Skip to content

Privacy Policy

Effective date: September 23, 2026

1. Who we are

Built in Baltics ("we", "us", "our") operates the platform at builtinbaltics.com, a community for builders, founders, and makers in Estonia, Latvia, and Lithuania.

Data controller

Built in Baltics is not yet a registered legal entity. The operators of Built in Baltics act as the data controller for your personal data under the EU General Data Protection Regulation (GDPR). This section will name the company, its registration number, and its registered address once the company is registered.

Contact: info@builtinbaltics.com

2. Data we collect

2.1 Account data

When you create an account we collect:

  • Email address and password (hashed), or the account you sign in with through Google, GitHub, or LinkedIn
  • Display name, country (EE / LV / LT), and professional role

2.2 Profile data

You may optionally provide:

  • Bio, nationality, skills, avatar photo
  • Social links (GitHub, LinkedIn, X / Twitter, website)
  • Messaging handles (Telegram, Discord)
  • Contact email and collaboration preferences

2.3 User-generated content

  • Projects (title, description, images, tags, links)
  • Discussions and replies
  • Events (title, description, location, dates, cover image)
  • Collaboration posts
  • Comments on projects, events, and discussions

2.4 Behavioural data

  • Votes / upvotes on projects, discussions, and replies
  • Bookmarks (saved projects, discussions, events)
  • Event RSVPs (going / interested)
  • Connection requests and messages between users

2.5 Technical data

  • Authentication cookies — Supabase session cookies (strictly necessary for login)
  • Referral cookie — a ref_code cookie (30-day expiry) if you arrive via a referral link

2.6 Keegi

Keegi helps members find someone who can help with a question. Every member is findable by default, and Keegi builds a capability card for every findable member:

  • If you have written content on the platform, we send your role, skills, and bio, together with that content, through the Vercel AI Gateway to Anthropic (the Claude model), which writes the card. The content includes your projects, project updates, discussions, upvoted replies, events, and collaboration posts. Collaboration posts are visible only to signed-in members, so this includes content that is not public.
  • If you have not written anything yet, the card is simply your role, bio, and skills.
  • Either way, the card is sent to OpenAI to create an embedding (a numerical form of the card used for search). Cards are built and refreshed by a nightly job.

When a member asks Keegi a question, the question is sent to OpenAI to create an embedding, and to Anthropic together with the names, cards, and supporting excerpts of up to 20 matching members, so the model can write an answer. Questions asked of Keegi are logged with the asker's name so organisers can see what the community needs.

Anthropic and OpenAI are based in the United States (see section 10). We rely on our legitimate interest in helping members find each other (see section 4). You can object at any time by turning off Findable by Keegi in Settings, which removes you from matching and deletes your stored card. Contact someone@keegi.xyz with questions about this preview.

2.7 Job applications

If you apply to a job posted on the platform, we collect and share with that job's poster (and no one else):

  • Your cover letter or short note, and answers to any screening questions the poster set
  • A CV / resume — either an uploaded PDF (kept in a private, access-controlled bucket and served only via short-lived signed links) or a link you provide
  • A reply-to email address you enter for the poster to contact you
  • Messages you exchange with the poster in the application chat

You can withdraw an application at any time, which deletes it and any uploaded CV. If the poster deletes the job, all of its applications, CVs, and chats are deleted.

3. How we use your data

  • Provide the service — display your profile, projects, and content to the community
  • Authentication — manage sign-in sessions and account security
  • Notifications — send you in-app and email notifications about activity on your content (stars, comments, replies, connection requests)
  • Email communications — welcome email, unread notification digest, event reminders, and email change confirmations
  • Referral tracking — credit referrals to the referring user
  • Moderation — review content for compliance with our Terms of Service
  • Keegi: a capability card built from your profile and the content you have written, including members-only collaboration posts, used only to suggest you when another member asks who can help. It is processed by Anthropic and OpenAI (see section 2.6). Turn off Findable by Keegi in Settings to opt out; that deletes the card.

4. Legal basis for processing

  • Contract performance: processing necessary to provide you with the platform (account, content hosting, connections)
  • Legitimate interest: analytics, moderation, platform security, referral attribution, and Keegi matching (section 2.6). You can object to Keegi at any time by turning off Findable by Keegi in Settings.
  • Consent: optional email notifications (digest, event reminders) which you can opt out of at any time in Settings

5. Who we share data with

We do not sell your personal data. These service providers process personal data on our behalf, only to run the platform:

  • Supabase: database, sign-in, file storage, and realtime messaging. Holds your account data, content, messages, and uploaded files. Hosted in the EU (Frankfurt).
  • Vercel: hosting. Every request to the site is handled on Vercel servers in the EU (Frankfurt).
  • Vercel Web Analytics and Speed Insights: visitor statistics and page performance. They receive the page address, the referring page, your device and browser type, and a country derived from your IP address. They do not set cookies.
  • Vercel AI Gateway, Anthropic, and OpenAI: Keegi. They receive profile fields, content you have written, capability cards, and questions asked of Keegi, as described in section 2.6.
  • Resend: email delivery. Receives your email address, display name, and the content of each email we send you. Notification emails can include short previews of messages and job applications sent to you.
  • Cloudflare Turnstile: bot protection on the sign-up, sign-in, and password pages. Receives your IP address and browser signals used to tell people from bots.

These services act under their own privacy policies when you choose to use them:

  • Google, GitHub, and LinkedIn: if you sign in with one of them, it learns that you signed in to Built in Baltics and shares your name, email address, and profile photo with us. Profile photos from these services are shown directly from their servers, so those servers see the IP address of anyone viewing the photo.
  • Discord: if you connect your Discord account, we add you to the Built in Baltics Discord server and give you a verified member role that other server members can see.
  • Stripe: payments for featured project placements. Stripe collects your card and billing details directly; we send Stripe your user ID and the project being featured.

AgentConf(agentconference.ai), an event partner, receives a booth listing for every project on Built in Baltics that is not archived: the project name, tagline, description, and logo, plus the project author's sign-up email address (or the contact email on their profile if there is none) so the author can claim the booth. Listings are not removed from AgentConf automatically when a project is archived or an account is deleted; contact us to have yours removed.

Our emails load a font from Google Fonts, so Google may see the IP address of the device that opens an email.

We may also disclose data if required by law or to protect the safety of our users.

6. Data retention

We retain your personal data for as long as your account is active. When you delete your account, all associated data — profile, content, images, connections, bookmarks, votes, and notifications — is permanently deleted via cascading database rules. Backup copies may persist for up to 30 days before being purged.

7. Your rights under GDPR

You have the right to:

  • Access — request a copy of the personal data we hold about you
  • Rectification — update or correct your data via your dashboard Settings at any time
  • Erasure— delete your account and all associated data from Settings > Delete Account
  • Restriction — request that we limit processing of your data
  • Portability — request your data in a structured, machine-readable format
  • Object — object to processing based on legitimate interest
  • Withdraw consent — opt out of email notifications at any time in Settings

To exercise any of these rights, contact us at info@builtinbaltics.com. We will respond within 30 days.

8. Cookies

We use only strictly necessary cookies that are exempt from consent under the ePrivacy Directive:

  • Supabase session cookies (sb-*) — maintain your authenticated session
  • Referral cookie (ref_code) — stores a referral code for up to 30 days so it persists through sign-up

We do not use any advertising, tracking, or third-party cookies.

9. Security

We implement appropriate technical and organisational measures to protect your data, including:

  • Passwords are hashed using industry-standard algorithms (bcrypt via Supabase Auth)
  • All data is transmitted over HTTPS/TLS
  • Row-level security (RLS) policies restrict database access to authorised users
  • File storage uses per-user folder isolation with RLS
  • Admin actions require verified admin role

10. International data transfers

Our database, file storage, and servers run in the EU, in Frankfurt. These providers are based in the United States or may process data there:

  • Vercel (for Web Analytics, Speed Insights, and the AI Gateway), Anthropic, and OpenAI
  • Resend (emails are sent from the EU, but Resend is a US company)
  • Cloudflare
  • Google, GitHub, LinkedIn, Discord, and Stripe

Transfers to our service providers outside the EEA are made under standard contractual clauses or equivalent safeguards compliant with GDPR Chapter V. Google, GitHub, LinkedIn, Discord, and Stripe process your data under their own terms when you choose to use them.

11. Children

Built in Baltics is not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or a prominent notice on the platform. The "Effective date" at the top reflects the latest revision.

Changes on September 23, 2026

  • Section 1: states who the data controller is.
  • Section 2.1: lists LinkedIn sign-in.
  • Section 2.5: corrected the description of session cookies.
  • Sections 2.6, 3, and 4: Keegi now states exactly what it sends to Anthropic and OpenAI, that this includes members-only collaboration posts, and the legal basis we rely on.
  • Section 5: now names every service that receives personal data, adding Vercel Web Analytics and Speed Insights, Anthropic, OpenAI, Cloudflare Turnstile, LinkedIn, Discord, Stripe, and AgentConf.
  • Section 10: lists every provider that may process data outside the EU.

13. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at: info@builtinbaltics.com

If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority (e.g. the Data State Inspectorate of Latvia, Estonian Data Protection Inspectorate, or Lithuanian State Data Protection Inspectorate).

Our Partners
Become a partner →