Legal
Data Processing Agreement
Last updated
For customers who need a DPA covering the data they store in BildrX.
Roles
For the cap-table, stakeholder, CRM and document data you store, you are the controller and BildrX is the processor, acting on your instructions as expressed through the product. For your own account and billing records, BildrX is the controller.
Sub-processors
Amazon Web Services (hosting and storage, Singapore ap-southeast-1); Supabase (database, authentication and file storage, Singapore); Anthropic (AI features); Stripe (payments); SignWell (electronic signatures); Resend (transactional email); Google (optional sign-in, and Google Analytics where the visitor accepted optional cookies — United States among other locations); Featurebase (support chat, help centre and changelog; on the marketing site the chat and the changelog each load only once the visitor opens them or accepted optional cookies); Tally (forms on the marketing site, once the visitor loads one), with Google reCAPTCHA inside those forms and Google Sheets receiving each submission; marketplace partners or subcontractors BildrX engages to carry out a marketplace order (the order details that work needs); Cloudflare (DNS).
The Privacy Policy describes what each one receives.
Security measures
Encryption in transit and at rest, role-scoped access enforced in the database, audit trails on signature events, and managed cloud infrastructure in Singapore. The security page describes current practice in plain language.
Contact
To start the conversation, contact legal@bildrx.com.