Privacy statement

Who is responsible

Halfar Ventures BV, Zinkstraat 24, Box D7325, 4823 AD Breda, the Netherlands, Chamber of Commerce 61505528. Questions about your data go to support@brickbull.nl.

What data we process

Your email address, to sign in and to send you messages about your account. If you fill them in: your first and last name.

Your settings, such as your default assumptions for financing, interest and costs and your requirements for the bid calculator.

Your analyses: the link or the details of the home you enter, your assumptions, the results and the explanation, and whether you saved an analysis.

Your usage: when you made an analysis, whether it counted towards your limit, and roughly what it cost us at our suppliers.

For a paid plan: your customer number at Stripe, the status and dates of your subscription and the single analyses you bought. You enter your account or card number on Stripe’s payment page; we do not receive or keep that number.

Technical data: a session cookie that keeps you signed in, hashed sign-in codes and session tokens, and messages in our server logs. Those logs mostly hold error messages and sometimes an internal user number; we keep no log of the pages you visit.

If you email us: your message and our correspondence.

Why we use it, and on what legal basis

Performance of the contract: your account, your analyses, your subscription and payments, and answering your questions.

Legitimate interest: keeping BrickBull safe and affordable by preventing misuse, enforcing limits, tracking costs and fixing problems. We weighed that this has little impact on you, as we only use the data needed for it.

Legal obligation: keeping our financial records for the tax authorities.

We do not use your data for advertising, build no marketing profiles and do not sell your data.

Who we share it with

TransIP (the Netherlands) hosts our servers, the database, the backups and our email. As our host, TransIP has technical access to the systems the data is on.

Stripe processes payments. Stripe receives your email address and what you enter on the payment page, and acts as an independent controller for part of that data, for example to prevent fraud. For what Stripe does with your data and how long it keeps it, we refer to Stripe’s privacy policy.

Anthropic writes the explanation of an analysis with the AI model Claude. Anthropic receives the details of the home (including its address), your assumptions for that analysis, the results and, where available, figures about the neighbourhood. We do not send your name or email address. Combined with other data this can still relate to you, so we treat it as personal data.

Apify reads listings and comparable rentals for us. Apify only receives the link to the home or the name of the town.

We use PDOK and CBS (the Dutch government) for neighbourhood figures. PDOK receives the address of the home, CBS only a neighbourhood code.

We work with TransIP, Anthropic and Apify under their data processing agreements. Otherwise we only share your data where the law requires it.

Transfers outside the EU

Stripe, Anthropic and Apify may process data outside the European Economic Area, including in the United States. This only happens with a safeguard the GDPR recognises: certification under the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses in the agreement with that supplier. On request we tell you which safeguard applies to which supplier.

What suppliers do with the data

Under its terms, Anthropic does not use data received through its commercial API to train models, and keeps it for a limited time. Exceptions, for example when misuse is suspected, are in Anthropic’s retention policy.

Apify keeps the results of a job temporarily under its own retention policy.

How long we keep data

Account, settings, analyses and usage: as long as your account exists. If you have not signed in for two years, we email you; if you then do not sign in within 30 days, we delete your account.

After you delete your account: we erase your account, settings, analyses, usage and your Stripe customer number from our live database at once. They remain in our backups until those expire, at most 14 days later. What we must keep by law, as listed below, we only delete after that period.

Financial records: we keep invoices and payments for 7 years, as Dutch tax law requires.

We delete sign-in codes as soon as you use them; an unused code expires after 10 minutes and is deleted within a day. A session ends after 30 days or when you sign out, and is deleted within a day after that.

Server logs are overwritten automatically once they reach a fixed maximum size, usually within a few weeks.

Emails with us: up to two years after your last message.

At suppliers their own retention periods apply, see above.

Cookies

The app on brickbull.app sets one cookie: a session cookie that keeps you signed in. It is needed for the service. We use no advertising or analytics cookies and no other techniques to track you, and we load fonts from our own server. The website brickbull.nl sets no cookies. On Stripe’s payment page Stripe’s cookies apply.

Security

We take measures that fit the data we process. All connections use HTTPS. We store sign-in codes and session tokens hashed, so that someone who gets hold of a copy of the database cannot simply sign in with them. Only BrickBull’s administrators can access the servers, besides the technical access of our host. If something does go wrong with your data, we report it to the Dutch Data Protection Authority and to you where required.

Your rights

You have the right to access, correct and delete your data, to restrict its processing (we then keep your data but temporarily do not use it) and to data portability: receiving your data in a common file format to use elsewhere.

You can object to processing based on our legitimate interest. We then stop, unless we have compelling reasons that outweigh your interest.

Much of this you do yourself in your profile: download your account and analyses as a file (JSON), change your name and settings and delete your account. For anything else, email support@brickbull.nl. We reply within a month and may ask you to confirm the request is yours.

If you disagree with how we handle your data, you can complain to the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

Changes

If we change this statement in an important way, we let you know by email in advance.