Privacy Policy

The data controller is AGsoft Arkadiusz Głuszyk, Langiewicza 5/51, 38-500 Sanok, Polska, NIP: 6871910547. Data protection contact: contact@builderator.com.

Where a school uses Builderator, the school may independently decide what pupil data is entered (for example the display name and class assignment).

Builderator is a non-commercial, free web app where pupils solve tasks and build 3D models, and teachers and administrators author content and manage classes. Registration and use of the service are currently free of charge.

• Pupil account: display name (first name or nickname), password hash (never the plain password), optional e-mail address used only for password recovery, selected avatar, class code, interface language.
• Learning progress: points, solved and missed tasks, completed models, revision state (account-bound data, not a public identity).
• Teacher/administrator account: username, password hash, optional e-mail address, role and assigned classes.
• Session and security data: hashed session tokens with expiry, and login-attempt counters containing the IP address and account name, used to protect against attacks.
• Audit trail: account events and administrative operations — login, registration, logout, content changes (no passwords or tokens).
• Server logs: request method and path, request id, timestamp and error details. We do not log passwords, tokens or full request bodies.
• Undelivered e-mail messages: the recipient address, subject and body of a message that could not be sent, kept briefly (up to 30 days) for retry or diagnosis. Password-reset links are not stored.
• Content and files: tasks, categories and models created by teachers and uploaded images. We do not expect them to contain pupils' personal data.

• Creating and running the account and providing the service – Art. 6(1)(b) GDPR (performance of a contract).
• Operating and improving the educational features and saving progress – Art. 6(1)(b) GDPR.
• Security, abuse prevention and protection against unauthorised access – Art. 6(1)(f) GDPR (legitimate interests).
• Establishing or defending legal claims and complying with legal obligations – Art. 6(1)(c) and (f) GDPR.
• Optionally, only with consent – for example any analytics or advertising if introduced in the future – Art. 6(1)(a) GDPR.

We do not use automated decision-making or profiling. We do not add advertising or analytics tracking without prior consent.

The service is intended primarily for supervised classroom use. Pupil accounts usually require no e-mail address. Use of the service by someone under 16 requires the consent of a parent or legal guardian. We do not automatically verify age or consent; the person creating the account (school, teacher or guardian) is responsible for obtaining it. A parent or guardian may withdraw consent and request deletion of a child's account and data at any time using the contact address in section 1.

We use only technologies strictly necessary for the service to work. We do not use analytics, advertising or tracking cookies, and therefore show no cookie consent banner – consent is not required for strictly necessary technologies.

• builderator-session – staff (teacher/administrator) session cookie. Necessary for authentication. HttpOnly, SameSite=Strict, Secure in production; the server-side session expires after 12 hours.
• builderator-player – pupil session cookie. Necessary for authentication. HttpOnly, SameSite=Strict, Secure in production; the server-side session expires after 30 days.
• localStorage: builderator-session-v3 – locally stored player name and account id, avatar choice, class and task order; stays in your browser and is not sent to third parties.
• localStorage: builderator-admin-locale – remembers the selected admin-panel language.

Session cookies are strictly necessary for the service and need no consent. You can delete them in your browser settings, which will sign you out.

We rely on trusted infrastructure and service providers that process data only on our behalf:

• Cloudflare, Inc. – application hosting (Workers), database (D1), object storage (R2), e-mail delivery and short-lived operational logs (Workers Logs).
• Google Ireland Limited / Google LLC – delivery of transactional messages (password reset, teacher requests) through the Gmail API. Google Fonts are downloaded once at build time and served from our own server, so using the service does not connect to Google's servers for that purpose.

We do not sell or share data with third parties for marketing purposes. Our providers may also process data outside the European Economic Area; in that case we apply the safeguards required by the GDPR.

• The pupil account and its data remain while the account is active. You can delete the account yourself, which removes the data from the database.
• Per-model game data (progress, answer ledger) is deleted on a model reset or completion and when the account is deleted. In addition, inactive data may be removed after 30 days of inactivity.
• Revision (spaced-repetition) state is bound to the account and kept for as long as the account, including after a model reset or completion.
• The audit trail is kept for up to 12 months; older entries are removed periodically.
• Sessions expire automatically: 12 hours for staff, 30 days for pupils.
• Login-attempt counters are kept only for as long as needed to protect against abuse.
• Server logs are retained for a short period determined by the Cloudflare Workers Logs configuration.
• Backups within Cloudflare D1 Time Travel expire according to Cloudflare's rolling window.

• Right of access and to receive a copy of your data.
• Right to rectification.
• Right to erasure (the right to be forgotten).
• Right to restrict processing.
• Right to object to processing.
• Right to data portability.
• Right to withdraw consent at any time where processing is based on consent.
• Right to lodge a complaint with a supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

We apply technical and organisational measures appropriate to the risk: passwords are stored only as PBKDF2-HMAC-SHA256 hashes, session tokens are stored hashed and carried in HttpOnly/SameSite cookies, the connection is encrypted (HTTPS), and login is rate limited. Access to the admin panel is role-restricted.

To exercise your rights, write to contact@builderator.com. We will respond within one month. We may ask for information to confirm your identity in order to protect the data from unauthorised access.

We may update this policy as the service or the law changes. The current version is always available at /privacy. Last updated: 2026-09-25. Version: 1.0.