Legal

Privacy policy

Plain-English version: we keep what you give us and a record of how you use this website, measured by our own analytics (no Google Analytics, no advertisers). Where the law asks for your permission first, we ask first. June, the assistant on every page, is an AI: what you type to her goes to our AI model provider, and we keep the chat. We use all of it to answer you and to make the site better, we never sell it, and you can have it deleted by sending one email.

Effective date: October 11, 2026. This policy covers buildwithik.com and the software services we operate. "BuildWithIK" is the trading name of Indra Kamal International Private Limited, registered in Nepal at Ward No. 3, Krishnagalli, Lalitpur, Nepal, 44700, and Build With IK LLC, registered in the USA at 30 N Gould St, STE R, Sheridan, WY 82801, USA (together, "we" and "us"). Questions or requests: anup@buildwithik.com. Using the site is also covered by our terms of use.

What we collect

• Information you give us: when you book a call, ask for a call back, chat with June (our AI assistant), request a site audit or write to us: your name, email address, phone number, company, website, time zone, and what you tell us, and for a booking the time you chose. What you type to June goes to our AI model provider so she can reply, and is kept with the conversation (see AI on this site). If you talk to June instead of typing, your browser’s own speech recognition turns your voice into text (depending on the browser, its maker’s speech service may do this, for example Google in Chrome); we receive only the text, never the audio.
• How you use this website: we run our own analytics, on our own servers at Cloudflare (no Google Analytics, no advertising or social-media trackers). What we record depends on where you are and what you chose (see Your privacy choices):
  • Full analytics: your IP address and the approximate location Cloudflare derives from it (country, region, city, postal code, time zone and approximate coordinates), your network provider, browser, device, operating system and language, the page or link that brought you here (including campaign tags such as UTM parameters and ad click IDs), the pages you view, your clicks, scrolling and time on each page, the names of form fields you use (not what you type in them, except the contact details you choose to send us), errors, and how fast pages load.
  • Coarse count only: the page, the time, your country, the kind of device, the browser family, the domain of the website that sent you and its campaign tags. No IP address, no cookie that recognises you, nothing that links one page to the next.
  Whichever applies, our analytics record that you sent June a message (its length), never what you wrote.
• Cookies: first-party only, never third-party. With full analytics, bwk_v recognises a returning browser (up to 13 months), bwk_s groups the pages of one visit (30 minutes), and bwk_pr remembers which referral partner’s link brought you, if one did (90 days). Always, because they are needed to respect your choice: bwk_c remembers whether you accepted or rejected analytics (12 months), bwk_r remembers which rules apply to your visit, with no location detail (1 day), and bwk_n remembers that you have seen a privacy notice, where we show one (12 months). The booking form’s spam check (Cloudflare Turnstile) runs a short challenge in your browser.
• Form drafts: while you fill in a form on this site (a booking, a call back, the site audit, a message to June, an NDA or a proposal you sign), what you type is kept only in your own browser, in its local storage, so a reload or a closed tab doesn’t lose it. A draft is never sent to us: we receive only what you send. It is cleared when you send the form, when you choose Discard, or after 7 days. Passwords, one-time codes, and bank, card, tax and ID numbers are never kept in a draft. On a shared computer, choose Discard before you leave.
• Automated visitors: search engines, AI crawlers and other bots are recorded by name, without cookies.
• Linking: with full analytics, when you give us your email or phone number (a booking, a form or the chat), we link it to the visits made from that browser, so the founder who answers you knows what you have already seen. With the coarse count, nothing is linked.
• Referral partners: if you join our referral program, your name, email address, country, how you plan to find clients, the link or campaign that brought you, and the network address and browser you signed up and sign in from. Before your first payout: a government ID, a tax form (W-9 in the US, W-8BEN or W-8BEN-E elsewhere), which carries your tax identification number, your postal address and your payout details: the details of a bank account that can receive an international transfer, which we pay through Wise (you don’t need a Wise account; you may add the email of one you already have), or a US bank account for US partners. The ID, the tax form, the address and the payout details are encrypted before they are stored, and only the founders can open them. If you fill in and sign your tax form online, we also keep the record of your signature with the form, for as long as we keep the form: when you opened the signing page, agreed to sign electronically and signed, from which network address and browser, and your account’s email address; the record is sealed so that anyone holding its document ID can check that it has not changed (the check shows no personal data). We check partners’ names against the US government’s sanctions lists: automatically when you join, when you add payout or tax details and every week after that, or by hand before we pay (see Who we share it with), and we keep a record of each check for as long as we keep your name.
• Partners’ questions and feedback: in the partner dashboard, a partner can ask June, our AI assistant for partners, ask the founders a question, and send us feedback. We keep what they write there with their partner account: their chats with June, their questions and our answers, and their feedback with its status and our reply. If they speak their feedback instead of typing it, their browser’s own speech recognition turns it into text (depending on the browser, its maker’s speech service may do this); we receive only the text. June answers from the partner agreement, the program’s own pages and the partner’s own account, never anyone else’s; what a partner types to her goes to our AI model provider (see AI on this site). The founders read these chats, and get a daily summary of them by email. None of it goes to our analytics.
• Invitations to our partner program: if one of our founders invites you to join our referral partner program, we keep your name and email address, the country and the personal note the founder added (if any), when the invitation and its one reminder were sent, and whether you joined or asked us not to email you again. June, our AI assistant, writes the email on the founder’s behalf and our email provider sends it; it carries no tracking pixels. If you choose “Please don’t email me again”, we keep only a one-way fingerprint of your address (never the address itself), so we never email you about the program again.
• Calls with us: when you book a call, we record and transcribe it so we can take notes, unless you ask us not to (see Call recordings and notes).
• If a partner introduced you: the partner gave us your name, company, contact details and a short description of your project, and told us you agreed to the introduction. You can ask us to delete it at any time.
• Partner links, client records and signed proposals: if you arrive through a referral partner’s personal link, we note that partner’s code, so the partner is credited if you book a call or leave your details. Where full analytics are on, the first-party cookie bwk_pr remembers it for 90 days. Otherwise (where analytics need your consent first and you haven’t given it, or you chose Reject or your browser sends a Global Privacy Control signal) we set no cookie: the code travels only in the link you followed, for that visit. The partner learns only your company’s name (or your email’s domain) and how far our work together goes, never what you tell us. We keep everything you send us in one client record per email address, with our notes and the history of our contact. When you sign a proposal online, we keep a sealed record of the signature (your typed name, title and company, your email address, network address and browser, when you opened, viewed and signed it, and a fingerprint of the exact document) that anyone holding its document ID can check without seeing any personal data. When you pay us, we record the payment with your client record: the amount and currency, the day it arrived, how it was paid, its reference (an invoice number or transfer ID), what it was for and the founder who recorded it.
• Mutual NDAs: before a first call, we and the business we talk to can sign a mutual non-disclosure agreement online. When you book a call, we prepare one for you straight away from the name and email you booked with (and your company, if you gave it): its link is in the confirmation email we send you, and you add the company’s legal name, its country and your title when you open it (we may suggest the country from your connection’s location; you confirm it). If a referral partner introduced the business, the partner may send it instead. It carries the company’s legal name and country (they decide the NDA’s governing law and any territory rider), and the name, title and email of the person who signs for it. Signing it is up to you: if you tell us you don’t need one, we note that, and the call goes ahead. When they sign, we keep a sealed record of the signature, as for a signed proposal (the typed name, title and company, the email address, network address and browser, when the link was sent, opened and signed and when consent to sign electronically was given, any territory step, such as the language a client in Quebec chose to sign in, and a fingerprint of the exact document), and the client record keeps who signs for the company. The partner who introduced the business sees only whether it was sent, opened and signed, and when: never the NDA or anything the signer changed. Anyone holding its document ID can check the seal without seeing any personal data.
• Nothing else. We don’t buy data about you. Apart from what this list describes (a partner’s introduction, and the approximate location Cloudflare derives from your IP address), we don’t add data about you from other sources.

Call recordings and notes

When you book a call with us, we record and transcribe it so the founder you speak with can keep accurate notes. You can say no: tick Please don’t record my call when you book, change it later on the page that manages your booking, reply to your confirmation email, or simply tell us when the call starts.

• What we record: if you choose Zoom, Zoom records the call in our Zoom account and makes a transcript (who said what, and when); if you choose Google Meet, Google Meet transcribes the call in our Google Workspace. We also receive the list of who joined (their names, and email addresses where Zoom shows them). Zoom and Google Meet tell everyone in the call when it is being recorded or transcribed.
• Why: from the transcript we make short notes for your client record (a summary, the key points and the next steps), so whoever follows up knows what you told us and you do not have to repeat it. We also use the list of who joined to know whether the call took place.
• Who processes it: Zoom or Google (they make the recording or transcript), an AI model provider that reads the transcript to write the notes (Groq, with its zero-data-retention setting on, so it does not keep what we send), and Cloudflare (it stores our copy of the transcript, encrypted). A transcript only ever goes to an AI provider whose terms say it is not kept or used to train models; never to a free service that may use it that way.
• How long: our copy of the transcript is deleted 90 days after we receive it; the notes stay with your client record for as long as we keep your other correspondence (below). We delete the recording and transcript that Zoom or Google keep in our accounts when they are no longer needed for the notes.
• If you opt out: nothing is recorded or transcribed, and any notes are written by hand. If you opt out after a call has taken place, we delete its transcript and the notes made from it.
• Referral partners: if a partner introduced you, they learn only that a first meeting took place and its date, never the recording, the transcript or the notes.
• Legal basis (EEA, UK and Switzerland): our legitimate interest in keeping an accurate record of what you tell us, so we can follow up properly. You can object at any time, before or during the call, and we will take notes by hand instead.

Your privacy choices

Where you are decides how our analytics start:

• In the European Economic Area, the United Kingdom, Switzerland, Brazil, Turkey, South Korea, China and Quebec: nothing that identifies you is recorded until you choose Accept. Until then, and if you choose Reject, we keep only the coarse count.
• Everywhere else: full analytics are on. You can choose Reject at any time with Privacy choices, and we switch to the coarse count.
• Everywhere: a Global Privacy Control or Do Not Track signal from your browser counts as Reject, even if you accepted before. You can change your choice at any time with Privacy choices at the bottom of every page.

How we use it

• To respond to you, schedule calls, and deliver the services you request.
• To run tools you invoke. For example, our AI site audit and chat process the text and URLs you submit in order to produce their results.
• To keep the site secure, and to understand how it’s used so we can improve it (for example, which pages lead people to book a call).
• To run the referral program: to confirm who a partner is, to meet our tax obligations, to check payouts against sanctions lists, and to pay commissions.
• We don’t make decisions about you based only on automated processing that have a legal or similarly significant effect on you. A possible match on a sanctions list, for example, holds a partner’s referrals and payouts only until a founder has reviewed it, and the founder decides.
• We do not sell or rent personal information, we do not share it for cross-context behavioural advertising, and we do not use it for third-party advertising.

AI on this site

• June is an AI assistant, not a person. She answers from our own documents and passes anything specific to a founder. The suggested questions are answered with text we wrote; anything else you type or say goes to our AI model provider, Groq, to write her reply, and we keep the conversation so a founder can follow up. An AI also writes a short summary of each conversation we keep, for the founder who reads it. Groq has zero data retention turned on for us, so it doesn’t keep what we send. If June ever uses another provider, it is only on terms that don’t let that provider use what you type to improve its products.
• June for partners: in the partner dashboard, June answers questions about the referral program, the partner agreement and the partner’s own account (their introductions, balance, payouts and setup), from those documents and that account only. What a partner types goes to Groq to write her reply, and we keep the chat with the partner’s account; the founders read it. She offers a founder whenever a question needs a person, and she gives no legal or tax advice.
• The site audit is written by AI from what our audit engine sees on the site you submit: it sends screenshots and text of that site’s pages to AI model providers (Groq, Google’s Gemini API and Cloudflare’s own models) to score them and suggest fixes.
• Call notes are drafted by AI from the call’s transcript, unless you ask us not to record (see Call recordings and notes).
• AI answers can be wrong. Nothing June or an audit says is an offer or a promise about a project; our terms of use explain what they can and can’t do.
• No AI on this site makes decisions about you that have legal or similarly significant effects.

Legal bases (EEA, UK and Switzerland)

We answer you, book calls, keep your conversation with June and run the tools you ask for because you asked: as steps before or under a contract with you, or, where that doesn’t fit, under our legitimate interest in answering and following up on what you asked us. We record and transcribe calls under our legitimate interest in an accurate record of them, and you can opt out (see Call recordings and notes). We keep the coarse count, the bot log and our security records under our legitimate interest in running a safe, working website; they hold nothing that identifies you. Full analytics, the link between your visits and the contact details you give us, and a partner link’s 90-day cookie run here only with your consent, which you can withdraw at any time with Privacy choices. We run the referral program (confirming who a partner is, collecting a tax form, checking names against sanctions lists, paying commission, and answering partners’ questions and feedback, June included) to perform our agreement with each partner, and under our legitimate interest in meeting the US tax and sanctions laws that apply to us as a US company. Where EU, UK or Swiss law requires us to keep a record, we keep it because we must. We keep a signed mutual NDA and its record to perform it and to establish, exercise or defend legal claims under it; an NDA that was sent and never signed is correspondence, kept as such.

Data from connected platforms (including Meta)

Some of our products connect to third-party platforms, such as Facebook Pages, Instagram or WhatsApp via Meta’s APIs, on behalf of business clients who explicitly authorize that connection through the platform’s own login and permission flow. For such data we act as follows: we access only the data the platform permissions cover (for example, comments and messages on the client’s own pages and accounts); we use it solely to provide the contracted service to that client (such as customer-feedback analysis); we do not sell it, use it for advertising, or share it beyond the service providers needed to operate the product; and we handle it in accordance with the Meta Platform Terms and Developer Policies. Platform data is deleted when the client disconnects the integration, when our agreement with the client ends, or upon request as described below. You can also ask the business you interacted with; it can instruct us to delete the data.

Who we share it with

Only the service providers that make the site and our products work, our processors:

Each is bound to use the data only to provide its service to us. We’ll update this list before we add a provider that handles your personal information.

To check a partner’s name against sanctions lists, we look it up in the US government’s own search services: the Consolidated Screening List at trade.gov, automatically, or OFAC’s sanctions search, by hand. We send only the name.

In the products we build for clients, the client’s data stays in systems they control; where a product uses an AI service, we choose one whose business terms don’t use that data for training. We may also disclose information if the law requires it.

Where it is processed

We work from the United States and Nepal, and our providers process data in the United States and other countries where they operate. When we or our providers move personal information out of the EEA, the UK or Switzerland, the transfer rests on the European Commission’s standard contractual clauses (with the UK and Swiss additions), which are part of our providers' data processing terms, or on another safeguard the law recognises; we don’t rely on the EU–US Data Privacy Framework. Ask us for a copy.

How long we keep it

Form submissions, bookings and correspondence (including your conversations with June and the notes from our calls): for as long as we’re talking, and up to 24 months after our last contact so we have context if you come back. Call transcripts: 90 days. Analytics: the raw log of each page request, and the visit and event records, for 90 days; the record of a browser, and any contact details linked to it, until 24 months after its last visit. Daily totals (counts by page, source, country, city and device) are kept indefinitely: they hold no personal details. Platform data connected by clients: for the duration of the client agreement. Signed proposals and their signature records: for as long as the agreement runs and 10 years after it ends. Payments recorded with a client record (accounting and tax records), and the client record they belong to: 7 years after the latest payment. Signed mutual NDAs and their signature records (with the client record they belong to): for as long as the NDA is in effect, then 13 years (the 3 years its confidentiality promises outlast it, plus the 10-year limitation period for claims on a written contract), and never less than 10 years after it was signed; an NDA that was sent (or prepared when you booked a call) and never signed, or that you told us you don’t need: 24 months after it was last sent, opened or answered. A shared site-audit report: 12 months after you make its link, then it is deleted.

Backups: our nightly backups (of everything except the raw analytics) and our database’s own restore history keep copies for up to 30 days, for recovery from a failure only. Something deleted from our live systems can stay in them for up to 30 more days; then it is gone too.

Referral partners (and the clients they introduce): each kind of record has its own period, and we delete it when the period ends.

• Your profile and activity (your answers when you joined, where you came from, sign-in records): 2 years after your last activity or the closing of your account, whichever is later.
• A referred client's contact details (their name, email, phone and the brief) and our notes on that introduction: 2 years after the introduction goes quiet. We keep the company name and the money records.
• Copies of your ID: 5 years after your last activity or your last payout, whichever is later.
• Tax forms (W-9, W-8BEN, W-8BEN-E): 7 years after your last payout or 2 years after your last activity, whichever is later (if we never paid you, 2 years after your last activity).
• Payout records: 7 years after each payout (the payout details on a request we did not pay: 2 years after that decision). Your current payout details: removed after 2 years without activity; you can enter them again. Commission we still owe you is never deleted.
• Your name, email and postal address, and the record of each acceptance of the partner agreement (the version, the confirmations you ticked, the time, your network address and your browser): kept as long as any record above is kept, and at least 2 years after your last activity. Then we remove your name, email, address, network address and browser; the version, the confirmations and the time stay.
• Your chats with June in the dashboard, your questions to the founders and your feedback, with our answers: 2 years after the last message or change, or sooner, with your name and email, if those are removed first.
• Invitations to the partner program: 2 years after the invitation’s last change (sent, reminded, joined or declined). If you asked us not to email you again, the one-way fingerprint of your address stays, so that we never do.

Your rights and data deletion

You can ask us at any time to see, correct, or delete the personal information we hold about you, including the analytics records linked to you. You can also clear or block our cookies in your browser; the site works without them. To request deletion: email anup@buildwithik.com with the subject "Data deletion request" from the address you used with us (or identify it), and we will delete your data from our systems within 30 days and confirm by reply. If your data reached us through a platform integration (for example, a Facebook or Instagram interaction with a business we serve), name that business and platform and we will delete the associated records the same way.

If we say no. If we can’t do what you ask (for example, because the law makes us keep a tax record), we’ll tell you why. You can appeal by replying to our answer with "Appeal" in the subject. A founder who didn’t handle your request will review it and answer within 45 days. If we still say no, you can complain to your data protection authority or, in the US, to your state attorney general.

In the EEA, the UK and Switzerland you also have the right to restrict or object to our use of your data, to receive it in a portable format, to withdraw consent at any time (without affecting what happened before), and to complain to your data protection authority.

Your rights in US states (including California)

In the last 12 months we collected these categories of personal information: identifiers (name, email address, phone number, IP address and cookie IDs); internet activity on this website (pages, clicks, referrers and what you type to June); approximate location derived from the IP address; professional details you give us (company, title and website); audio recordings and transcripts of calls, unless you opt out; signatures and signature records; commercial information (the payments a client makes us); and, from referral partners only, sensitive personal information (a government ID and the tax identification number on a tax form) and financial details (payout account details). They come from you, from your browser, from Cloudflare’s IP-based location and from a referral partner who introduced you. We use them for the purposes above and keep them for the periods above. We do not sell or share personal information (as California law defines those words), and we honour Global Privacy Control. We use sensitive personal information only to confirm who a partner is, meet tax law and pay commission, never to infer anything about anyone, so there is nothing to limit.

You have the right to know what we hold about you, to get a copy, to have it corrected or deleted, and not to be treated differently for using these rights. Email anup@buildwithik.com from the address you used with us; we confirm the request from that address and answer within 45 days. Someone you authorise in writing may ask on your behalf.

Notes for your country

• India: our grievance officer is Anup Rao (anup@buildwithik.com); we resolve grievances within one month. We treat anyone under 18 as a child. If you’re a referral partner, please send a PAN card or passport as your ID, not an Aadhaar card (or hide the first eight digits of your Aadhaar number).
• Nepal: our Nepal studio handles personal information under Nepal’s Individual Privacy Act, 2018, and the same contact applies.
• Switzerland: you can complain to the Federal Data Protection and Information Commissioner (FDPIC).
• Canada: you can complain to the Office of the Privacy Commissioner of Canada. In Quebec, our person in charge of the protection of personal information is Anup Rao (see Contact); your information may be communicated outside Québec (see Where it is processed); and you can complain to the Commission d’accès à l’information.
• Brazil: our data protection officer (encarregado) is Anup Rao (see Contact). You have the right to confirm that we process your data, to access, correct, anonymise, block or delete it, to port it, to know who we have shared it with, to be told when you can refuse consent and what follows if you do, to withdraw consent, to ask for a review of a decision made solely by automated means, and to complain to the Autoridade Nacional de Proteção de Dados (ANPD).
• Singapore: our data protection officer is Anup Rao (see Contact). You can complain to the Personal Data Protection Commission.
• Australia: you can complain to us first, and then to the Office of the Australian Information Commissioner.

Security

Data lives on access-controlled infrastructure (Cloudflare), transmitted over HTTPS, with credentials restricted to the people who need them. The link between our booking system and our calendar is stored encrypted. No system is perfectly secure, but we keep the surface small: we collect little, so there is little to lose.

Children

Our services are for businesses and are not directed at children, and we do not knowingly collect their information. We treat anyone under 16 as a child everywhere (stricter than US law, which uses 13), and anyone under 18 where local law sets that age (India, for example). If you think a child has given us information, tell us and we will delete it.

Changes

If we change this policy, we’ll update this page and its effective date, and flag meaningful changes on this page rather than bury them. We won’t use information you’ve already given us in a materially different way without asking you first.

Contact

Privacy contact: Anup Rao, Co-founder & CTO, anup@buildwithik.com. He is our person in charge of the protection of personal information (Quebec), our data protection officer (encarregado) for Brazil, our data protection officer for Singapore, and our grievance officer for India, where we resolve grievances within one month.

Indra Kamal International Private Limited · Ward No. 3, Krishnagalli, Lalitpur, Nepal, 44700 · Build With IK LLC · 30 N Gould St, STE R, Sheridan, WY 82801, USA · anup@buildwithik.com