This English version is the binding text of this document. Translations are provided for convenience only; if a translation differs from this English version, the English version prevails.
[Controller legal name, address and contact — and a DPO/contact e‑mail — to be inserted by the owner.] For personal data our business customers upload about their own contacts and employees, Butterpie acts as a processor on the customer’s instructions under a data‑processing addendum.
To provide and secure the Service (performance of a contract), to comply with legal obligations (e.g. tax/accounting record‑keeping), for limited legitimate interests (security, fraud prevention), and on your consent for voice conversations with the assistant (section 7a), which you can withdraw at any time. [Bases to be confirmed per processing activity by counsel.]
We retain personal data only as long as needed for the purposes above or as required by law. Statutory accounting records are retained for the periods Polish law requires. Data tied to a closed account is deleted or anonymized after a defined window, subject to legal holds. For each AI assistant answer we keep a note of which records were used and how many AI credits it used, but not the text of the question or of the answer; the note is kept under the same retention as the rest of your account’s records. Help requests, with their conversation and any picture of the screen, are kept for up to 10 years after the request's last message or change of status, or longer if a legal hold requires it; messages sent through a contact form are kept for up to 10 years after we receive them (section 7b).
We share data with sub‑processors (hosting, payment processing, e‑mail delivery, AI assistance) under contract, only as needed to run the Service. We do not sell personal data. Our current sub‑processors are:
Payments are handled by our payment provider, named on the checkout page, as merchant of record. You can ask us for the names of all our sub‑processors at privacy@butterpie.io.
Hosting is within the EU/EEA. Where any transfer outside the EEA occurs, it is protected by appropriate safeguards (e.g. Standard Contractual Clauses). The optional AI features involve such a transfer: their data is processed in the United States, under the safeguards described in section 7a.
Subject to law you may request access, rectification, erasure, restriction, portability and objection, and may lodge a complaint with the Polish supervisory authority (UODO). The Service provides self‑serve data export and erasure request flows. Contact privacy@butterpie.io.
The assistant is optional. When you ask it something or talk to it, we send our AI service provider, OpenAI Ireland Limited (“OpenAI”, a sub‑processor bound by a data‑processing agreement), only what the answer needs:
We send a pseudonymous identifier instead of your name or e‑mail address. We never send your password, attachments or PDF files, other customers’ data, or anything your role does not allow you to see.
We instruct OpenAI not to store conversations. OpenAI does not use this data to train its models; it may keep it for up to 30 days to detect abuse and then deletes it, unless it is required by law to keep it longer. Butterpie keeps no audio and no transcript of voice conversations; the conversation on your screen is kept only in your browser tab and is cleared when you sign out. For each answer, Butterpie keeps a note of which records were used and how many AI credits the answer used, but not the text of your question or of the answer.
OpenAI Ireland Limited transfers this data to its affiliate OpenAI OpCo, LLC in the United States, which processes it there. This transfer outside the EEA is based on the Standard Contractual Clauses adopted by the European Commission (Article 46(2)(c) GDPR). You can ask us for a copy of these safeguards at privacy@butterpie.io.
The assistant never saves, issues or sends anything by itself; you do. Voice conversations need your consent, which you can withdraw at any time in the assistant; withdrawing ends any conversation in progress. A red indicator shows whenever the microphone is on.
A “Help & feedback” button is shown in the app once you have signed in, in the public demo, and on the sign‑in, sign‑up and two‑factor screens; using it is optional. When you are signed in and use it to ask for help, report a problem or share feedback, we keep:
Before you send a request, the form shows you the picture and the details. You can remove the picture, and the request is then sent without it; please remove it if it shows something support does not need to see.
Only you and Butterpie support staff can see your requests; other members of your organization, including its owners and administrators, cannot. Support staff use a request only to answer you, to put right what you report and to improve the Service, and each time they open a request or its picture, the access is recorded. Replies are written by people; we do not send help requests to our AI service provider. We keep a request, its conversation and its picture for up to 10 years after the request's last message or change of status, or longer if a legal hold requires it (section 4).
When support replies, you see a notice in the app, and we send a short e‑mail to your account’s e‑mail address saying that a reply is waiting. That e‑mail never contains the text of your request or of the reply; you read the reply in the app after signing in. It is sent through our e‑mail delivery provider (section 5).
In the public demo, on the sign‑in, sign‑up and two‑factor screens, and for anyone whose role does not include help requests, the button opens a contact form instead, like the one on our website. A contact form sends no picture: it sends your e‑mail address, your name if you give it, your message and, when you write from the app or the demo, the name of the screen you wrote from; we also keep the country and a shortened form of your network address, never the full IP address. If you are signed in when you send it, we also record which user account sent it, except in the demo, where a message is never linked to an account. We answer by e‑mail, and keep these messages for up to 10 years after we receive them.
We apply per‑tenant isolation, encryption in transit, multi‑factor authentication, audited access and data‑minimization by design. No system is perfectly secure; we work to reduce and respond to risk.
We will post updates here and, for material changes, notify account holders.