1. Information we process
Buildifyx processes account and connection information needed to authenticate users, route MCP requests, manage devices and workspaces, enforce plan limits, and operate billing and support.
- Account data: email address, password hash, account role, authentication source, account status, and account timestamps.
- Device data: device name, platform, architecture, agent version, tool metadata, connection state, last-seen time, and revocation state.
- Workspace data: device association, instance ID, workspace name, local path, MCP-enabled state, and last-seen time.
- Credential and authorization data: hashed login, device, OAuth, reset, and authorization credentials; token metadata such as name, prefix, expiry, last use, and revocation state; OAuth client and scope information.
- Plan and billing data: plan and quota state plus Stripe identifiers and subscription, billing interval, invoice, payment-status, and cancellation metadata when paid billing is used.
- Service-operation data: timestamps, temporary quota or operation claims, verification/reset state, and other records required to keep concurrent account and billing operations consistent.
2. MCP requests and local project content
When an AI client invokes a Buildifyx MCP tool, the request and the resulting response may pass through Buildifyx Cloud so the service can authenticate the request and relay it to the selected desktop agent. This can include file paths, file contents, command arguments, command output, and other tool data required for the action you requested.
Buildifyx is a relay and management layer, not a general cloud file-storage service. Your project remains on your connected device unless a tool action or another service you use causes data to be sent elsewhere.
3. How we use information
We use the information above only as needed to operate and secure the service, including the following purposes.
- Create and authenticate accounts, sessions, devices, and MCP clients.
- Route tool requests to the correct enabled workspace and return results to the requesting client.
- Apply device, token, and MCP-workspace quotas and prevent conflicting account operations.
- Display connection, workspace, usage, plan, and billing status in the dashboard.
- Send verification, password-reset, security, invitation, and billing-related email when configured.
- Detect, investigate, and recover from authentication, connection, billing, or security failures.
- Respond to support requests and account-management requests.
5. Security and access controls
Buildifyx uses technical controls designed to reduce unnecessary exposure of account credentials and local workspaces. No system can guarantee absolute security.
- Database passwords are stored as salted scrypt hashes rather than plaintext passwords.
- Login, device, OAuth, and reset secrets are stored as hashes where the credential design permits it.
- The desktop agent connects outward to Buildifyx Cloud; users do not need to expose a public inbound port for the normal remote flow.
- Only workspaces enabled for MCP access are available to MCP routing, and local tool actions remain subject to the workspace permission policy.
- Users can revoke access tokens and device credentials and can disable MCP access for a workspace.
6. Retention and deletion
Different records have different lifetimes. Some short-lived authentication records expire automatically. OAuth authorization codes are issued for approximately 5 minutes, OAuth access tokens for approximately 1 hour, and OAuth refresh tokens for approximately 30 days. Other temporary verification, reset, quick-login, quota, and operation records expire according to the active service configuration or operation lifecycle.
Account, device, workspace, token, and billing records are retained while needed to provide the service and manage the account. An account-deletion flow revokes connected credentials, disconnects access, removes account/workspace/subscription records, and performs billing cleanup. Some revoked or operational records may remain temporarily while cleanup and consistency jobs finish.
To request deletion or ask about retained account information, contact contact@buildifyx.com.
7. Your controls
Buildifyx gives you product controls that affect what can connect and what AI can access.
- Disable MCP access for any workspace you do not want exposed to an MCP client.
- Revoke or rotate access tokens and device credentials.
- Stop or remove a local agent/workspace instance from the connected device.
- Use the billing portal, when available for your subscription, to manage recurring billing.
- Contact support to request account deletion or assistance with account information.
8. Changes and contact
We may update this policy as the service changes. The date at the top of this page identifies the current version. Questions about this policy or your Buildifyx account can be sent to contact@buildifyx.com.