Legal
Privacy policy
Last updated: 19 October 2026
1. Who are we?
BBE Buddy is a product of Nathan Derkse. We are the data controller for personal data processed through this service. Contact: nathan@vergelabs.nl.
2. What data do we collect?
- Account data: email address and name, at registration.
- Conversations: messages you send to the assistant and the responses you receive.
- Uploaded documents: files you upload for processing.
- Generated materials: documents, plans and other output produced for you.
3. What do we use your data for?
Solely to deliver the service: source-grounded educational guidance and the materials built from it. Your data is not sold to third parties and is not used for third-party marketing. Administrators of BBE Buddy can read conversations to resolve problems and to improve the quality of answers, for example when an answer has received feedback. Other users cannot see your conversations.
4. Legal basis
- Performance of contract: you hold a subscription and we need your data to deliver it.
- Legitimate interest: improving the service and resolving technical issues.
5. Processors and locations
Conversations and uploaded documents are stored in the EU, in Ireland. To write an answer, the question and the passages selected from the collection are sent to an AI model outside the EU.
| Processor | Location | Purpose |
|---|---|---|
| Supabase | Ireland (EU) | Database and file storage: account profile, conversations, uploaded documents |
| Zilliz | Ireland (EU) | Search index of the collection |
| Vercel | Dublin, Ireland (EU) | Hosting |
| Auth0 | United Kingdom | Sign-in and account security |
| OpenRouter | United States | Sends the question and the selected passages to the AI model that writes the answer (Anthropic, OpenAI or Google) |
| Cohere | Outside the EU | Search: turns the question into a search query and ranks the passages found |
| Sentry | Germany (EU) | Error tracking |
| Stripe | EU | Payment processing |
| Resend | United States | Account and service emails |
6. Retention periods
Conversations and materials are kept for as long as your account is active, and you can delete conversations yourself at any time. When you delete your account, all of your data is permanently deleted within 30 days.
7. Your rights
- Access: request which data we hold about you.
- Rectification: have inaccurate data corrected.
- Erasure: request deletion of your data.
- Portability: request an export of your data.
- Objection: object to certain processing.
8. Export and deletion
You can exercise these rights directly:
- Data export:
GET /api/user/export - Delete account:
DELETE /api/user/delete
Or write to nathan@vergelabs.nl and we will handle the request within 30 days.
9. Cookies
Essential cookies only: the session cookies required to keep you signed in. No tracking cookies, no analytics cookies, no third-party advertising cookies.
10. Complaints
Please contact us first at nathan@vergelabs.nl. You also have the right to lodge a complaint with your local data protection authority.