Privacy and AI
Last updated: 20 October 2026. This page explains in plain terms how artificial intelligence (AI) is used in the IzykBuild app: what data it sees, who processes it and what your company controls. It does not replace the data processing agreement signed with each customer.
What the AI is used for in IzykBuild
- Izyk, the AI assistant: answers questions about your site and summarises information.
- Analysis of site photos, for example for 3D progress (spotting installed parts).
- Classifying and searching snags (type of issue, trade, urgency).
- Automatic translation of interface texts.
The AI provider
IzykBuild's AI is provided by Google through the paid Gemini API, under the terms that apply in the European Economic Area. Under those terms (Gemini API Additional Terms of Service, effective 23 March 2026), Google acts as a data processor and processes the data under its "Data Processing Addendum for Products Where Google is a Data Processor".
What data the AI sees
- Only what each task needs: for example one snag description, one photo, or the question asked to Izyk with the context needed to answer it.
- Never the whole database.
- Each company's data is strictly isolated: a request made for one company only uses that company's data.
What Google does, and does not do, with that data
- Google does not use prompts, files or responses to improve its products.
- Google processes them as a data processor, under its data processing addendum.
Protections already in place
- Automatic masking of personal data in texts before they are sent to the AI: names, email addresses, phone numbers, IBANs, tax IDs (NIF, VAT…) and postal addresses are replaced with neutral placeholders (for example [PESSOA_1]); the answer is then restored inside the app. The replaced values are not stored: only the number of replacements is logged.
- Stripping of EXIF/GPS metadata (including location) from photos before they are sent to the AI.
- Both protections are on by default for every company. Because detection is automatic, it may not catch every case: avoid putting unnecessary personal data in texts.
The limits, stated plainly
- Temporary retention: Google keeps prompts, the context provided and responses for 55 days, solely to detect and prevent violations of its Prohibited Use Policy and for legally required disclosures (Google's abuse monitoring policy). So we do not claim "zero retention".
- Processing outside the EU: data may be stored transiently or cached in any country where Google or its agents have facilities, including outside the European Union. So we cannot promise that data sent to the AI never leaves Europe.
What we are introducing
- An optional EU AI processing mode (Google Vertex AI, "eu" multi-region, processing within EU member states). It is built but not yet active; this page will be updated once it is available.
What your company controls
- Each company can switch the AI off. With the AI off, AI features are unavailable and IzykBuild sends no AI requests on that company's behalf.
- Automatic masking of personal data is on by default and can be set per company.
- AI usage is logged per company (feature, date, volume), so we can answer your questions about it.
Roles and hosting
For site data, the customer company is the controller and IzykBuild is the processor; Google (Gemini API) acts as a sub-processor for AI features. The app is hosted on a virtual private server (VPS) rented from Hostinger. The detailed terms are set out in the data processing agreement (GDPR Art. 28), available on request.
Contact
Questions about privacy and AI: contact@izykbuild.com. See also our Privacy policy.