Privacy Policy
The Intelligence Desk is a field tool for commercial real estate. It uses your camera and your location to pin information to the buildings in front of you, and it saves what you capture so you can come back to it. This page explains, plainly, what that means for your data.
Who we are
The Intelligence Desk is operated by Bureau St. James. We are the controller of the personal data described here. You can reach a human at jsmith@bureaustjames.com.
What we collect, and why
Your email address and name, and optionally your company. We use this to create and secure your account, to tell your captures apart from other people's, and to contact you about the service. Sign-in is handled by Clerk, our authentication provider; your password is held by Clerk and is never visible to us.
With your permission, we use your device's precise location to place augmented reality cards on the correct buildings and to centre the map. The app requests location only while it is in use. It does not track you in the background.
When you save a capture, the coordinates of that capture are stored with it — that is what makes a capture findable on the map later. Location used only for moving the map around is not recorded.
With your permission, the camera powers the augmented reality view and lets you photograph a storefront or site. The live camera feed is not recorded or transmitted. Photos you deliberately capture and save are uploaded and stored with the capture they belong to.
The app reads your device's accelerometer and gyroscope so augmented reality cards stay locked to a storefront as you move your phone. This data is used on the device in the moment and is not stored or transmitted.
Notes, place details, observations, saved opportunities, and any contact details you choose to record about people you meet in the field. This is the substance of the product — we store it so you have it.
If you enter another person's details, please only record what you have a legitimate business reason to hold. You are responsible for the personal data you enter about other people.
We record your IP address against certain expensive API requests in order to enforce rate limits and prevent abuse. Our hosting provider keeps standard server logs. We do not build advertising or behavioural profiles from any of this.
What we do not do
- We do not sell or rent your personal information, and we never have.
- We do not share it with data brokers or advertisers.
- We do not track you across other apps or websites, and the app contains no advertising identifier or ad SDK.
- We do not run third-party analytics, behavioural tracking, or crash-reporting SDKs in the app.
- We do not access your location when the app is not in use.
- We do not access your photo library, contacts, microphone, or health data.
Who can see what you capture
This is the part worth reading carefully, because the app is partly a shared tool.
Your own captures
If you are using the app on your own, your notes, photos, and capture locations are visible to you and to our administrators. They are not shown to other users.
If you belong to a team
If your account is part of an organisation, the notes you save — including their text, photos, and exact coordinates — are visible to the other members of that organisation. Treat a team capture as something your colleagues will read.
Public leaderboard
The app has a leaderboard showing the most active scouts. It displays your display name and your capture count, and it is visible to anyone, including people who are not signed in. It does not expose your notes, photos, or locations. If you would prefer not to appear, email us and we will remove you.
Share links
If you choose to share a capture, we generate a public link. That page deliberately shows only the place, the signal, an approximate locality, the date, and your handle. It does not include your note text, your exact coordinates, your photos, or your real name. Anyone with the link can view it.
One honest limitation about photos. Photos you save are currently held in storage that serves them over public URLs. The links are long and not listed anywhere, so they are not browsable or searchable — but anyone who obtains a photo's URL can open it without signing in. We are moving this storage behind authentication. Until we have, please do not photograph anything you would not be comfortable having outside your account, and we will update this page when that change ships.
Where your data lives, and who processes it
We use a small number of service providers to run the product. They process data on our instructions and are not permitted to use it for their own purposes.
- Clerk — accounts and sign-in.
- Supabase — our database and file storage, where your notes, photos, and capture coordinates are held.
- Vercel — hosting for the app and this website.
- Mapbox — map rendering. Receives map view information from your device in order to draw the map.
- Anthropic — where the app offers to identify a business from a photo you captured, that photo and its text are sent to Anthropic's Claude API to generate the result. Anthropic does not use it to train models.
- Google — where street-level imagery is shown, coordinates are sent to Google's Street View API through our servers, so your device and IP address are not exposed to Google.
- Amazon Web Services — storage for documents attached to saved opportunities, where that feature is enabled.
These providers are based in the United States, and your data is stored and processed there. If you are in the UK, EU, or EEA, that means your data is transferred outside your region; we rely on the European Commission's Standard Contractual Clauses, or an equivalent safeguard, for those transfers.
How long we keep it
- Captures, notes, and photos — until you delete them, or until you delete your account.
- Account information — for as long as your account is open.
- Rate-limiting and server logs — a short operational window, generally no more than 90 days.
Backups persist for a short period after deletion and are overwritten on their normal cycle.
Your choices
- Permissions. You can grant or revoke camera, location, and motion access at any time in your device settings, under Settings › The Intelligence Desk. The app's map and AR features need location and camera to work, but the rest of the app will continue to function.
- Deleting individual captures. You can delete any note, capture, or saved opportunity from within the app. Deleting a capture removes it and its photos.
- Deleting your account and all of your data. See below.
Deleting your account
You can ask us to delete your account and everything in it at any time. Email jsmith@bureaustjames.com from the address on your account with the subject Delete my account.
We will confirm receipt, and we will erase your account record, your notes, your captures, your photos, and your stored coordinates within 30 days. Deletion is permanent and we cannot recover the data afterwards. We may retain a minimal record that a deletion request was made and honoured, which we are required to keep to demonstrate compliance.
Content you had already shared into a team workspace may remain visible to that team, since it forms part of their shared record. Tell us in your email if you want us to remove that too and we will work with the account owner.
If you are in the UK, EU, or EEA
Under the UK GDPR and EU GDPR you have the right to access a copy of your data, to correct it, to have it erased, to restrict or object to how we use it, and to receive it in a portable format. You also have the right to complain to your local data protection authority.
Our legal bases are: performing our contract with you, for running your account and storing what you capture; your consent, for camera and location access, which you can withdraw at any time in your device settings; and our legitimate interests, for keeping the service secure and preventing abuse.
To exercise any of these rights, email jsmith@bureaustjames.com. We will respond within one month.
If you are in California
Under the CCPA and CPRA you have the right to know what personal information we collect and why, to request a copy of it, to ask us to delete it, to ask us to correct it, and not to be discriminated against for exercising any of those rights.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. The categories we collect are identifiers, geolocation data, audio-visual information in the form of photos you take, and the commercial and professional information you record. All of it is collected for the purposes described above. To make a request, email jsmith@bureaustjames.com.
Security
Data is encrypted in transit. Access to production systems is limited to people who need it to operate the service. No system is perfectly secure, and we do not claim otherwise — see the note above about photo storage for a limitation we are actively working on. If you believe you have found a vulnerability, please write to jsmith@bureaustjames.com and we will respond promptly.
Children
The Intelligence Desk is a professional tool, intended for people aged 16 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
Changes to this policy
If we change how we handle your data, we will update this page and change the date at the top. If a change is significant — a new category of data, or a new way of sharing it — we will tell account holders by email before it takes effect.
Contact
Bureau St. James
jsmith@bureaustjames.com