Butler Privacy Policy
1. Who we are
Butler is operated by Bluespine Consulting Cc ("Bluespine", "we", "us"), the responsible party for the personal information processed in the app under the Protection of Personal Information Act 4 of 2013 (POPIA). Butler connects people who need help at home and on the road (clients and their families) with vetted service providers ("Butlers"). Our Information Officer is Mashoeu Harold Maleka (Katlego), reachable at privacy@bluespine.co.za.
You sign in to Butler with your Validate@ZA identity, which Bluespine also operates. How Validate@ZA verifies your identity is described in the Bluespine Privacy Policy; this page covers what Butler itself processes.
2. What we collect
| Category | What | From |
|---|---|---|
| Identity | Your name, South African ID number and verification level, received from Validate@ZA when you sign in. | Validate@ZA |
| Profile and contact | Phone number, preferred language, home address, emergency contacts and next of kin you add. | You |
| Location | Your location while you request or provide a service, and live trip tracking during an active job. Butlers' availability location while they are on shift. | Your device, with permission |
| Care information | Mobility level and medical notes you choose to add so a Butler can help safely. This is special personal information. | You or your authorised family member |
| Butler credentials | For Butlers: driving licence and professional driving permit data read from the card barcode, vehicle licence disc data, trade and professional registrations, references, uploaded certificates, and the outcome of the police clearance. Criminal-record information is special personal information. | You, public registers, Validate@ZA |
| Photos and voice | Photos you take or choose (profile, receipts, proof of work, credential documents). Voice commands, only when you tap the voice button; speech is converted to text on your device. | You |
| Jobs and messages | Service requests, prices, ratings and in-app chat with the other party to a job. | You and the other party |
| Payments and payouts | Payment records for services. For Butlers: bank account details for payouts and earnings records. | You, our payment services |
| Device | A push-notification token, device type, app version and security logs. | Your device |
| Contacts | Only if you choose to invite someone from your contacts; we receive just the contact you pick. | Your device, with permission |
3. Why we use it
- To provide the service (POPIA s11(1)(b)): match you with a qualified Butler nearby, run the job, track trips, take payment and pay Butlers.
- To keep people safe (s11(1)(d) and (f)): verify Butlers' identity and credentials before they can take work, check police clearances, and support emergency SOS.
- With your consent (s11(1)(a), s27(1)(a)): care information and other special personal information, push notifications, contacts and voice features. You can withdraw consent at any time.
- To meet legal obligations (s11(1)(c)): tax and financial records, and lawful requests from authorities.
We use Anthropic, through its API, as an operator that processes information for us in two places: to understand the wording of a service request you type or dictate, so the app can fill in the request for you to check before you send it; and to read the details on certificates a Butler uploads (for example caregiver, first-aid and food-handler certificates). Anthropic processes this under its commercial data-processing terms and may do so outside South Africa (see section 4). We do not make decisions about you solely by automated means.
4. Who sees it
- The other party to a job: a client sees the assigned Butler's name, photo, rating and live location during the job; a Butler sees the client's name, the pickup and destination addresses, and care information the client chose to share for that job.
- Family members you authorise in your care circle, for the roles you give them.
- Service providers who process data for us: Google (Firebase Cloud Messaging for push notifications and Google Maps Platform for maps and addresses), Anthropic (understanding the wording of service requests and reading uploaded certificates), Datanamix (identity checks through Validate@ZA), public registers we check credentials against (for example PIRB, SAQCC Gas, HPCSA), and the banks and payment services that move money.
- Authorities, only where the law requires it.
We do not sell, rent or trade personal information. Butler is available only in South Africa and we host it in South Africa. Some service providers, such as Google and Anthropic, may process data outside South Africa; we rely on POPIA s72 safeguards when that happens.
5. AI assistants you connect
If you connect an AI assistant (such as Claude Code, Codex, OpenCode or Antigravity) to your Butler account, Butler sends it what you ask for: your own care profile and requests (which can include health details), your saved cards in masked form, and, if you are a Butler, your profile, application, work offers and credentials. We do this only after you approve it on the Validate@ZA consent screen, which names the assistant and the company that runs it. That company receives the information as your service provider, not ours; it handles it under its own terms and may process it outside South Africa. An assistant never receives information about the people in your care circle and cannot book, pay or change anything. Disconnect it at any time in the Butler app under Settings, Connected apps and AI assistants; it then cannot renew its access, and access already given ends within an hour. We keep a record of each approval: who, which assistant, when, and the wording shown.
6. How long we keep it
- Your account information is kept while your account is open.
- Live trip locations are kept only as long as needed for the job and any dispute about it.
- Payment, earnings and payout records are kept for five years after the transaction for tax law, in anonymised form if you delete your account.
- Security logs are kept for 12 months.
7. Deleting your account
In the app: Settings → About & Legal → Delete my account. You can also email privacy@bluespine.co.za from your registered address.
Deleting your account removes your Butler profile, addresses, contacts, care information, vehicles, credentials and documents, location history and devices, and then deletes your Validate@ZA identity, which signs you out of every Bluespine app. Records other people or the law rely on are kept without anything that identifies you: completed jobs (without addresses), ratings (without your comments), chat (your messages are replaced), and payment, earnings and payout records. We cannot delete an account while a job is in progress, a payout is still being made, or a Care Bank balance remains; the app tells you what to finish first.
8. Your rights
Under POPIA you may ask for access to your information, ask us to correct or delete it, object to processing, and withdraw consent. Email privacy@bluespine.co.za with the subject "POPIA Data Subject Request"; we respond within 30 days. You may complain to the Information Regulator at POPIAComplaints@inforegulator.org.za.
9. Security
We encrypt data in transit, restrict access by role and clearance level, verify sign-ins through Validate@ZA, and keep audit logs of sensitive actions. Butlers must pass identity, credential and police-clearance checks before they can take work.
10. Children
Butler accounts are for adults, with one exception: a parent or guardian whose identity Validate@ZA has verified may add their teen. The guardian consents on the teen's behalf, approves the teen's bookings, pays for them and receives the teen's safety alerts. Information about a person in care, including a minor, is provided by the adult responsible for them, who consents on their behalf.
11. Changes
We will update this page when our practices change and tell you in the app about material changes.