Launch Café Privacy Policy
Draft of 6 November 2026. English version of docs/privacybeleid.md; keep both in sync. Everything marked [VERIFY] must be checked by Amber or a lawyer before publication. Remove this note and the markers when publishing.
This policy explains what data Launch Café processes when you connect Launch Café to your AI assistant (such as Claude), why, for how long, and what your rights are. It applies to the connection at https://mcp.launchcafe.be and the related admin environment. It supplements our terms of use. [VERIFY: the existing terms are Madame Pixel's and do not mention Launch Café; see docs/gdpr-verwerking.md, point 12 and docs/gebruiksvoorwaarden.md]
1. Who is responsible?
BV Amber Aspeslagh, trading as Launch Café [VERIFY: the company number appears in the existing terms under the trade name "Madame Pixel". Is Launch Café a second trade name of the same company, or a separate business?]
Leernsesteenweg 329, 9800 Deinze, Belgium
Company number / VAT: BE1027880690
Privacy contact: info@launchcafe.be
Launch Café is responsible for the data stored on our server (see section 2). For what you share in your conversations with your AI assistant, the provider of that assistant (Anthropic) is responsible under its own policy. We do not see those conversations.
2. What data do we collect and why?
Launch Café is a shared place where your assistant remembers how to work for your business. We store only what is needed for that:
| Data | Example | Purpose |
|---|---|---|
| Company name and access | Your company name, an access key (token) or the linked e-mail address | To recognise you and show you your own data |
| E-mail address (when signing in with Google) | Your business Gmail or Google Workspace address | To link you to your company. We read only the e-mail address from your Google account, not your contacts, mail or files. |
| Company profile | What your business does, your customers, goals, tone of voice, brand style, tools you use | So your assistant works in your style. You provide this yourself during the introduction and confirm it before it is stored. |
| Your own working methods and earlier versions | How you want posts, campaign plans and texts to be made, with a short reason for each change | So your changes persist and you can go back to an earlier version |
| Lessons from your own results | "Reels reach more people than photos", with the source (e.g. Instagram) | So your working methods improve. Patterns only, no raw figures or names of people. |
| Tips and your answer | A tip from Launch Café and whether you accepted it | To follow up on tips |
| Usage data | Which working method was fetched or changed, and when | To see whether the service works and which tips are useful |
| Technical logs | Time, company name, type of request and function used | Troubleshooting and security. No content and no tokens. Our own log contains no IP address. |
What we do not do: we do not read or store your conversations with your assistant, we do not query your assistant's memory or chat history, we do not build profiles of individual people, we do not show advertising and we do not sell data. Connections to your own tools (Instagram, Meta Ads, Shopify, ...) run through your assistant and those connectors, not through our server.
Please do not put personal data of your customers or other third parties in your company profile or working methods. If something ended up there anyway, tell us and we will delete it.
3. Legal basis
- Performance of a contract (Art. 6(1)(b) GDPR): your company profile, working methods, access and sign-in data are needed to provide the service.
- Legitimate interest (Art. 6(1)(f) GDPR): security, troubleshooting, improving the service and sending tips. You can object to this (section 8). Tips can be based on your own data and on patterns across several customers.
- Consent (Art. 6(1)(a) GDPR): when you confirm in a conversation that something may be remembered. You can reverse this at any time.
Launch Café can see the changes and company profiles of all customers in order to maintain the service and give tips. This is visible only to the people Launch Café designates, through a secured admin environment. Other customers never see your data. Tips based on patterns across customers never mention another customer's name or content.
4. Who do we share data with?
We work with the processors below. With each we have a data processing agreement or accept their standard one. [VERIFY: confirm for each that the agreement is in place]
| Party | Role | Location |
|---|---|---|
| Fly.io | Hosting of the server and database | Amsterdam (EU) |
| Auth0 (Okta) | Sign-in | EU region |
| Sign in with Google | Worldwide, under Google's policy [VERIFY] | |
| GitHub | Storage of our code and tests; contains no customer data | [VERIFY] |
Your AI assistant (Anthropic for Claude) receives the content Launch Café returns, such as your working methods and company profile, because you use the connection. That provider's privacy policy applies to it. Otherwise we share data only where the law requires it.
5. Transfers outside the EU
The server and database are in Amsterdam. When signing in with Google and with Auth0, data (your e-mail address) may be processed outside the EU, under the European Commission's standard contractual clauses or the EU-US Data Privacy Framework. [VERIFY per processor]
6. How long do we keep data?
- While you are a customer: your company profile, working methods and earlier versions are kept so you can return to a previous version.
- After the relationship ends, or on your request: we delete your data within 30 days. This covers your company name, linked e-mail address, company profile, own working methods with all earlier versions, lessons, tips and your answers to them, and usage data. This is done on request with an admin function; there is no automatic deadline. Technical logs and backups are not covered, see below.
- Backups: the database is backed up daily and backups are overwritten after 5 days, so deleted data disappears from backups at most 5 days later.
- Technical logs: the logs are kept at Fly.io for about 7 days. They contain no content, no tokens and no IP address.
- Legal retention duties (e.g. invoices) continue to apply after deletion.
7. Security
- The connection is always encrypted (HTTPS).
- Access is by signing in with Google or a personal key. A key gives access only to your own data; do not share it. We are phasing out personal keys in favour of signing in with Google; we will tell you in advance. [VERIFY: update once the keys are actually switched off]
- The admin environment is protected by a separate password.
- Logs contain no keys and no content of your data.
- Changes are stored as a new version; nothing is changed without your confirmation.
If you notice anything suspicious, or think your key reached someone else, email info@launchcafe.be and we will replace it immediately. In case of a personal data breach we notify the Belgian Data Protection Authority within 72 hours, and you if the risk is high.
8. Your rights
You can always ask for:
- access to the data we hold about you;
- correction of inaccurate data;
- deletion of your data;
- restriction of, or objection to, processing based on legitimate interest;
- portability: you receive your data in a readable file;
- withdrawal of consent where consent is the legal basis.
Email info@launchcafe.be. We reply within one month. To verify your identity, we ask that you write from the e-mail address linked to your account.
Not satisfied? You can lodge a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, www.gegevensbeschermingsautoriteit.be.
9. Children
Launch Café is for entrepreneurs and businesses and is not intended for anyone under 16. We do not knowingly collect data from children.
10. Cookies
The connection and the Launch Café admin environment do not use cookies (the admin environment asks for a password through the browser). There are no advertising or tracking cookies. Cookies on the launchcafe.be website fall under that website's policy.
11. Changes
We may change this policy, for example when we add a processor or a feature. The date below shows the latest version. We will tell you about important changes.
Last updated: [date of publication]