Skip to content
TypeAndBuild

TypeAndBuild · Legal

Privacy Policy

Effective and last updated: 8 October 2026.

This policy explains how TypeAndBuild handles personal data when you visit our website, use our website builder and account services, or use our advertising tools. Optional features apply only when they are enabled or connected.

Who is responsible for your data

TypeAndBuild is a brand operated by HAUGSTRUP HOLDING ApS, CVR 29801274, c/o Jeppe Haugstrup, Grejsdalsvej 360, 7100 Vejle, Denmark. In this policy, “we”, “us” and “our” refer to that company.

We are the data controller for our own accounts, platform administration, billing, support and security. Contact us about privacy or your rights at hello@typeandbuild.com, by telephone on +45 60 22 01 50, or at the postal address above.

When a customer uses TypeAndBuild to collect enquiries or publish their own website, that customer determines the purpose of their visitors’ data and is normally the controller. We process that data on their instructions to provide the service. Their privacy notice also applies; this policy does not replace it.

Information we collect

  • Accounts and communication: your email address, any name or business details you provide, account status, website ownership, invitations, sign-in records and correspondence with us.
  • Website and AI work: your instructions, conversations, uploaded images and files, website content, revisions, results, work status and usage records. Content can contain personal data if you include it.
  • Service and security: IP addresses, request times, browser and device information, session records, errors and audit events used to operate and protect the platform.
  • Billing and advertising: balances, usage, transactions, approved budgets, campaign settings, performance and records of your approvals. A connected service may provide account identifiers and billing-readiness information; this is not access to your full payment-card details.
  • Enquiries and feedback: information submitted through managed contact forms, and ratings or comments you choose to send. Editor feedback includes the related account, website and work reference, IP address, approximate country, time zone, language and broad device/browser details.

We obtain data from you, your use of the service, authorised collaborators, connected providers and public websites you ask us to use as references. Provide only information necessary for your request. Do not put passwords, access tokens or unnecessary sensitive personal information into prompts or forms.

Under the GDPR, our legal basis depends on the purpose:

  • Providing the service and responding to requests: creating and administering your account, hosting and editing websites, performing requested AI work and managing authorised advertising are necessary for our contract with you or steps you request before a contract (Article 6(1)(b)).
  • Business contacts, reliability and protection: handling an organisation’s account contacts, support, abuse prevention, security, troubleshooting and service feedback serves our legitimate interests in operating a reliable service and protecting users (Article 6(1)(f)), balanced against your rights.
  • Legal obligations: records needed for accounting and responding to lawful obligations are processed under Article 6(1)(c).
  • Optional measurement: advertising attribution that needs your permission uses consent (Article 6(1)(a)). You can decline or withdraw it without losing access to ordinary contact forms.

An email address and necessary account/security information are required for sign-in and account services. Optional feedback and advertising measurement are not required. Where we process a customer’s visitors’ data on instructions, the customer is responsible for identifying their legal basis.

AI and connected services

AI services process the instructions, files and relevant website or conversation context needed to complete your request. Depending on your account’s connection, this may involve OpenAI, your connected ChatGPT account, or OpenRouter and the underlying AI provider. Provider terms and account settings also apply. Published website content is accessible to visitors and may be indexed by search engines.

Authorised staff may access account information and work records when necessary for support, security and service administration. Access is restricted by role. Connected credentials are handled separately from website content; stored provider credentials are encrypted. Do not submit information you lack permission to share with the selected service.

When you authorise a Google Ads connection, we can access the advertising accounts available to that connection. Relevant data includes account and manager identifiers, names, currency and time zone, campaigns, ads, keywords, bids, budgets, status, performance and conversion reports. We use it to prepare plans, carry out actions you authorise, manage approved advertising and show results. Preparing a plan does not itself authorise advertising spend.

Connection credentials allow continued access until they expire or access is revoked. They are stored securely and are not published on your website. Limited campaign summaries may be sent to the AI service used for planning or review. Google connection tokens, advertising click identifiers and raw enquiry messages/contact details are excluded from the ad planner’s AI context.

We do not sell Google user data, use it to build unrelated advertising audiences, or use it to train our own general-purpose AI models. TypeAndBuild’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements where applicable.

You can revoke access through your Google Account connections and contact us to request deletion of stored connection data. Revoking access does not delete records we must retain or automatically stop campaigns already running at Google. Stop advertising first, or pause the campaigns directly in Google Ads if access has already been removed. Google’s own processing is described in Google’s Privacy Policy.

Cookies, website analytics and advertising measurement

We use necessary cookies for sign-in, session security and protection against forged requests. Standard sessions have limited lifetimes; choosing “Remember this computer” uses persistent sign-in cookies with a lifetime of up to 400 days, which can refresh when you use the service. Signing out or clearing cookies removes that browser’s sign-in state. Browser storage also remembers non-secret preferences, drafts and pending work references. Blocking necessary cookies prevents sign-in features from working.

On customer websites where our built-in analytics is enabled, we keep daily totals for page paths, referring website names and approximate countries for up to 90 days. This analytics does not use tracking cookies, persistent visitor identifiers or fingerprinting, and does not store visitor IP addresses. An IP address may be used briefly to estimate country locally; separate security logs can contain IP addresses. Supported Do Not Track and Global Privacy Control signals are respected by this analytics feature.

Optional advertising attribution starts after consent on the customer website. It can retain an advertising click identifier, consent record, page/event context and a browser reference for up to 90 days to connect an advert to a genuine enquiry. Where configured and authorised, consented conversion information is sent to Google for measurement. Declining does not stop the form from working. Withdrawal stops future optional collection and pending exports and removes associated attribution data from our active measurement system; it cannot recall information already received by Google or other recipients.

Customer-added analytics, embeds, advertising tags and other third-party features can have different practices. The website owner must explain those separately.

Recipients and international processing

Data is shared as needed with hosting and backup providers, AI providers, Google for connected advertising, and email providers for sign-in, support and service notifications. Managed form submissions are available to the website owner and authorised platform administrators, and can be included in email notifications to the owner’s registered or verified notification address. We use Google’s email service for platform messages. We may also disclose relevant records to professional advisers or public authorities when legally required or necessary to establish or defend a legal claim.

Some providers can process data outside the European Economic Area, including in the United States. International transfers require an applicable legal mechanism, such as an adequacy decision or appropriate safeguards including European Commission Standard Contractual Clauses. Contact us for information about the recipients, processing locations and transfer safeguards applicable to your use of the service. A connection to a third-party account is also subject to that provider’s own privacy arrangements. We do not sell personal data.

How long information is kept

Retention depends on the purpose and the relevant account or website:

  • Accounts, websites and work history: kept while needed to provide the account, preserve your content and revisions, resolve requests or meet legal obligations. Ask us to close your account or exercise deletion rights. Deleting a website does not automatically close its owner’s account.
  • Managed form enquiries: kept for the website owner until removed by the owner or an authorised administrator. Copies already delivered by email follow the recipient’s retention practices.
  • Built-in visitor analytics and optional attribution: up to 90 days. Withdrawal can remove optional attribution earlier.
  • Editor feedback: raw IP addresses are removed within 90 days of the latest feedback, plus the routine cleanup interval. Remaining feedback and context are linked to the associated account, website or work record and removed when that related record is deleted.
  • Temporary work records: failed build workspaces are normally kept for 24 hours, execution logs for seven days and completed, audited job records for 30 days. These short periods do not apply to your saved conversations, website revisions or financial records.
  • Legal and security records: kept for the applicable accounting requirements, investigation or claim period. We limit retention to what that purpose requires.

Deletion from active systems does not immediately erase earlier backup copies. Backup copies are handled separately for recovery and retention requirements and are not ordinary working copies. Contact us for the retention and deletion position of a particular record, including connected Google data.

Security

We use HTTPS, access controls, protected sessions, restricted operational access and encryption for stored connection credentials. Access is limited to the people and systems that need it for the service. No online service can guarantee that a security incident or provider failure will never occur. Tell us promptly if you suspect unauthorised access to your account.

Your rights and choices

Depending on the circumstances, you can request access, correction, deletion, restriction of processing or a portable copy of your data. You can object to processing based on legitimate interests and withdraw consent at any time without affecting earlier lawful processing. These rights are subject to the GDPR’s conditions and exceptions.

Write to hello@typeandbuild.com. We may need proportionate information to verify your identity. We normally respond within one month; if the law permits an extension, we will explain it. For an enquiry submitted to a customer’s website, contact that business first; we assist it with requests relating to data we process for it.

You may complain to Datatilsynet, the Danish Data Protection Agency, or your competent supervisory authority. Datatilsynet’s address is Carl Jacobsens Vej 35, 2500 Valby, Denmark. You do not have to waive any rights to contact us or use the service.

We update this policy when our practices change and show the date above. Material changes will be brought to affected users’ attention as appropriate. New uses of connected Google data will be disclosed before they begin, with renewed consent where required. Our Terms of Service explain the service agreement, advertising approvals and payment arrangements.