Privacy

1. Who we are

Sebastian Ott
theButler.network
Lichtel 36, 97993 Creglingen, Germany
Email: privacy@thebutler.network

We are the controller for the processing described here.

Data Protection Officer: We have not currently appointed one. Under § 38(1) of the German Federal Data Protection Act, appointment is not required because fewer than 20 people are permanently engaged in the automated processing of personal data. We keep under review whether Art. 37(1)(b) GDPR triggers an appointment obligation, and we document that assessment. Please direct all privacy matters to the address above.

2. Our approach

We process as little personal data as we can. Specifically:

• You can use theButler.network without an account.
• Without an account, no conversation history is stored on our servers.
• We use no advertising pixels and no cross-site tracking. For privacy-friendly audience measurement we use Vercel Web Analytics, without cookies and without storing anything on your device (Section 3.12).
• Our application logs no IP addresses, query content or user identifiers. Our host’s access logs do record IP and browser details for technical reasons — described under 3.1.
• We do not sell personal information.

3. What we process

3.1 Visiting the website

Data: IP address, timestamp, page requested, HTTP status, data volume, browser type, operating system. Purpose: delivering the website, operational security, error diagnosis. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning service; see Recital 49). Location: static content is delivered through Vercel's global CDN; server-side processing takes place in the Dublin, Ireland region (dub1). The processor is Vercel Inc., USA. Retention: runtime logs for 24 hours, then deleted automatically by the host.

3.2 Abuse prevention and rate limiting

Data: IP address (as a counting key), time window, request count. Purpose: preventing automated bulk requests; limiting AI processing costs. Legal basis: Art. 6(1)(f) GDPR. Location: Hetzner Online GmbH, data centre in Falkenstein (Germany); encrypted backups in Helsinki (Finland). Retention: maximum 24 hours, then automatically deleted.

3.3 Search and chat — without an account

Data: your query, the current session's history, derived search terms. Purpose: producing the recommendation. Legal basis: Art. 6(1)(b) GDPR (performing the service you requested), otherwise Art. 6(1)(f). Recipient: OpenAI Ireland Ltd. as processor. Location: United States. The contracting party is OpenAI Ireland Ltd.; the processing itself takes place in the United States. Retention: we do not retain your queries. Short-lived caches exist during processing (up to 15 minutes). OpenAI may retain API data for abuse monitoring for up to 30 days. Note: your queries are not used to train AI models.

3.4 Conversation history — with an account

Data: complete conversations (your messages and the replies), conversation title, association with your account. Purpose: making your history available across sessions and devices. Legal basis: Art. 6(1)(b) GDPR. Location: Supabase, region eu-west-1 (Ireland). Retention: 180 days after the last activity in a conversation, then deleted automatically. You can delete any conversation yourself at any time.

When you sign in for the first time, we ask whether conversations previously stored only in your browser should be moved into your account. This does not happen without your agreement.

3.5 Preference profile

Data: up to four attributes derived from your queries — pet type, style preference, genre preference, mood preference. Purpose: better recommendations without repeating the same information. Legal basis: Art. 6(1)(b) GDPR. What we deliberately do not store: materials and intolerances. A statement such as "no nickel" may point to an allergy and would then be health data under Art. 9(1) GDPR, requiring your explicit consent. Until we ask for that consent, such a statement takes effect only within the current conversation and is not stored. Location: Supabase, region eu-west-1 (Ireland). Retention: until you withdraw consent or delete your account. Your control: Settings → What Edwin remembers shows every stored attribute in plain text and lets you delete each one. A deleted entry does not come back, even if an older session still holds it in your browser.

3.6 Account and sign-in

Data: email address, registration and last sign-in timestamps, session identifier. Purpose: magic-link sign-in (no password). Legal basis: Art. 6(1)(b) GDPR. Recipient: Supabase as processor, including sending the sign-in email. Retention: until you delete your account.

3.7 Watchlist

Your watchlist is stored exclusively in your browser and is not transmitted to us.

3.8 Going to a retailer

When you click a retailer offer, you leave theButler.network. The retailer and the relevant partner network receive your IP address and may set their own cookies. Their privacy notices apply.

3.9 Product images

Product images load directly from retailers' servers or their image services. The provider therefore receives your IP address, browser type and the page you are viewing — even if you never click the offer. This is technically unavoidable because some partners (notably Amazon) contractually prohibit caching their images.

Legal basis: Art. 6(1)(f) GDPR.

3.10 Contacting us

Data: email address, the content of your message, any further details you provide. Purpose: handling your enquiry. Legal basis: Art. 6(1)(b) or (f) GDPR. Retention: six months after your enquiry is resolved; statutory retention periods are unaffected.

3.11 MCP interface (AI assistants)

We offer an MCP endpoint through which third-party AI assistants (for example Claude or ChatGPT) can search our product catalogue on your behalf. If you use one of those assistants and it queries theButler.network, the following applies.

Data: technical metadata about each call — the tool that was called, the market and language it was called for, the vertical, the number of results and offers returned, the response time, the error or empty-result reason, whether a ranking ran, the identifiers of the offers returned, the length of your query, a hashed form of your query, and a hashed session identifier. Not stored: the text of your query, and your IP address. The query is reduced to a SHA-256 hash before storage; the plain text is never written. Session identifier: if your assistant sends a session id, we hash that. If it does not, we derive the identifier from the connecting address, the client software and a ten-minute time window, and hash the result. A hash of an IP address remains personal data (CJEU C-582/14, Breyer), which is why this entry exists and why the retention period below applies to it. Purpose: providing product search inside third-party AI assistants, and measuring whether that search works — how often it returns nothing, how often it fails, how long it takes. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is operating and improving an interface we make available free of charge. Recipients: we send the text of your query to OpenAI Ireland Ltd. as our processor for the search (Sections 5 and 6); OpenAI may store it for up to 30 days for abuse monitoring and does not use it to train AI models. The other data listed above is not passed on. The AI assistant you use is not a recipient of this data — it receives only the search result. Location: Hetzner Online GmbH, data centre in Falkenstein (Germany); encrypted backups in Helsinki (Finland). Your query is processed by OpenAI in the United States. Retention: 90 days, then automatically deleted.

3.12 Audience measurement (Vercel Web Analytics)

Data: for each page view: the page visited (without query parameters or anchors, so without the text of your search), the referring page, the time, country and region (derived from the IP address), device type, operating system and browser with version. Recognition: no cookies and nothing stored on your device. To count visits, Vercel derives a hash from the request, which is discarded after 24 hours. Your IP address is not stored for this. Purpose: aggregated statistics on which pages are visited how often and where visitors come from, so we can improve the service. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly audience measurement). You can object at any time (Art. 21 GDPR); an ad or script blocker in your browser also prevents the measurement. Recipients: Vercel Inc. as our processor. Location: Vercel Inc., United States (Sections 5 and 6). Retention: the hash used for recognition is discarded after 24 hours. After that, the individual data points no longer relate to you.

4. Storage on your device

We store the following in your browser. This storage is strictly necessary for the functions you have requested and therefore requires no consent under § 25(2) no. 2 TDDDG.

We set no analytics, tracking or advertising cookies. You can clear all local data through your browser settings, or use "Delete all local data" in our settings. Audience measurement under Section 3.12 does not store anything on your device either.

5. Processors and recipients

The table above is the complete list of our processors. If one is added or removed, we update this notice.

6. International transfers

Some providers process data in the United States. We have concluded the European Commission's Standard Contractual Clauses (Decision 2021/914) with all of them and have documented a transfer impact assessment for each.

Where available, we use European processing regions: accounts, conversation history and preference profiles sit with Supabase in Ireland (eu-west-1), the product catalogue and the data in sections 3.2 and 3.11 with Hetzner in Germany (encrypted backups in Finland), and the website's server-side processing runs in Ireland (dub1).

Your queries to the language model are not processed in Europe. OpenAI's EU data residency requires a separate, project-level configuration that we do not have, so your input is processed in the United States. The basis is the Standard Contractual Clauses together with a documented transfer impact assessment. If you would rather not have this, use the search without the assistant.

7. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection to processing based on legitimate interests (Art. 21) and withdrawal of consent with future effect (Art. 7(3)).

Exercise most rights yourself

• Settings → Download my data — full export in JSON format
• Settings → What Edwin remembers — view and delete individual attributes
• Settings → Delete account — deletes your account and all associated data
• Sidebar → Delete conversation — deletes an individual conversation

Written requests are answered within one month. For complex requests this may be extended by two months, and we will tell you. Requests are free of charge. We ask for additional identifying information only where we have reasonable doubt about your identity — we do not require copies of identity documents as a matter of course.

Complaints: you may lodge a complaint with a supervisory authority. Our lead authority is Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg. In the UK: the Information Commissioner's Office. In Switzerland: the Federal Data Protection and Information Commissioner.

8. Automated processing

We use artificial intelligence to understand your query and to select and order products, taking into account your query and, if present, your preference profile.

No automated decision-making within the meaning of Art. 22 GDPR takes place. Product recommendations produce no legal effects and do not similarly significantly affect you. You are always free not to follow them.

We explain which factors determine ordering in How recommendations work.

9. Security

We apply technical and organisational measures under Art. 32 GDPR, including encrypted transmission (TLS), database-level access restriction, multi-factor authentication for administrative access, request rate limiting, security headers and regular updates of the components we use.

10. Children

Our service is not directed at children. We do not knowingly collect personal information from anyone under 16 (under 13 in the United States). If you believe a child has provided us with data, please tell us and we will delete it promptly.

11. Changes

We update this policy when our processing or the legal position changes. The current version is always available on this page. We notify registered users by email of material changes.