Privacy Policy
Overview & Scope
This Privacy Policy explains how Bubble Lab, Inc.(“Bubble Lab,” “we,” “us,” or “our”) collects, uses, shares, and protects information in connection with the Bubble Lab Communities platform, dashboards, automations, AI features, and related services (collectively, the “Services”), and our websites, including communities.bubblelab.ai(the “Site”).
Bubble Lab provides community-operations infrastructure to organizations that run private professional communities (each, a “Customer”). When we process information about a Customer's members, partners, sponsors, or contacts on the Customer's behalf, the Customer generally directs that processing and is responsible for its own privacy practices. In that role we act as a service provider or processor, and this Policy describes our own practices. If you are a member of a community that uses Bubble Lab, please also review that community's own privacy notice, and direct requests about your data to the community first (see Your Rights & Choices).
Information We Collect
We collect the following categories of information:
Information you provide
- Account & contact information — name, email, phone, company, role, password, and similar details when you create an account, request a demo, or contact us.
- Billing information — billing contact and transaction records. Payment card details are handled by our payment processors, not stored by us.
- Content you submit — community, member, partner, sponsor, vendor, and speaker records; profile fields; messages; files; survey responses; and other content you upload, import, or generate through the Services.
- Communications — messages, support requests, and feedback you send us.
Information processed on behalf of Customers
To operate a Customer's community, we process member and partner data the Customer provides or authorizes us to access, which may include names, contact details, professional background, company and role, interests, asks, expertise, fundraising status, engagement history, and connected messaging content (for example, from Slack, Discord, or WhatsApp workspaces the Customer connects).
Information from third-party sources
We may obtain and enrich information from third-party platforms and publicly available sources, including professional networks (such as LinkedIn and X), public web pages, data-enrichment providers, and integration partners, and combine it with other information we hold to build and improve profiles, matching, search, analytics, and the Services generally.
Information collected automatically
- Usage & device data — IP address, device and browser type, pages and features used, referring URLs, timestamps, and diagnostic logs.
- Cookies & similar technologies — used for authentication, preferences, analytics, and to operate and improve the Site and Services (see Cookies & Tracking).
How We Use Information
We use information for the following purposes:
- To provide, operate, maintain, secure, and support the Services and the Site.
- To power core features, including member onboarding, matchmaking and introductions, AI-powered search and chat, the member directory, analytics, reporting, and automations.
- To process transactions, manage accounts, and communicate with you about the Services.
- To personalize, analyze, measure, and improve the Services, and to develop new products, features, workflows, models, and offerings.
- To develop, train, fine-tune, evaluate, and improve our algorithms, models, machine-learning systems, matching logic, and analytics, including by using the information described above as training and reference data.
- To produce insights, benchmarks, and research, including across communities and Customers.
- For safety, fraud prevention, security, troubleshooting, and to enforce our agreements.
- For marketing and promotional communications (subject to your choices and applicable law), and to measure the effectiveness of our communications.
- To comply with legal obligations and to establish, exercise, or defend legal claims.
Aggregated & De-Identified Information
We may aggregate, anonymize, or de-identify information so that it no longer reasonably identifies any individual or, where applicable, any single Customer (“Aggregated & De-Identified Information”). Aggregated & De-Identified Information is not personal information.
We may use, retain, reproduce, modify, combine, commercialize, license, sell, transfer, and otherwise disclose Aggregated & De-Identified Information for any lawful purpose, in our sole discretion and without restriction or obligation to you. This includes, without limitation:
- developing, training, and improving our products, models, and analytics;
- creating and offering insights, benchmarks, trend reports, indices, and other data products and analytics — including to, or jointly with, third parties; and
- marketing, research, and other commercial purposes.
As between you and Bubble Lab, we own all Aggregated & De-Identified Information and all derivative works, insights, and intellectual property created from it. Where required by law, we will maintain and use such information only in de-identified or aggregated form, will not attempt to re-identify it except as permitted by law, and will require recipients to comply with applicable de-identification obligations.
Data Retention
We retain information for as long as needed to provide the Services, operate our business, and comply with our legal obligations, resolve disputes, and enforce our agreements. We retain information we process on behalf of a Customer in accordance with our agreement with that Customer; following termination, we may retain such information for a limited period to allow export, after which we may delete it subject to legal, security, operational, and routine backup-retention requirements. Aggregated & De-Identified Information may be retained and used indefinitely.
Security
We use commercially reasonable technical and organizational measures designed to protect information from unauthorized access, disclosure, alteration, and loss. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.
International Data Transfers
We are based in the United States and process information in the United States and other countries. Data-protection laws in these countries may differ from those in your jurisdiction. Where we transfer information internationally, we do so in accordance with applicable law and use appropriate safeguards where required. By using the Services, you understand that your information may be transferred to and processed in the United States.
Your Rights & Choices
Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, to object to certain processing, and to opt out of certain sharing. To exercise these rights, contact us at hello@bubblelab.ai.
If you are a community member: the community you belong to (our Customer) generally controls the data we process about you. Please direct your requests to that community; we will assist them as a service provider and, where appropriate, forward your request.
California (CCPA/CPRA)
California residents have rights to know, access, correct, and delete personal information, to opt out of the “sale” or “sharing” of personal information, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights.
We may disclose certain categories of personal information to third parties and may engage in activity that is treated as a “sale” or “sharing” of personal information under California law. To opt out of the sale or sharing of your personal information, or to exercise any of your rights, email us at hello@bubblelab.aiwith the subject line “Privacy Request,” or use any opt-out preference signal your browser supports. We do not knowingly sell or share the personal information of individuals we know to be under 16. Aggregated & De-Identified Information is not personal information and is not subject to these requests.
EEA, UK & Switzerland
Where the GDPR or UK GDPR applies and Bubble Lab acts as a controller, we rely on legal bases including performance of a contract, our legitimate interests (such as operating, securing, and improving the Services and our business), consent where required, and compliance with legal obligations. You may have rights to access, rectify, erase, restrict, port, and object to processing, and to lodge a complaint with your supervisory authority. Where we process personal data on a Customer's behalf, that Customer is the controller and you should contact them.
Children's Privacy
The Services are intended for businesses and adults. They are not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.
Changes to This Policy
We may update this Policy from time to time. When we do, we will revise the “Effective” date above and, for material changes, provide additional notice as required by law. Your continued use of the Services after an update takes effect constitutes acceptance of the revised Policy.
Contact Us
Questions about this Policy or our privacy practices? Contact us at:
Bubble Lab, Inc.
1201 Tennessee Street, San Francisco, CA 94107
hello@bubblelab.ai