Privacy

The controller under the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR) is:

Vercel Inc. serves the site and records standard request logs: IP address, date and time, page requested, browser and referring page. They are used to deliver the site and protect it against abuse (legitimate interest, GDPR art. 6(1)(f)). See the Vercel privacy notice.

Fonts, brand assets and preview videos are served from buildindex.dev. Build Index sets no analytics cookies and does not save marketing attribution in browser storage.

We use Vercel Web Analytics to measure page visits and clicks on Buy. Vercel receives the analytics request and its normal browser and referrer context, subject to your browser's referrer policy. Processing includes the requesting IP address to derive a daily visitor identifier; that identifier is discarded after 24 hours. Reports include aggregate information such as page paths, referring sites, approximate locations, browsers and devices. This identifier is not an account or an identifier shared across websites. See the Vercel Web Analytics privacy documentation.

Our custom events contain only a broad source label (Instagram, direct or unknown, or another source) and, where relevant, the template name. We remove query strings and fragments from page addresses sent to analytics. We do not attach names, email addresses, payment details, checkout identifiers or search text to these events. We do not use Meta Pixel or send these statistics to Instagram.

Limited campaign labels, such as the source, medium, campaign and content of an Instagram link, are kept in memory and carried in navigation URLs. When you click Buy, these labels and an opaque purchase reference are passed to Polar and can become part of the order metadata. We compare them with paid orders to prepare aggregate sales reports. We do not send buyer records or purchase events to Vercel Web Analytics, and an opened checkout or a confirmation screen is not counted as a paid order.

We disable audience statistics and marketing attribution when your browser sends Do Not Track or Global Privacy Control. Local development, preview deployments, automated browser checks and explicitly marked internal tests are excluded from audience statistics. A technical test flag can be stored in sessionStorage for the current tab so our own checks remain excluded while navigating; it contains no marketing data. You can clear it with Exit test mode. Marked checkout tests are kept separate in sales reports.

When you click Buy, Polar's checkout opens. As merchant of record, Polar collects your name, email, billing country or address and payment details to process the order, deliver the download and handle tax. Card payments are processed by Stripe; we never see your card number. Polar and Stripe may set cookies needed for payment and fraud prevention. See the privacy policies of Polar and Stripe.

Polar shares your name, email, country and order details with us. We use them to deliver your files, answer support requests and keep the records accounting law requires (contract and legal obligation, GDPR art. 6(1)(b) and (c)).

Mail sent to hello@buildindex.dev is hosted by Infomaniak Network SA in Switzerland. We use your message and address only to answer you.

• Vercel Inc., USA: hosting and aggregate audience statistics.
• Polar Software, Inc., USA: checkout, receipts, delivery, tax and campaign attribution attached to orders.
• Stripe, through Polar: card payments.
• Infomaniak Network SA, Switzerland: email.

We don't sell or rent personal data and don't use it for advertising.

Vercel, Polar and Stripe process data in the USA. These transfers rely on the safeguards Swiss and EU law recognise, such as certification under the Swiss-US and EU-US Data Privacy Framework or standard contractual clauses.

• Request logs: for the short period set by Vercel.
• Aggregate analytics: Vercel's standard Pro reporting window is currently 12 months. This is a guaranteed reporting window, not a promise that all aggregates are deleted at its end; Vercel may retain them longer. See its reporting-window documentation.
• Campaign labels attached to a Polar order follow the order record. The technical internal-test flag lasts for the current tab session or until you exit test mode.
• Orders and receipts: 10 years, as Swiss accounting law requires (art. 958f Code of Obligations).
• Emails: as long as needed to handle your request, longer only if they belong to an order record.

You can ask what data we hold about you and have it corrected or deleted, object to its processing, or receive it in a portable format. Write to hello@buildindex.dev. You can also complain to the Federal Data Protection and Information Commissioner in Switzerland or, in the EU, to the data protection authority of your country.

We update this page when the way we handle data changes. The date at the top shows the last update.