This privacy policy explains which personal data we process when you use the #JAMES app (APPlause by #JAMES, “the app”) or the website bnbbutler.be, why we do so, with whom we share data, how long we keep it and which rights you have.
1. Who is responsible?
#JAMES the BnB Butler, Knokke, Belgium, VAT number BE0777963457, is the data controller.
Privacy contact: hallojames@bnbbutler.be.
2. What data do we process in the app, and why?
Mobile number: account, login and verification
Your account is linked to your mobile number. We use it to create your account, to let you log in and to verify your number with a one-time code, which you receive via WhatsApp or by text message (SMS). To send and check this code we work with Twilio (Twilio Verify), which receives your mobile number and the code. A code is valid for 10 minutes. To prevent abuse, we record when a code was requested, for which number or email address, from which IP address and whether the code was correct. We do not store the code itself.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR). For recording the requests: legitimate interest (Art. 6(1)(f) GDPR), namely keeping your account secure.
WhatsApp updates: only with your consent
After you confirm your number, we ask whether you would like to receive updates via WhatsApp. Nothing is pre-selected. If you choose “yes”, we send you updates via WhatsApp. Your WhatsApp ID is your mobile number. For this we work with WhatsApp (Meta). We store your choice and when you made it. Without your consent, we do not send you WhatsApp updates. A verification code sent via WhatsApp is not an update and is not covered by this consent. You can withdraw your consent at any time by replying “STOP” or by emailing hallojames@bnbbutler.be. This does not affect messages we sent before.
Legal basis: consent (Art. 6(1)(a) GDPR).
Email address: password reset
We use your email address to send you a code when you want to reset your password. You can also receive this code via WhatsApp or SMS. We send emails through Mandrill (Mailchimp Transactional).
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Face ID and Touch ID: on your device only
If you enable login with Face ID or Touch ID, recognition happens entirely on your device, through the operating system. We never see or store your face or fingerprint data. Your device only tells the app whether the check succeeded or failed.
Push notifications: only with your consent
If you allow notifications, your device receives a push token, which we link to your account to send you notifications. Notifications are delivered through Expo and through Apple’s (iPhone) or Google’s (Android) notification service. You can turn notifications off at any time in your device settings.
Legal basis: consent (Art. 6(1)(a) GDPR).
Error reporting: Sentry (EU)
If the app crashes or runs into an error, we send a technical error report to Sentry, with data stored in the European Union. Such a report contains technical data such as the device type, the operating system and app version, the time and what went wrong. We do not include your name, email address or mobile number. We use this only to find and fix errors.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR): a stable and secure app.
App updates
The app downloads small updates from Expo’s servers. This involves technical data such as your IP address and the app version.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR): a secure and up-to-date app.
Which advertisement led to a download: Meta App Events and Google Firebase, only with your permission
To know which advertisement led to a download of the app or to a new account, the app measures three moments: the installation, opening the app and creating an account. It does so with Meta App Events (Meta Platforms Ireland Ltd.) and Google Firebase / Google Analytics (Google Ireland Ltd.).
- On an iPhone or iPad, only after you answer “Allow” to Apple’s question “Allow this app to track your activity?”. Without that answer, there is only Apple’s anonymous count (SKAdNetwork), which does not identify you.
- On Android and everywhere in the European Union, only after you have given your permission in the app.
- When you create an account, our server reports this new account to Meta (Conversions API) and to Google Analytics. Your email address and mobile number go along only encrypted (hashed), never in a readable form.
You can withdraw your permission at any time in the settings of the app, or by writing to hallojames@bnbbutler.be. The retention periods (section 7) and your rights (section 9) also apply here.
Legal basis: consent (Art. 6(1)(a) GDPR).
Data you enter yourself
Your name, profile photo, mobile number, email address, stays and reservations, service requests and messages in the chat with your butler. We use this data to provide the services of the app.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
3. Chat on the website
When we receive something
On our website you can chat with #JAMES or contact us via WhatsApp. As long as you do not type anything and do not tap “Chat via WhatsApp”, nothing is sent to our servers: until then, the pages you view stay in your browser only.
When you send a first message, we receive together with it: the page you are on and the last five pages of your visit, how you arrived on the website (referring website, campaign codes, Look Book code), the language and time zone of your browser and whether you use a phone or a computer. From your IP address we only derive your approximate country and city; we do not store the IP address itself.
Remembering your conversation
After your first message we remember your conversation in your browser for 30 days: with one functional cookie on bnbbutler.be, or in your browser’s storage when the chat is shown in another window. This way you see your conversation again when you come back. This cookie is needed for the chat to work and is not used for statistics or advertising.
Continue with Google: only if you click
At the bottom of the chat you can choose “Continue with Google”, to save your conversation and get our answer by email. If you do nothing, you simply keep chatting without us knowing who you are.
If you click, Google first shows you which details will be shared. We then receive only your name and email address. We never see your password or your mobile number. Google also sends your profile picture; we do not store it. Our server checks with Google that the sign-in is genuine and then stores your name and email address with your conversation.
Legal basis: consent (Art. 6(1)(a) GDPR): you choose it yourself by clicking.
Questions from #JAMES and your answers
To help you properly, #JAMES asks a few questions in the chat, for example your name, the destination and dates, the number of guests or the time of a service, and whether we may note your mobile number or email address. Answering is not required. What you answer is stored with your conversation and your request.
If you gave your mobile number or email address, we may also answer you that way: via WhatsApp or text message, or by email. If you do not answer, we send one automatic reminder, about 30 minutes later, in the chat and through the channel you gave. Once all questions are answered, you receive a link to a personal page with your request, where you can still add comments.
We do not send browser notifications or advertising through the chat.
Legal basis: answering your question and preparing a possible contract (Art. 6(1)(b) GDPR).
Recognising your question automatically
Your messages are read automatically to recognise what you are asking (for example renting a home, a service or a partnership) and to fill in details you write yourself, such as your name, mobile number, destination and dates, in the right place. For this we also use an AI service (Anthropic, Claude), which processes your messages only on our behalf. A #JAMES team member always decides whether a request is started; no decisions are taken about you without human involvement.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR): handling your question quickly and correctly.
Passing your request to service providers
If you ask for a service (for example cleaning or a chef), we may pass the request to service providers in your region to see who is available. This only happens after a #JAMES team member confirms it, and only with what is needed: the type of service, the place and the period, never your name or contact details.
If you tap “Chat via WhatsApp”
That is a deliberate step to contact us. We then store the same details with a short code (for example C-7K2QM) that is already in your WhatsApp message, so we can answer your message in the right context. Your WhatsApp message itself goes through WhatsApp (Meta), see section 5.
We use chat data only to help you, not for advertising, and we do not sell it.
6. Transfers outside the EU
Some providers process data in the United States. Mandrill (The Rocket Science Group LLC / Intuit) is covered by the EU-US Data Privacy Framework. For the other providers outside the EU, such as Twilio, Meta, Google, Anthropic, Netlify and Expo, we rely on appropriate safeguards: the EU-US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.
7. How long do we keep your data?
- Account data and what you enter in the app: as long as your account exists. If you delete your account, we erase this data within 30 days, unless a legal retention obligation applies.
- Website chat conversations, with your answers and (if you clicked) your name and email address via Google: as long as you are a customer, otherwise 2 years after the last message.
- Code with “Chat via WhatsApp” (code and context): 90 days.
- Cookie or browser storage to remember your conversation: 30 days.
- Verification codes: valid for 10 minutes. The record of requests (number or email address, IP address, time): as long as needed to keep your account secure.
- WhatsApp consent: until you withdraw it. We keep proof of that consent for as long as needed to demonstrate it.
- Error reports in Sentry: up to 90 days.
- Measuring downloads and new accounts in the app (section 2): we keep nothing beyond your account; Meta and Google keep these measurements according to their own retention periods. If you withdraw your permission, the app stops measuring.
8. Security
We protect your data with appropriate technical and organisational measures, such as encrypted connections (HTTPS), restricted access and a limited number of attempts when entering codes. No system is 100% secure, but we do our utmost to protect your data.
9. Your rights
You have the right to access, rectify or erase your data, to restrict processing, to object and to data portability. You can withdraw any consent at any time.
You can delete your account in the app via ⋮ → profile → delete account, or by emailing hallojames@bnbbutler.be.
Send your request to hallojames@bnbbutler.be. We will respond within one month.
If you are not satisfied, you can lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be.
10. Children
The app and the website are not intended for children under 13. We do not knowingly collect data from children under 13. If we find out that this has happened, we will delete that data. If you are a parent or guardian and you know that your child has given us personal data, please contact us.
11. Changes
We may update this privacy policy, for example with a new version of the app or a new feature on the website. The date at the top shows the latest change. We will let you know in the app about significant changes.
12. Contact
Questions about privacy? Email hallojames@bnbbutler.be.