Privacy Statement — MDB Builder
BizzBit B.V. · Version 0.1 (draft) · September 2026
How BizzBit handles the personal data of MDB Builder users Which parties receive data, which cookies are used and what rights you have
1. Who we are
MDB Builder is a service of BizzBit B.V., Kruisakkers 2, office number 11, 4613 BV Bergen op Zoom, the Netherlands, Chamber of Commerce (KvK) number 97560154. Questions about privacy or a request concerning your data can be sent to support@mdbbuilder.com, with "Privacy" in the subject line.
2. Two roles
BizzBit processes personal data in two different roles:
- As controller for the data needed to provide MDB Builder: your account, sign-in details, invoicing, security and compliance. This Privacy Statement covers that data.
- As processor for the content that organisations place in MDB Builder: documents, MDBs, comments, chat messages, signatures on documents and customer and supplier details. The organisation using MDB Builder (your employer or its partner) is responsible for that content, and the arrangements in the Data Processing Agreement (Annex 1 to the Terms of Service) apply. If you have a question about that content, please contact that organisation; BizzBit will assist it.
3. What data we process, why and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Account: email address, name, initials, chosen colour, company and department, roles, membership status, preferences | Providing you with an account and delivering the service | Performance of the contract |
| Sign-in: sign-in method used and account ID at the identity provider, time of last sign-in; sign-in history: time, sign-in method and outcome of every sign-in attempt (including refused ones), with IP address, browser details and the campaign tags of the link you came from (such as utm_source) | Secure sign-in and linking accounts | Performance of the contract; legitimate interest (security) |
| Signature profile: name, initials, job title and image of your signature | Having documents signed and recording who signed what | Performance of the contract |
| Activity and audit trail: changes to members, roles, permissions and subscriptions, signature events, credit transactions with the acting user | Accountability, security and insight for admins | Legitimate interest |
| Invitations: email address of invited persons and who invited them | Delivering invitations and shares | Legitimate interest of the inviting organisation and BizzBit |
| Invoicing: billing email address, billing address, VAT number, country, payment details at the payment provider, invoices | Charging for subscriptions and credits, applying VAT correctly | Performance of the contract; legal obligation (tax retention requirement) |
| Sanctions screening: email domain, country of establishment, outcome of the check and who made a sanctions declaration | Complying with sanctions regulations (see 7) | Legal obligation; legitimate interest |
| Requests and reports: messages with Enterprise enquiries, credit requests, membership requests and reports of misuse | Handling the request or report | Legitimate interest |
| Marketplace profile: company name, description, website, contact email address (by default the address of an admin or member) | Making companies findable for other users in order to collaborate | Legitimate interest; the listing is switched on by default and can be switched off at any time in the company settings |
| AI functions: files and texts you enter yourself, product name and your refinement instruction | Creating the requested AI result | Performance of the contract |
| Technical data: IP address and browser details in server logs; error logging: time, the error message, the page and the request in which the error occurred, with your account, IP address and browser details | Security, limiting misuse and resolving failures | Legitimate interest |
| Email with support: your message and contact details | Answering your question | Legitimate interest |
| Sandbox access (sandbox.mdbbuilder.com): the email address you enter, whether you ticked the box for follow-up email (and when), the campaign tags and page of the link you came from, IP address and browser details, and when the link was sent and used | Sending you the link to the sandbox, limiting misuse, and getting in touch about MDB Builder after your visit | Legitimate interest (the link and occasional personal contact about your visit); consent for follow-up email such as tips and news (the separate, unticked box), which you can withdraw at any time |
| Sandbox (sandbox.mdbbuilder.com): per visit the start and end time, IP address, browser details and language, the page and campaign tags of the link you came from, and counts of what was opened and edited, AI use and exports. Inside the sandbox you work as an anonymous demo guest without an account; the visit is linked to the email address you used for access | Limiting misuse of the sandbox, measuring which links and campaigns bring visitors and improving the product | Legitimate interest |
We do not create profiles of you for marketing and do not sell data. We only send marketing emails (tips, news about MDB Builder) to sandbox visitors who ticked the separate box for it; every such email lets you unsubscribe, and you can also withdraw your consent by emailing support@mdbbuilder.com. All other emails from MDB Builder are service emails that are part of using the service, such as the sandbox link, invitations, notifications about shares and projects, invoices and balance warnings.
4. Recipients and sub-processors
BizzBit engages the following parties. This is also the list of sub-processors referred to in the Data Processing Agreement.
| Party | Purpose | Which data | Location |
|---|---|---|---|
| Microsoft Azure (Microsoft Ireland) | Hosting of the application, database, file storage, real-time notifications, email delivery, monitoring and key management | All data and content in the service | EU (West Europe, the Netherlands) |
| Microsoft Entra ID / External ID | Signing in with a Microsoft account or a one-time code by email | Email address, name, account ID | EU / Microsoft EU Data Boundary |
| Azure OpenAI (Microsoft) | AI functions (preview) | What you enter in the AI function, processed in an isolated BizzBit environment; see Article 8.2 of the Terms of Service for what happens to that input | EU Data Zone (including Sweden) |
| Stripe | Payments, VAT calculation and invoices | Name, email address, billing address, VAT number, payment details; during checkout Stripe also processes device and fraud signals | EU and US |
| Signing in with Google Workspace (if used); address suggestions and maps for company details and partnerships | For sign-in: email address and name; for address suggestions: the search text and the email domain; for maps: your IP address via your browser | US and EU | |
| Resend | Fallback route for email delivery if the main route is unavailable | Email address, name and the content of the service email | US |
| CARTO | Map background of the partnership map if Google Maps is unavailable | Your IP address via your browser | EU and US |
| Pexels and Pixabay | Searching for online images in the sheet designer | The search term (without user data); when displaying results, your IP address via your browser | EU and US |
In addition, other users see your data to the extent this is part of collaborating: members of your company see your name, initials and role, and partners with whom content is shared see your name with comments, reviews and signatures. BizzBit support staff only have access to a company when an admin invites them. Otherwise, we only disclose data when required by law.
Transfers outside the EEA. Where a party processes data in the United States, this is done on the basis of the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
5. Retention periods
| Data | Retention period |
|---|---|
| Account, memberships, signature profiles, audit trail | As long as the account or the company exists; thereafter in accordance with the deletion request (Article 13 of the Terms of Service) |
| Invoicing and payment data, credit administration | 7 years after the end of the financial year (tax retention requirement) |
| Sanctions checks and sanctions declarations | As long as necessary to demonstrate compliance with sanctions regulations |
| Reports of misuse and requests | As long as necessary for handling them and to assess repeat occurrences |
| What you enter in an AI function | Files and images are not stored; they only exist while the result is being created. The product name and any instruction you type yourself remain with the job and are deleted together with the result |
| Results of AI functions that you do not use | No more than 24 hours; they are then cleaned up automatically |
| Input and results at Azure OpenAI, for misuse detection by Microsoft | No more than 30 days (see Article 8.2 of the Terms of Service) |
| Server logs and error logging | No more than 90 days |
| Sign-in history | 90 days |
| Sandbox access requests (email address, consent) | 12 months after the link was last used; consent for follow-up email until you withdraw it, after which only the fact of withdrawal is kept |
| Sandbox usage log | IP address 90 days; the remaining visit data is kept as usage statistics, linked to the access request as long as that exists |
| Session | You are signed out after 24 hours of inactivity and in any case 14 days after signing in |
| Backups and recycle bins | In accordance with the periods in chapter 7 of the SLA |
6. Cookies and local storage
MDB Builder uses no tracking, analytics or marketing cookies. That is why we do not ask for consent via a cookie banner.
- Strictly necessary cookies from MDB Builder: a session cookie to keep you signed in and security cookies that protect the sign-in process.
- Local storage in your browser for convenience, such as collapsed panels or a dismissed introduction, and in the sandbox the access link for 7 days so you can start a new sandbox without a new email. This data stays on your device.
- Third-party cookies only when you use the function concerned: Stripe places cookies during checkout to prevent fraud, and Google may place cookies when a Google map is displayed.
7. Automated decisions
To comply with sanctions regulations, MDB Builder automatically checks the email domain and the country of establishment at sign-up, invitations, sharing and purchases. If a check is negative, the action is refused or the company is placed under review. Sign-ups with addresses from general email providers are also refused, because MDB Builder is offered for business use only. If you disagree with such an outcome, please contact us; a BizzBit employee will then review it manually.
8. Security
BizzBit protects personal data with appropriate technical and organisational measures. These are described in the Security, Privacy & Compliance Whitepaper (app.mdbbuilder.com/legal/security-whitepaper).
9. Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interest. You can withdraw consent at any time.
- You can change your name, initials and colour yourself in your profile; company and billing details are managed by admins in the settings.
- For other requests, email support@mdbbuilder.com. We respond within one month and may ask you to confirm your identity.
- If your request concerns an organisation's content (see 2), we will forward it to that organisation or ask you to contact it.
If you are not satisfied with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the supervisory authority in your own country. We would appreciate it if you contacted us first.
10. Changes
We may amend this Privacy Statement, for example when we engage a new recipient. Changes are made in accordance with Article 14 of the Terms of Service. The current version is available at app.mdbbuilder.com/legal/privacy.