Privacy Policy

1. Data We Collect

We collect the following information when you use this site:

• Contact details – your name and email address (newsletter form or B2B inquiries)
• Professional information – company, role, automation needs (for B2B prospects only)
• Messages – any comments or questions you share with us (optional)
• Session cookies – used for the educational chatbot and to cap requests (10 messages per session)
• Usage insights – aggregated page views and queries via Google Search Console (anonymized)

2. Legal Basis (GDPR Article 6)

Your personal data is processed on the following grounds:

• Explicit consent when you submit the waitlist form
• Legitimate interest to secure the product experience (session cookies and abuse prevention)

3. How We Use Your Data

Your information helps us to:

• Send you free educational content (tutorials, demos, build-in-public) if you opt in
• Respond to your B2B consulting inquiries (for professionals only)
• Understand how the site is used so we can improve our content
• Comply with legal and regulatory obligations

3.1 Service Providers

Trusted third parties help us run the service:

• Notion – secure storage for contacts and B2B inquiries (servers located in the EU/US with GDPR safeguards)
• Google Search Console – anonymised traffic analytics (no personal data stored)

4. Retention Periods

We keep data only as long as necessary:

• Newsletter contacts – up to 3 years or until you unsubscribe
• B2B prospects – duration of business relationship + 3 years
• Session cookies – cleared automatically when you close your browser
• Anonymised usage logs – 26 months (GDPR default)

5. Your GDPR Rights

You can exercise the following rights at any time:

• Access – receive a copy of the personal data we hold about you
• Rectification – correct data that is inaccurate or incomplete
• Erasure – request deletion of your personal data
• Portability – obtain your data in a structured, machine-readable format
• Objection – object to specific processing activities
• Restriction – ask us to limit processing in certain circumstances

To exercise any right, contact us at: [email protected]

6. Cookies

We currently deploy the following cookie categories:

6.1 Essential cookies (no consent required)

• Chat session – caps conversations to 10 messages per session for safety
• Language preference – stores your FR/EN choice so you see the right version

6.2 Analytics cookies (consent required)

We do not run analytics cookies today (Google Analytics is disabled to keep the stack cost-free).

If we activate analytics later, we will request your explicit consent through the cookie banner.

6.3 Managing your preferences

You can update your cookie choices at any time via:

• The consent banner displayed on first visit
• The "Cookies" badge in the bottom-right corner
• Your browser settings (manual deletion of stored cookies)

7. Data Security

We apply technical and organisational measures to safeguard your data:

• HTTPS encryption – all traffic between you and Bubble is encrypted
• Restricted access – only authorised Bubble team members can view personal data
• Secure hosting – data stored on GDPR-compliant infrastructure (Notion)
• Strong authentication – enforced password policies and multi-factor access

8. International Transfers

Your data may transit outside the EU when processed by Notion (United States). These transfers rely on EU Standard Contractual Clauses and supplementary safeguards aligned with GDPR requirements.

9. Policy Updates

We may update this policy to reflect product or regulatory changes. If updates are material, we will notify you by email (if subscribed) or via an on-site banner.

10. Contact & Complaints

Data controller:
Bubble Invest
Email: [email protected]

Supervisory authority:
If you believe your rights are not respected, you can lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés):
www.cnil.fr

11. Children's Data

Bubble is designed for adults. We do not knowingly collect personal data from individuals under 18. If you are a parent or guardian and believe your child has shared personal data with us, please contact us so we can delete it.

12. Data Deletion

You can request the deletion of all your personal data at any time:

• By email: send your request to [email protected] with the subject "GDPR Data Deletion Request".
• Information to provide: your name, your email (the one used to interact with our services), and the type of data you want deleted.
• Processing time: we will process your request within a maximum of 30 days, in accordance with Article 17 of the GDPR.
• Confirmation: you will receive an email confirmation once deletion is complete.

This section also satisfies the Meta platform (Facebook/Instagram) requirements for marketing API access: https://bubbleinvest.org/privacy#data-deletion

13. Advertising Measurement Tools (Meta, Google Ads)

As part of our online advertising campaigns, we use performance measurement tools that are only activated after your explicit consent via the cookie banner ("Marketing" category):

• Meta Pixel + Conversions API (CAPI): measures the effectiveness of our Facebook and Instagram ads. Data collected (page view, CTA click, appointment booking) is sent to Meta Platforms Ireland Ltd. Any personal data transmitted (email, phone) is hashed using SHA-256 server-side before sending. Meta retention: maximum 13 months. Purpose: advertising measurement and personalization. Recipient: Meta Platforms Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland.
• Google Ads Conversion Tracking + Enhanced Conversions: measures the effectiveness of our Google ads. Any personal data transmitted is also hashed before sending. Retention: 13 months. Purpose: advertising measurement and optimization. Recipient: Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland.

You can withdraw your consent at any time via the "Manage Cookies" link at the bottom of any page.