Privacy policy

The data controller is GAETAN KURZAWA, a French SARL with a share capital of €1,000, 2 allée des Acacias, 94000 Créteil, France, registered with the Créteil Trade and Companies Register under number 987 886 199, represented by its managing director, Gaëtan Kurzawa. Contact: contact@buildmyrig.gg.

Build My Rig and Race Companion (racecompanion.app) are published by the same company and share one account system: the same sign-in works on both services. Race Companion’s own processing is described in its privacy policy.

• Account: email address, password stored only as an irreversible hash (or the link to your Google account if you use it), creation and last sign-in dates. To create and secure your account. Legal basis: performance of the Terms.
• Profile and builds: username, bio, photos, videos, logo, build configuration and notes and, if you fill them in, location and contact details (link, Discord, contact email). To show your profile and builds. Legal basis: performance of the Terms.
• Interactions: likes, comments, reviews and followed builds. Legal basis: performance of the Terms.
• Alerts and notifications: watched products, price thresholds, notification preferences, deal subscriptions and, if you enable browser notifications, the technical subscription address your browser provides. To notify you on the site, by email or in your browser. Legal basis: performance of the Terms, and your permission given in the browser for its notifications.
• Second-hand listings: text, photos, price and place given in the listing. Legal basis: performance of the Terms.
• Import from Race Companion: if you run the import, the hardware detected by the Race Companion plugin and your PC configuration (CPU, GPU, memory, monitors, VR headset) pre-fill your build. Nothing is imported unless you ask. Legal basis: performance of the Terms.
• Partner creators: creator name, promo code and statistics of the related clicks. Legal basis: partnership contract.
• Clicks to retailers: link, retailer, product, originating page, browser type, IP address truncated as soon as it is recorded (the last block is erased), account identifier if you are signed in, date. To know which links are useful, check affiliate commissions and detect fraudulent clicks. Legal basis: legitimate interest.
• Audience measurement, with your consent: page views, clicks, navigation, device, approximate country, technical errors and session recordings with form inputs masked; if you are signed in, your account identifier (never your email). Tool: PostHog. Legal basis: consent, which you can withdraw at any time via “Cookies” in the footer.
• Server logs: IP address, date and time, requested page, browser and referring site, for security and troubleshooting. Legal basis: legitimate interest.
• Country for prices: if you have not chosen a country, your IP address is used, on our server, to guess your country in the free DB-IP database (IP to Country Lite), for the VAT, the currency and the retailers that deliver to you. It is not recorded for this, and the guessed country is not kept. Legal basis: legitimate interest.
• Messages: your address and the content of your emails, to reply to you. Legal basis: legitimate interest.

The Build My Rig extension for Chrome shows, on a product page of a retailer Build My Rig tracks, the prices of that product compared on buildmyrig.gg.

• What it sends: only when the page you are viewing is a product page of one of those retailers: the address of that page, without its tracking parameters, which is part of your browsing history on those sites; your browser language; the country you picked for prices in the extension, if you picked one; and shipping included, if you turned it on. Without a picked country, the country of your IP address, else your language, sets the currency and the VAT of the prices shown, as on a first visit to the site; shipping included is added to them, estimated for that country. The extension sends no page content, no other page or site you visit, no cookie, no installation identifier and no account. Legal basis: performance of the service you installed.
• On our servers: like any visit, this request reaches our server with your IP address and your browser’s user agent (its name and version); the server logs keep them with the date and the requested address, which holds the product page address, for 90 days. They are not linked to an account, not used for advertising and not shared.
• If you click an offer: the click goes through buildmyrig.gg and is recorded as a click from the site (see “Clicks to retailers”), then the retailer opens. Some links are affiliate links: your price does not change.
• In your browser: your settings (comparison on or hidden, panel minimised, panel position, chart period, country for prices, shipping included or not), the list of retailers compared and the last comparison of each open tab stay in the extension’s storage, on your device.
• If you report a mistake: only when you press Send, the extension sends the address of the page, the product the comparison showed, the reason you picked, your comment if you wrote one, its version, its language and the country for prices. They reach us as an email to contact@buildmyrig.gg, sent by Resend (see “Recipients”), without your email address or any account, so we can fix the comparison. Legal basis: legitimate interest (the accuracy of the prices shown).

The extension asks for the storage permission, and for running its script on the retailers you turn on. It runs on the sites of the retailers it tracks, and on buildmyrig.gg, where it only marks the page with its version number so the site stops suggesting it, and reads nothing; it neither reads nor changes any other site. Once a day, it downloads from buildmyrig.gg the list of retailers compared, a request that sends nothing else; when Build My Rig adds one, its menu offers to turn it on, and Chrome asks you for that site before it runs there. Right after installation, it opens buildmyrig.gg once to confirm it is installed and show how to pin it. To stop everything, turn it off or remove it from Chrome’s extensions page.

Visible to everyone and possibly indexed by search engines: your username, bio, photos and videos, builds, comments, reviews and listings. Your location is shown only if you enable location sharing, and is then rounded to about 1 km. Your contact details are shown only if you say you are open to visits. Your account email address is never public.

• Essential, no consent needed: Auth.js sign-in cookies (session valid 30 days, short-lived security and redirect tokens), the csrf-token cookie against forged requests (24 hours), the trm_language cookie for your language and the bmr_country cookie for the country you chose (1 year each).
• Preferences, stored locally: your cookie choice, language, country and currency, current build, comparison, filters, drafts and the suggestions you closed. This data stays in your browser until you clear it.
• Audience measurement, with your consent: PostHog identifier and session data in local storage (keys starting with ph_).
• Third-party content: YouTube videos in articles load only when you click; YouTube (Google) may then set its own cookies.

You can change your choice at any time via “Cookies” in the footer.

• netcup GmbH (Germany): hosting of the site, databases, photos and videos, and backups.
• Google: daily off-site copy of the database backups on Google Drive, kept 14 days; Google sign-in if you choose it.
• Resend (United States): sending emails (alerts, notifications, deals, password reset, reports sent from the extension).
• PostHog (servers in the European Union): audience measurement, only with your consent.
• Browser push services (Google, Mozilla, Apple, Microsoft): delivering notifications, if you enable them.
• OpenStreetMap Foundation: map tiles, loaded by your browser when you open a map (they receive your IP address). Place search goes through our server, which only sends the place name.
• YouTube (Google): article videos, only if you click.
• Retailers: some product images are loaded from their servers; once you are on a retailer’s website, it processes your data under its own policy.
• Hostinger: mailbox of the contact address.

No data is sold or used for targeted advertising.

Resend and Google are based in the United States; PostHog is a US company whose European hosting we use. These transfers are covered by the European Commission’s standard contractual clauses or by the EU-US Data Privacy Framework.

• Account, profile, builds, content, alerts: until the account is deleted.
• Clicks to retailers: the truncated IP address, browser and originating page are erased after 13 months; the click then remains with no personal data, as a record of commissions.
• Audience measurement: 12 months at most.
• Server logs: 90 days.
• Backups: 14 days. Deleted data disappears from backups within 14 days.
• Messages and reports sent from the extension: as long as needed to follow up on your request.

You have the right of access, rectification, erasure, restriction, objection and portability, the right to withdraw your consent at any time and the right to give instructions about your data after your death.

From your member area, you can export your data and delete your account. Deletion covers Build My Rig and Race Companion: your data on both services and the shared sign-in are erased. For any other request, write to contact@buildmyrig.gg; we reply within one month.

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr).

Encrypted connections (HTTPS), hashed passwords, restricted server access, protection against forged requests and request rate limiting, daily backups.

Accounts are for people aged 16 and over. If you believe a child under 16 has given us personal data, write to us and we will delete it.

This policy may change with the site or the law. The latest update date is shown at the bottom; significant changes will be announced on the site. See also the Legal Notice and the Terms of Use.