Privacy policy

Who we are

Business Builder by JKRB designs and builds websites for small businesses in the UK. It is a trading name of JKRB Investments Limited, the company responsible for your data (the "data controller"). For anything in this policy, you can reach us at hello@jkrb.build or on WhatsApp via the button on any page.

JKRB Investments Limited is registered in England and Wales under company number 10576770. Registered office: 5th Floor, 167-169 Great Portland Street, London, W1W 5PF. That is a postal address for legal notices, not an office you can visit: we work with you online.

What we collect, and why

We collect as little as we can get away with:

• Applications: your contact and business details, requirements, links and optional supporting files. We store the application and proposal in our PostgreSQL database and supporting files in private Cloudflare R2 storage. Authorized JKRB administrators can access supporting files; the client can download preview images included in their published proposal. We use these details to review your request, prepare your proposal and contact you about your project.
• Client accounts: your name, verified email, optional business and phone details, linked sign-in providers, application messages and proposal approvals. Passwords are stored as hashes. Essential sign-in cookies, session records, IP addresses and browser details help secure your account. You can update your details, reset your password and sign out other devices in account settings.
• Project emails: Resend delivers verification and password recovery links, application and proposal updates, replies from our team, approval confirmations and payment confirmations. These are service messages about your account and project.
• What you send us on WhatsApp: your name, your number and whatever you tell us about your business. We use it to prepare your proposal and build your site. WhatsApp itself is operated by Meta under its own privacy policy.
• What you send through the contact form: your name, your business name, your email, your phone number if you add one, and your message. We use it to reply and prepare your proposal, nothing else. It reaches us by email, you get one confirmation email back, and both are delivered by Resend.
• Payment details: handled entirely by Revolut. Your card number never touches our servers. We see your name, your business name, the amount and a payment reference, which we keep for accounting. If you pay for a care plan, Revolut also stores your card so it can take the renewal.
• Content for your website: the words, photos and details you send us to publish. They remain yours.
• Anonymous visit statistics: we use cookieless analytics (Vercel Analytics and Simple Analytics) that count visits without identifying you, on the public website. Client accounts use essential sign-in cookies.
• Ad measurement, also without cookies: if you arrive from one of our Google ads, we count whether that visit led to a WhatsApp tap, a sent enquiry or a submitted application, so we know the ad was worth paying for. This runs in Google's cookieless mode: it sets no cookies, builds no profile of you, and never tells us who you are.

The AI assistant

If you use Ask JKRB, your messages and the recent conversation are sent to OpenAI to generate answers about our service. Please do not share sensitive personal information, passwords or payment details. Chat messages are not automatically sent to our team; use the contact form or WhatsApp when you want a reply from a person.

The visible conversation is kept in your browser tab’s memory. Starting a new chat, reloading or closing the page clears it. Our assistant does not save transcripts to a JKRB database or include them in application logs. We request that OpenAI does not store responses for later retrieval; OpenAI may still retain content for abuse monitoring under its data controls, normally for up to 30 days, with exceptions for legal or safety requirements.

To prevent misuse and manage usage, we store request counts and a daily-changing, protected hash of your IP address in our PostgreSQL database. Visitor counting windows end within a day, and aggregate windows end at the end of each day or month. Expired counters are removed in batches as new assistant requests arrive; they may remain stored while the assistant is idle. The database receives neither your raw IP address nor your chat messages. We also log operational events and token counts to monitor reliability and running costs.

What we don't do

We don't sell your data, share it with advertisers, send marketing emails you didn't ask for, or profile you. We use no tracking cookies.

How long we keep things

Client account details, application messages, approval records, proposal snapshots, supporting files, WhatsApp conversations and project content are kept while we work together and for as long as reasonably needed afterwards to support your site. Payment records are kept for six years, as UK tax rules require.

Your rights

Under UK GDPR you can ask us at any time to see the data we hold about you, correct it, delete it, or hand it over in a portable format. Email us and we'll sort it, usually within days. If you're not happy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Third parties we rely on

The short list of services that make the site work:

• Vercel: hosting for this site and the sites we build.
• Google, Apple and GitHub: optional sign-in providers. If you choose one, we receive the profile and email details needed to create or connect your account. Their own privacy policies apply to their sign-in service.
• Revolut: payment processing and recurring care plan billing.
• WhatsApp (Meta): an optional contact and support channel.
• Resend: delivers account verification, password recovery, enquiry, application, proposal, message and payment emails.
• OpenAI: generates responses when you use the AI assistant, subject to its API data controls.
• DigitalOcean: hosts our PostgreSQL database, including applications, proposals and the assistant’s usage counters and protected visitor identifiers.
• Cloudflare R2: private storage for application attachments and proposal preview images.
• Vercel Analytics and Simple Analytics: cookieless visit counts.
• Google: counts, without cookies, whether our Google ads lead to WhatsApp taps, sent enquiries or submitted applications.