# [Privacy Policy](https://rebilder.com/legal/privacy) > How Rebilder collects and uses information, protects business data, and handles access, export and deletion requests. - **Updated:** 2026-09-14 - **Author:** Rebilder LLC - **Description:** How Rebilder collects and uses information, protects business data, and handles access, export and deletion requests. - **Section:** Legal - **Publisher:** Rebilder LLC ## Summary How Rebilder collects, uses and protects information, and how to exercise your privacy choices. ## Who we are Rebilder is operated by Rebilder LLC, a company established in the United States, which is the data controller for the personal data described in this policy. Data protection questions, access requests and deletion requests: privacy@rebilder.com. We answer from a monitored address rather than a form, and a request sent there is a valid request under the GDPR, the UK GDPR and the CCPA. For your Console account, your scan requests and your lead email, we are the controller. For the gateway events your install sends us and the content your site serves through it, we act on your instructions as a processor; your own privacy notice governs your visitors. ## What we collect — Console account data - Your email address and authentication records, held by our authentication provider. - The organisation and store records you create, including the domains you register. - API keys, stored only as a hash. The key itself is shown once, at creation, and we cannot recover it. ## What we collect — Gateway events, what your install sends us Gateway events include your store identifier, request time, requested URL, requester classification and verification, request headers and referral information, response source, presentation profile and processing time. They exclude visitor IP addresses, cookies and visitor identifiers. URLs can contain personal information; keep it out of the URLs your site supplies. ## What we collect — The Rebilder Tag, pageviews from your own site Merchants can install the Rebilder Tag to measure pageviews and AI referrals. We process page paths, referral classifications and declared browser automation on the merchant’s behalf, under their privacy notice. Tag records exclude query strings, IP addresses, IP hashes and raw user-agent strings. The tag sets no cookies, browser storage or visitor identifiers. It respects Do Not Track and Global Privacy Control. Visitor counts are labeled estimates. ## What we collect — Scan records Scan records contain the target URL, score, ruleset version and technical response metadata. We do not store third-party page bodies or prose excerpts in scan records. ## What we collect — Answers generation Rebilder and its AI service provider process business pages, policies, source references and question or request signals to prepare answers and assess customer questions. With Autopilot enabled, Rebilder uses the source pages you select to maintain answers under your authorization. ## What we collect — Autopilot sources and activity Autopilot records the source references and supporting passages used in its checks, your selected sources and permissions, the person who authorized changes, earlier and updated answers, and delivery-check results. These records support your report, corrections and undo. You can pause automatic changes in the Console. Shared compatibility research is a separate, optional preference; saving it does not activate a shared research program. ## What we collect — Email and marketing choices If you provide an email address with a scan, we store the address, related scan, timestamp and hashed IP to handle your request and contact you about that scan. The report opens in your browser. Marketing consent is separate and optional. We retain your consent wording and timestamp. Reports remain available when you decline marketing. Every marketing email includes a one-click unsubscribe that applies across campaigns. ## What we collect — Abuse prevention We use temporary IP hashes to limit abuse. Raw IP addresses are not stored in these records. Our bot-protection provider processes IP addresses and browser signals when a security check is used. ## What we collect — Visits to rebilder.com Our analytics provider measures visits to public pages, excluding the Console and sign-in screens. It processes page URLs, referrals, browser and language information and city-level location derived from an IP address that it discards. Analytics is cookieless and reported in aggregate, without persistent visitor identifiers. Hosting providers also maintain request logs. You can block public-site analytics with a content blocker and continue using the site. ## What we collect — Cookies and browser storage We use necessary session cookies for sign-in and security cookies for bot checks. A local browser preference remembers when you dismiss the guide offer; it stays on your device. Public-site analytics does not use cookies or persistent identifiers. We obtain consent before introducing non-essential cookies. ## Why we process it, and on what basis - **To provide the service** — Console accounts, event ingest, scan results, answer generation, authorized Autopilot checks and updates, and report delivery. Basis: performance of a contract with you. - **To protect the service** — Rate limiting, bot challenges, abuse investigation, security logging. Basis: our legitimate interest in protecting the service and the websites it visits, with hashed identifiers to limit data collection. - **To improve the product** — Aggregate measurement of how sites and agents behave. Basis: legitimate interest. Published aggregates are additionally floored at 25 independent sites. - **To send marketing** — Basis: your consent, recorded with the wording you were shown, withdrawable in one click. - **To comply with law** — Tax records, responses to lawful process, copyright notices. Basis: legal obligation. ## Rebilder and Mumm Rebilder and Mumm maintain separate account data. Per-site Rebilder data is not used for negotiation. Shared website-performance aggregates require at least 25 independent sites. Mumm buyer data is not shared with Rebilder, including in aggregated form. We do not use this data to create cross-site price or discount products or sell negotiation clearing prices. These commitments govern the information collected under this policy. ## Publication and removal - Nothing about a named third party is published on a Rebilder index, ranking or badge without a verified opt-in from the domain owner. - Nothing derived from an authenticated, merchant-supplied or locally-run scan is ever published. - A scan result for a domain that has not opted in is private to the person who ran it, carries no social card, and is excluded from search indexing. - Removal is free, self-serve and permanent, and it is never purchasable. - We may use a scan result as the basis for marketing contact with the business it describes, an email about that site’s own results, sent to a business address we hold or that is published for that purpose. We do this only for business contacts, never for a natural person’s personal address; every message identifies us, states why you received it, and carries a one-click unsubscribe we honour permanently. Unsubscribing is independent of removal: leaving our mailing list does not remove an index entry, and removing an index entry does not require you to be on it. If a person’s name is their domain, a sole trader, a freelancer, a personal site, the opt-in requirement is the whole protection, and it applies to them exactly as it applies to a chain. To remove an entry, write to privacy@rebilder.com from the domain; suppression happens while we verify, not after. ## Our crawler, and how to block it Our scanner identifies itself as rebilder-ars. To block it, add a robots.txt group naming rebilder-ars and disallow access. Request behavior and controls are documented at /bots. ## Who else sees it - Service providers for hosting, account access, storage, email, security, website analytics, AI-assisted answers and payment processing. They receive the information needed to perform those services. - Courts or law enforcement under valid legal process, with notice to you unless prohibited. - A successor to the business, subject to the privacy, product-separation and publication commitments in this policy. - We do not sell personal information or share it for cross-context behavioural advertising. For the provider details relevant to your data, contact privacy@rebilder.com. For a data-processing agreement and its provider information, contact legal@rebilder.com. ## How long we keep it - **Gateway events** — Retained for the window shown for your plan on /pricing, and in no case longer than 13 months. Deleted sooner on request. - **Tag pageviews** — Held for the same window as gateway events, never longer than 13 months, and deleted sooner on request. - **Scan records** — For a domain that has not opted into the public index: 90 days from the scan. For an opted-in domain: the most recent scan for as long as the entry is published, deleted immediately on removal. - **Scanner leads** — Unsubscribing soft-deletes the row and keeps the consent record, because the evidence of what you agreed to is the thing that protects you. An erasure request hard-deletes it. Otherwise the record is kept for 24 months from the last contact. - **Rate-limit rows** — Hashed buckets are disposable and expire within about 7 days. They are unlinkable across days by construction. - **Console accounts** — For as long as the account is open, then 30 days, then deleted, less any billing records we are required to keep for tax purposes. Account, event and scan records use request-based deletion. Email privacy@rebilder.com to request it. Rate-limit records and tag pageviews also receive scheduled cleanup. ## Your rights, and the route to exercising them - Access, a copy of what we hold about you. - Correction, fix anything wrong. - Deletion, erasure, subject only to records we are legally required to keep. - Portability, an export in a machine-readable format. - Objection and restriction, including to any processing we base on legitimate interest. - Withdraw consent, one click in any marketing email, or by writing to us. - Complain to a supervisory authority, independently of any request you send us. Send any of these to privacy@rebilder.com with enough detail to find the records, the address you used, the domain, or the scan link. We acknowledge within 5 working days and complete within 30 days, and we will tell you if a request will take longer and why. We do not charge for this and we do not treat you differently for asking. ## Security We protect data using encrypted connections, hashed API keys, access controls and restrictions on scanner destinations. Report vulnerabilities to security@rebilder.com. We do not pursue good-faith reports that do not exfiltrate data. ## Where it is processed Our infrastructure is hosted in the United States, and our service providers also process information in Singapore. For transfers from the UK or EEA, we use the Standard Contractual Clauses adopted by the European Commission and the UK International Data Transfer Addendum where applicable, or an equivalent approved mechanism. Contact privacy@rebilder.com for information about the providers and safeguards relevant to your data. ## Children Rebilder is a service for people who operate websites and is not directed at children. We do not knowingly collect data from anyone under 18. If you think we have, write to privacy@rebilder.com and we will delete it. ## Changes to this policy We post revisions here and email account holders about material changes at least 14 days before they take effect. We notify affected account holders of provider changes before processing begins and at least 30 days in advance, except where law or an active security threat requires an earlier change. Object within that period at privacy@rebilder.com; if unresolved, you may end the affected service and receive a refund for the unused period. ## Contact privacy@rebilder.com for anything on this page, including access, deletion, export and complaints. legal@rebilder.com for the Terms. security@rebilder.com for vulnerabilities. support@rebilder.com for everything else.