Privacy policy

Who we are

Blue Bean Data is a trade name of Kristof Menyhert, a sole proprietorship (eenmanszaak) registered with the Dutch Chamber of Commerce under KvK number [to be added], located at [to be added]. VAT number: [to be added]. Contact: [to be added].

We are the controller for the personal data described here.

What we collect and why

Conversations with the assistant: your messages, its replies, and what we derive from them to prepare for working with you: a short project summary, an internal indication of how well the project fits us, and an indicative price range. We use this to answer you, assess your request and prepare a call. Legal basis: steps you ask for before a possible contract (GDPR art. 6(1)(b)), and our legitimate interest in improving our answers (art. 6(1)(f)).

Your email address, when you ask for a sign-in link or book a call: to send the link, keep your conversations linked to you across devices, and reply to your request (art. 6(1)(b)).

Booking details: name, email address, time and topic of the call (art. 6(1)(b)).

Project rooms, when we work on a project with you: the project plan, notes and meeting records, documents you or we upload, proposals and who accepted them, and the email addresses of the people invited. Everyone in the room sees what is shared there, including the sales partner who introduced you, if any; our team and that partner can also keep internal notes. The AI reads the room's notes and documents to write the plan and to prepare our conversations (art. 6(1)(b)).

Technical data: IP address, basic browser information and server logs, used to keep the service secure and prevent abuse, including rate limits and an automatic bot check (art. 6(1)(f)).

The AI assistant and automated assessment

The assistant runs on our own hardware in the Netherlands. On the way there, the encrypted traffic passes through Cloudflare's network. Your messages are not sent to OpenAI or any other external AI provider.

The assistant can make mistakes. The fit indication and price range are calculated automatically to help us prioritise and prepare. They never decide anything on their own: a person from our team reviews every request, and no decisions with legal or similarly significant effects are made automatically (GDPR art. 22).

Cookies

We use one strictly necessary cookie, "sid", which keeps your session and conversations together for up to 90 days. We don't use analytics or advertising cookies.

If you came to the site through a link from one of our sales partners, a "ref" cookie remembers that partner for 30 days, so the conversation you start is passed to them. It holds only their code.

Our bot check (Cloudflare Turnstile) looks at technical signals from your browser only to tell people from automated traffic.

How long we keep it

Conversations, including the project summary and estimate: deleted 3 months after the last message. You can delete a conversation yourself at any time in the chat sidebar.

Booking details: deleted 3 months after the call.

Project rooms: kept while we work on the project together, and deleted 12 months after the room is closed (when the project doesn't go ahead or is archived), together with its documents and the conversation it started from.

Shareable project briefs (only if you create one): a summary without your contact details, visible to anyone with the link. Deleted together with the conversation.

Your sign-in account (email address): deleted after 12 months without signing in.

Technical logs and rate-limit data: kept only briefly, for days to a few weeks.

If you become a client, we keep contract and invoicing records outside this website for as long as Dutch law requires (generally 7 years).

Who else processes it

We use a small number of service providers, under data processing agreements: Railway (hosting, database and document storage), Resend (email delivery) and Cloudflare (bot check, and the network in front of our AI server). When you join a call via Google Meet, Google processes data for that call under its own privacy terms.

Where providers process data outside the EU, transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. We never sell your data or use it for advertising.

Your rights

You can ask for access to your data, correction, deletion, restriction of processing or a copy in a portable format, and you can object to processing based on our legitimate interest. Email [to be added]; we reply within one month.

You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Security

Connections are encrypted, sign-in links and sessions are stored only in hashed form, and access to conversations is limited to you and our team.

Children

This website is meant for businesses and is not aimed at children under 16.

Changes

If we change how we handle personal data, we update this page and the date at the top.