Privacy policy: Biilby app and platform
Last updated: 12 October 2026
1. Who we are, and our role
Biilby SRL, Avenue Jean Monnet 1/1, 1401 Nivelles, Belgium (BE 1042.893.619) provides Biilby, a construction site-management platform used through the web app at app.biilby.ai and the Biilby mobile app for iOS and Android.
Biilby is sold to companies. When your employer, or a company that invited you to a project, uses Biilby:
- That company is the controller of the project data: drawings, documents, site records, photos, messages and mail about its projects. We process it on its behalf, under a data processing agreement, and only on its instructions.
- We are the controller for the data we need to run your account and the service itself: your sign-in details, security logs, and usage records used for billing and abuse prevention.
For questions about project data, your company is usually the right first contact. You can always write to us at [email protected].
2. What we collect through the app
| Data | Examples | Why |
|---|---|---|
| Account details | name, email address, company, role, preferred language, the languages you speak (for dictation) | to sign you in and show the right projects |
| Sign-in data | password (stored hashed), session tokens, Microsoft Entra ID identity if you sign in with Microsoft | authentication and security |
| Content you create | site log records, comments, notes, messages, checklists, questions to and answers from the Biilby assistant | the service itself |
| Photos and files | photos you take or attach, documents you upload | the service itself |
| Photo location | when a photo carries GPS coordinates in its metadata, the coordinates and the time it was taken are stored with the photo | to show where and when a site photo was taken |
| Audio | voice notes you send; recordings made while you dictate, when a better transcription is requested | voice messages and transcription |
| Device data | push notification token, app version, device platform | to deliver notifications and support the app |
| Usage records | which AI features were used, when, on which project, and their cost | billing, fair-use limits, service quality |
We do not track your location in the background or ask for location permission. The only location we store is what a photo’s own metadata contains, as above. We do not read your contacts, use advertising identifiers, or track you across other apps and websites. The “Save as contact” feature opens your phone’s own contact form; nothing from your address book is sent to us. Face ID and fingerprint unlock happen entirely on your device; we never receive biometric data.
3. How the AI features work
Biilby’s assistant, suggestions, morning brief, search and document analysis use artificial-intelligence services provided by Mistral AI, in the European Union. To answer a question or prepare a suggestion, the relevant project content (text from documents, schedule and site-log entries, photos, messages, voice notes) is sent to Mistral AI, which processes it to return a result. It acts as our sub-processor under contract and does not use customer content to train its models.
Suggestions are proposals. Nothing changes in a project until a person accepts it.
4. Who we share data with
We do not sell personal data or share it for advertising. We use these service providers (sub-processors):
| Provider | What it receives | Where |
|---|---|---|
| Scaleway | hosting: database, files, encrypted backups | France, Netherlands |
| Mistral AI | all AI processing: the assistant, analysis, photo descriptions, the search index, text recognition and voice transcription | European Union |
| Microsoft | outgoing email; Entra ID sign-in | European Union |
| Expo, Apple, Google | push notifications: device token, notification title and the start of the message | United States |
| Sentry | error reports from our servers, with email addresses masked | European Union (Germany) |
Push notifications are the only data that leaves the European Union. Those transfers rely on the European Commission’s Standard Contractual Clauses.
Within a project, what you post is visible to the people your company gives access to that project. Personal notes are visible only to you and to the people you share them with.
5. How long we keep it
- Project data: for as long as your company keeps the project, then deleted with it.
- Project mail that nobody accepted into the project: deleted after 30 days.
- Your account: until you delete it (see §6) or your company removes it.
- Encrypted backups: kept 35 days, then deleted automatically. They are locked against early deletion for 30 days to protect them from tampering.
- Invoices and billing records: as long as Belgian accounting law requires (7 years).
6. Deleting your account
You can delete your Biilby account at any time, and the deletion is immediate:
- In the app: Settings › Account › Delete account.
- Without the app: go to https://biilby.ai/account-deletion and request a confirmation link by email.
We delete your sign-in, profile, email address, sessions, devices, personal notes, private conversations with the Biilby assistant and preferences, and email you when it is done. Content you added to a company’s projects (records, photos, comments, messages) belongs to that company’s project files: it stays with the project under your name, where you remain listed as a contact without an account, unless the company asks us to remove it. Backups made before the deletion expire within 35 days. We keep a short security record of the deletion and any records we are legally required to keep, such as invoices.
You can also leave a single company without deleting your account: Settings › Account › Your companies.
7. Your rights
Under the GDPR you can ask to access, correct, delete or export your data, object to or restrict its processing, and withdraw consent where we rely on it. Write to [email protected]. If your request concerns project data, we pass it to the company that controls it. You can also complain to the Belgian Data Protection Authority (www.dataprotectionauthority.be).
8. Legal bases
- Contract: to provide the service to you and to your company.
- Legitimate interests: security, abuse prevention, improving reliability.
- Legal obligation: accounting and tax records.
- For project data, the legal basis is your company’s, as controller.
9. Children
Biilby is a professional tool for adults. It is not directed at children, and we do not knowingly collect data from anyone under 16.
10. Security
Data is encrypted in transit (TLS). Backups are encrypted before they leave our servers and are stored in a second EU region. Access to production systems is restricted to named staff using hardware security keys.
11. Changes
We will post changes here and, for significant ones, tell company administrators in advance.
12. Contact
Biilby SRL, Avenue Jean Monnet 1/1, 1401 Nivelles, Belgium · [email protected]