Privacy policy

Last updated 26 October 2026

RBO Build is run by RBO Build (ABN 62 353 202 882) ("we", "us"), Melbourne, Victoria, Australia. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth). This policy explains what personal information we collect, why, who we share it with, and how you can see or correct it. If anything is unclear, email info@rbobuild.com.

In short: we collect what we need to run your account and your websites; we never sell personal information; payments are handled by Stripe, so we never see full card numbers; the enquiries a website receives go to that website's business, and the member who manages the website sees only how many there are.

Who this policy covers

Members: web designers, freelancers, agencies and business owners who sign up to RBO Build.
Clients: the businesses a member makes websites for, when the member invites them to their own login.
Visitors to this website (rbobuild.com).
Visitors to the websites we host for our members and their clients, for example when they send an enquiry. For those websites, see "Websites we host" below.

What we collect

When you use the platform

Account details: your name, email address and password. Passwords are stored only in a scrambled (hashed) form that can't be read back.
Billing: your plan, payment status and invoices. Card details are entered on Stripe's pages and kept by Stripe; we only receive a reference and the last few digits.
Website content: what you and your clients give us for a website: the website's files (pages, images and other files you upload or start from a template), answers to onboarding questions, business details (such as name, phone, email, address and opening hours), logos, photos and texts.
Email settings for a website: the address enquiries go to and, if a member chooses to have enquiries sent from the business's own email, the mail server details for it. The password is stored encrypted and is never shown again.
Spam protection settings: if a member turns on spam protection for a website, the keys for Cloudflare Turnstile or Google reCAPTCHA. The secret key is stored encrypted and is never shown again.
Client payments: if a member collects payments from their clients through their own Stripe account, we store the payment's status and links to Stripe's receipts, not card details.
Messages to us: support requests, emails, and what you send through the "Book a demo" form on our website (your name, email, and any business, phone and message details you add). We use them only to reply to you.
Reports about websites: what you send through "Report a website": the address, what you saw and, if you add it, your email so we can reply. We never show your email to the website's owner.
Technical information: such as your IP address, browser type and the time of each request, kept in logs to keep the service running and secure.

When you visit this website

This website doesn't use cookies, analytics or advertising trackers, and its fonts and images are served from our own site. Our hosting provider (Cloudflare) processes basic technical information, such as your IP address, to deliver the page and protect it from attacks.

Cookies

The platform (not this website) uses a small number of cookies that it needs to work:

a sign-in cookie that keeps you logged in, and security cookies that protect forms;
a cookie that remembers whether you chose the light or dark look;
if you arrive through a referral link, a cookie that remembers who referred you.

We don't use advertising cookies.

How we use it

to provide the service: host websites and save the changes members make to them, send enquiries, run the member and client dashboards;
to bill members for their plans, and to let members collect payments from their clients through Stripe;
to send service emails, such as sign-up confirmations, invitations, reminders and notices about payments or problems with a website;
to answer questions and give support;
to keep the service secure, prevent spam and misuse, and meet our legal obligations.

We don't sell personal information, and we don't use it to advertise to you on other websites.

Websites we host

The websites we host belong to our members and their clients. Members make them with tools of their own choosing (for example an AI like Claude or ChatGPT, used through their own account with it) or start them from our templates; RBO Build doesn't use AI to make or change them. When someone sends an enquiry through one of those websites, we send it by email to the business (through our email delivery provider, or from the business's own email account if the member set that up) and keep a copy so the business can see it in its dashboard. If spam protection is turned on for the website, the form also uses Cloudflare Turnstile or Google reCAPTCHA, as described below. The member who manages the website sees only how many enquiries arrived, not the messages. For those websites we act on behalf of the member and the business, who are responsible for their own privacy policy and for how they use the enquiries they receive.

The browser add-on and connected apps

The RBO Build browser add-on and apps you connect to RBO Build (such as Claude) work on your websites only after you sign in on our own page and press Allow. They never see your password. The add-on reads only the folder you choose, only when you press Upload, and sends those files to RBO Build to become your website. It keeps its sign-in on your computer, in the browser's storage for add-ons. It doesn't read your browsing history or the pages you visit: it sees the address of the page you're on only when you press its button, to name the website's folder. You can disconnect an app or the add-on any time in Settings, Connected apps.

Who we share it with

We use trusted service providers to run RBO Build. They receive only what they need to do their job:

Microsoft Azure (in Australia): runs the platform and stores its data and files;
Cloudflare: hosts the websites and this website, provides the secure padlock (HTTPS) and protection from attacks and spam;
Cloudflare Turnstile or Google reCAPTCHA: when a member turns on spam protection for a website, its contact form uses one of these to check that a person, not a bot, is sending an enquiry. They look at technical information from your browser and device, as described in Cloudflare's Turnstile Privacy Addendum and Google's Privacy Policy;
Stripe: payments for plans, and the payments members collect from their clients;
Calendly: when you book a demo on our website, the calendar is provided by Calendly, which receives the name, email and time you choose and sends the invite. Calendly loads only after you choose to pick a time, and its own privacy policy applies;
our email delivery provider: sends the platform's own emails, and the websites' enquiries unless a business has them sent from its own email;
Google: the platform loads its fonts from Google Fonts.

Within an account, a member and the clients they invite see only what the member allows. We may also disclose information if the law requires it, or to protect the rights and safety of people or of the service.

Information sent overseas

Some of our providers are based in, or store information in, other countries, including the United States (for example Stripe and Google) and the countries where Cloudflare's network operates. We choose providers that protect information to a standard similar to the Australian Privacy Principles.

How we keep it safe

everything is sent over encrypted connections (HTTPS);
passwords are hashed, and email passwords for websites are encrypted;
members can only see their own websites, and clients only their own website and what the member allows;
access to our systems is limited to the people who need it.

No system is perfectly secure. If a data breach is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner, as the law requires.

How long we keep it

We keep account and website information while the account is open. After a plan ends, we keep it for a limited time so a website can be restored, and then delete or de-identify it, unless the law requires us to keep it longer (for example billing records for tax). Members can download their websites' files at any time while their account is open.

Seeing and correcting your information

You can see and change most of your details in your account. Under Your data you can also download a copy of everything we hold about your login, or delete your account yourself: a client's login is deleted straight away; a member's websites go offline at once and everything is deleted 30 days later, keeping only anonymous billing records. To ask for any of this another way, or to correct something, email info@rbobuild.com. We'll reply within 30 days. If you sent an enquiry through a website we host, you can also contact that business directly.

Complaints

If you think we've mishandled your personal information, email us first and we'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

We may update this policy as the service changes. The date at the top shows the latest version; if a change is significant, we'll tell members by email or in the platform.

Contact

RBO Build (ABN 62 353 202 882), Melbourne, Victoria, Australia · info@rbobuild.com