Privacy policy

1. Data we collect

We process the following data:

• Newsletter: your email address and the reading profile you choose (Finance, Tech or Balanced) when you sign up on the Newsletter page.
• Appointments: when you book a diagnostic, a lesson or a session, Calendly's booking module collects your name, your email address, the time slot you pick and any information you add to the form.
• Lessons and services: if you become a client, your contact details, the information needed for the service, and your billing and payment details.
• Messages: your contact details and the content of the emails you send us.
• Research on Substack: you subscribe to our research on Substack (free or paid plan); Substack handles payment and gives us access to your email address and your subscription type.
• Browsing: on every visit, your browser sends technical data (IP address, browser type, requested page) to our host and to the third-party services built into the site (section 6). Analytics and advertising cookies are only set with your consent.

2. Legal basis (Article 6 of the GDPR)

Each processing activity relies on one of the following grounds:

• Your consent: the newsletter, audience measurement and advertising measurement. You can withdraw it at any time.
• A contract, or steps taken at your request before entering into one: appointments, lessons and services.
• Our legitimate interest: answering your messages, following up with professionals who contact us, and running and securing the site.
• Our legal obligations: invoicing, accounting, and keeping proof of your cookie choices.

3. How we use your data

We use your data to:

• Send you the newsletter once you sign up
• Organise the appointments you book, deliver the lessons and services you order, and invoice them
• Answer your messages and consulting requests
• Measure site traffic and the performance of our ads, if you agree
• Run the site and keep it secure
• Comply with our legal obligations

3.1 Recipients

Your data is processed by our team and by service providers acting on our behalf:

• DigitalOcean: website hosting
• Notion: newsletter subscriber list
• Resend: newsletter delivery
• Calendly: appointment booking
• Our email, calendar, video call, invoicing, payment and accounting providers

The following services also receive data and process it under their own privacy policies:

• Google Ireland Limited: Google Analytics and Google Ads (section 6.2)
• Meta Platforms Ireland Limited: Meta Pixel and Conversions API (section 6.3)
• Substack: subscriptions to our research
• jsDelivr, Substack and Runware: an animation library and images shown on some pages (section 6.4)

4. Retention periods

We keep data for the following periods:

• Newsletter contacts: up to 3 years or until you unsubscribe
• B2B prospects: 3 years after the last contact
• Contracts, quotes and invoices of our professional clients: for the length of the contract, then 5 years (limitation period); 10 years when they support an accounting entry
• Invoices and accounting records, time sheets included: the period required by law (10 years)
• Contact details of our counterparts, appointments and day-to-day exchanges: for the duration of the relationship, then 3 years after the last contact
• Data of your own clients or teams that we process on your behalf during an engagement: not covered by these periods; we return or delete it within 30 days after the end of the engagement, except what the law requires us to keep
• Cookie choices: 6 months (182 days) for the cookie that stores them; after that, the copy kept in your browser's local storage no longer counts and we delete it on your next visit
• Google Analytics: 2 months for event data, 14 months for data associated with a user, reset on each new visit (our account's setting)
• Google and Meta cookies: up to 13 months for the Google Analytics and Google Ads cookies, 3 months for Meta's
• Host's technical data: connection logs kept by the host for security, 12 months at most

5. Your rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Access: receive a copy of the personal data we hold about you
• Rectification: correct data that is inaccurate or incomplete
• Erasure: request deletion of your personal data
• Portability: obtain your data in a structured, machine-readable format
• Objection: object to specific processing activities
• Restriction: ask us to limit processing in certain circumstances
• Withdrawal of consent: withdraw your consent at any time, by writing to us for the newsletter, and with the “Manage cookies” link for cookies (section 6.5)
• Instructions after death: set instructions for what happens to your data after your death

To exercise any right, contact us at: [email protected]

6. Cookies and trackers

Cookies and your browser's local storage let a website save information in your browser. Here are the ones we use, and what the third-party services built into the site receive.

6.1 Necessary cookies (no consent required)

• bubble_cookie_consent: stores your cookie choices, in a cookie valid for 6 months and in your browser's local storage
• bubbleLanguage: on blog articles, remembers the display language, in your browser's local storage

6.2 Google Analytics and Google Ads

Google's tag loads only after you agree: analytics cookies for Google Analytics, marketing cookies for Google Ads (“Accept all” accepts both). These services are provided by Google Ireland Limited.

• If you accept analytics cookies: Google Analytics measures site traffic, including page views, scrolling, newsletter sign-ups, clicks on booking buttons and confirmed appointments. It sets its own cookies to do so.
• If you accept marketing cookies: Google Ads may set its advertising cookies, record a conversion when you confirm an appointment, and use this data to personalise ads.
• Until you accept: no Google script loads and nothing is sent to Google.

6.3 Meta Pixel and Conversions API

If you accept marketing cookies, the Meta Pixel and Meta's Conversions API measure the performance of our ads on Facebook and Instagram. Your browser sends Meta Platforms Ireland Limited the pages you view, clicks on booking buttons, confirmed appointments and newsletter sign-ups, and the Pixel sets its cookies (_fbp and, if you arrive from a Facebook or Instagram link, _fbc). Our server also sends Meta page views, clicks on booking buttons and confirmed appointments, with the page address, your IP address, information about your browser and the identifiers in those cookies. If an email address or a name comes with the event, our server hashes it (SHA-256) before sending it.

Without your consent, the Meta Pixel script does not load and nothing is sent to Meta, either by your browser or by our server, even when you click a booking button. It loads when you click “Accept all” or accept marketing cookies.

6.4 Third-party services built into the site

• Calendly: when you click a booking button, the booking module loads from Calendly's servers; on blog articles, its script loads as soon as the page opens. Calendly receives your IP address and, if you book, the information you enter. It may use its own cookies, under its own privacy policy.
• jsDelivr: on the home page and the Professionals page, the three.js 3D animation library downloads from cdn.jsdelivr.net, which receives your IP address.
• Substack and Runware: blog article images are served from their servers, which receive your IP address.

Our fonts are hosted on our own server.

6.5 Managing your choices

On your first visit, a banner lets you accept all cookies, accept only essential ones, or customise your choices. If you decline, the site works normally.

You can change your choices at any time with the “Manage cookies” link at the bottom of every page, which reopens the banner, or right here: Manage cookies. Withdrawing your consent does not affect processing that already took place. You can delete cookies already set in your browser settings.

7. Data security

We implement technical and organisational measures to protect your data:

• HTTPS encryption: all communications are encrypted
• Restricted access: only authorised members of the Bubble team have access to the data
• Secure storage: data hosted on secure servers (Notion)
• Secure passwords: protected by strong authentication

8. Transfers outside the European Union

Several of our providers are based in the United States (DigitalOcean, Notion, Resend, Calendly, Substack) or belong to US groups (Google, Meta), so your data may be transferred to or accessed from outside the European Union. These providers state that they rely on the EU-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses.

The services listed in section 6.4 may also process your IP address outside the European Union.

9. Changes to this policy

We may update this privacy policy. If the changes are significant, we will let you know by email (if you have subscribed) or with a banner on the site.

10. Contact and complaints

Data controller:
Bubble Invest SAS
60 rue François Ier, 75008 Paris, France
RCS Paris 991 745 951
Email: [email protected]

Supervisory authority:
If you believe your rights are not respected, you can lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés):
www.cnil.fr

11. Minors' data

Our service is not intended for people under 18. We do not knowingly collect personal data from minors. If you are a parent and find that your child has given us personal information, please contact us.

12. Deleting your data

You can request the deletion of all your personal data at any time:

• By email: send your request to [email protected] with the subject “GDPR Data Deletion Request”.
• Information to provide: your name, your email (the one used to interact with our services), and the type of data you want deleted.
• Processing time: we will process your request within one month.
• Confirmation: you will receive an email confirmation once deletion is complete.

This section also satisfies the Meta platform (Facebook/Instagram) requirements for marketing API access: https://bubbleinvest.org/privacy#data-deletion

13. Client reviews

• Why: to publish our clients' verified reviews on this website, with their consent.
• What data: the answers to the review form, the display details the client chooses (first name, initial of the last name, job, city, LinkedIn profile) and, for each review link we send, an internal reference of the client who receives it, never published.
• Who receives it: the Bubble Invest team, through Notion (storage of reviews and of the links sent) and Resend (email to the team for each new review), two providers based in the United States (section 8).
• How long: a published review stays online until its author asks for its removal, and 3 years at most; a refused review, or one without consent to publication, is deleted after 3 months; the list of links sent is kept 3 years, as proof of the verification.
• Your rights: removal, access or correction on request to [email protected]. How we verify our reviews.

14. Withdrawal and cancellation requests

• Why: to receive your request to withdraw from or cancel a contract, acknowledge it and handle it. Legal basis: legal obligation (Article 6(1)(c) GDPR), as consumer law requires us to let you withdraw from or cancel a contract.
• What data: your name, your email address, the contract concerned, the date of your request and the reference you give.
• Who receives it: the Bubble Invest team, through Notion (storage of requests) and Resend (sending the acknowledgement and the alert to the team), two providers based in the United States (section 8).
• How long: 5 years.
• Your rights: access, correction or erasure on request to [email protected], within the limits of this retention obligation.