ButlerB Privacy Policy
ButlerB is a meal-planning app. We collect what the app needs to plan meals for your household, we run no ads or analytics trackers, we never sell your data, and you can delete your account and all its data at any time in Settings → Account → Delete account.
1. What we collect
- Account — email address, name and profile picture from sign-up (directly or via Google or Apple). Sign-in is handled by an authentication provider; we never see your password.
- Preferences — region, language, units, cuisine, avoided ingredients, diet type, grocery budget and notification settings. Your region drives store suggestions and storage tips. We never collect GPS location.
- Household and dietary data (sensitive) — household members, and, if you add them, allergies, calorie targets, dietary goals and diet-related health conditions. This is special-category data (GDPR Art. 9). We process it only with your explicit consent, only to filter recipes and plans for your household — including sending it to our AI partner when you use the diet features — and you can remove it at any time in Settings. If you add another person’s details, you confirm you are entitled to.
- Your content — recipes (with their source links), meal plans, pantry, shopping lists, cooking history, and the photos you submit: recipes to import, fridge and shelf scans, receipts and handwritten lists, photos attached to a cook, and a photo you add to a recipe. Photos are processed by our AI partner to do what you asked. Every photo attached to a cook or added to a recipe is screened automatically by the same partner before anyone else can see it — or, if your household has not agreed to AI features or the check cannot run, it is shown and a person reviews it. A recipe’s photo is shown wherever the recipe is: your household, a group you post it to, and — once it has been checked — its public page if you publish it.
- Social — if you use the social features: display name, connections, shared cooks and reactions, and the recipes you post to a group. You are not discoverable by default, nothing of yours reaches anyone until you choose an audience, and there is no public feed. You can block anyone and report content or an account; we may remove content or suspend an account that breaks the rules.
- Gatherings — when you reply to an invitation you may, optionally, share your allergies and diet type with that host for that occasion. It is off unless you turn it on, it is a copy taken at that moment, only the host household sees it, and you can withdraw it at any time.
- Technical — a push-notification token if you enable notifications, and usage and cost logs for the AI features (rate limiting and budgets, not profiling).
Voice input
Tap Ask BubbleBee and the bee listens while it is lit; switch it off and it is gone. There is no wake word running in the background, and your device’s microphone indicator shows whenever listening is active. While the bee waits for the word you chose, nothing is recorded. Only after your word does it record, and only until your closing word, silence, or fifteen seconds. That clip is transcribed, used once, and never uploaded to ButlerB or anyone else. You choose both words in Settings → ButlerB Assistant, and you can clear the word so that everything said while the bee is lit counts as a request.
Transcription runs either on a speech model you download to your phone, in which case no audio leaves your device, or on your device’s own speech service (Apple or Google), which may process the clip on their servers under their terms. Either way, only the resulting text reaches ButlerB. Voice sessions leave only what a command did; everything said outside the gate is never recorded and is discarded on your device. The microphone permission is optional; every feature works with typed input.
2. Why we process it (lawful bases)
| Purpose | Basis (GDPR) |
|---|---|
| Providing the service: accounts, sync, plans, lists, AI features on what you submit | Contract, Art. 6(1)(b) |
| Filtering recipes and plans for allergies, diets and conditions; sharing them with a gathering host | Explicit consent, Art. 9(2)(a) — revocable |
| Automatic screening of shared photos, reports, blocking and moderation | Legitimate interests, Art. 6(1)(f) — a safe service |
| Notifications | Consent — opt-in, revocable in system settings |
| Abuse prevention, rate limiting, error monitoring | Legitimate interests, Art. 6(1)(f) |
3. Who processes it for us
| Recipient | What they receive |
|---|---|
| Authentication provider | email, name, sign-in metadata |
| Cloud database and hosting | app data at rest and in transit |
| AI processing partner | the text and photos you submit to AI features, and with your explicit consent your dietary context. Not used to train their models. |
| Push-notification delivery | push token, notification content |
| Recipe page-rendering service | only the URL you asked to import |
| Error and crash monitoring | technical error reports — never your content or dietary data |
Public content, nutrition and weather services are queried with content identifiers only, never your identity. Some providers process data in the United States under the EU–US Data Privacy Framework or Standard Contractual Clauses. The current list of processors is available from admin@butlerb.com.
4. Retention
Your data is kept while your account exists. Deleting your account deletes your personal data without undue delay; only anonymous aggregate counts may remain, and backups roll off on our providers’ standard cycles.
5. Your rights
You can access, correct, delete and export your data, restrict or object to processing, and withdraw consent for dietary data at any time in Settings. A complete machine-readable export is available on request. Write to admin@butlerb.com; we answer within one month. You may also complain to your supervisory authority — in Sweden, IMY (imy.se).
6. Children
You must be 16 or older to create an account. An adult account holder may note family members’ dietary needs, including children’s, and controls that information. Shared photos in which a child is the main subject are declined by the automatic screening.
7. Security and changes
Data is encrypted in transit and at rest. Production data access is limited to a read-only credential for routine work and is never used to browse user data. We post changes here and update the effective date; material changes are announced in the app before they take effect.
8. Contact
ButlerB AB — admin@butlerb.com