Privacy Policy

1.1 Account & Authentication Data

• Email address
• Password (stored as a secure hash), or Google or Apple OAuth token
• Full name
• Account role (admin/user)
• Authentication tokens and session data
• Your phone number, if you add it in Settings, used to send text messages from your account and to fill in your contact details in drafted messages

Used to create, secure, and maintain your account.

1.2 Profile & Onboarding Data (optional, user-provided)

• Display name, nickname, pronouns, birthday, profile picture, headline, and bio
• Location, timezone, and availability
• Work information: company, job title, industry, years of experience, work summary
• Education information: degree, graduation year, university, student year, majors/minors, relevant classes, campus involvement, alumni groups, certifications, self-directed learning, internship status, highest education completed
• Skills, languages, and social links (e.g., LinkedIn)
• Networking preferences: cadence, meeting preference, comfort level (introvert/ambivert/extrovert), commitment horizon, follow-through, 12-month network vision, and networking goals
• What you offer, what you're seeking, and target companies
• Preferred tone, preferred communication channels, core values, interests, and personal notes
• Uploaded documents (e.g., résumé, portfolio, bio) and voice samples, if provided

Used to personalize your experience, improve recommendations, and support relationship-building features.

1.3 Contacts You Add (Person Records)

• Name, email, phone, birthday
• Company, role, skills, social links, website
• Notes, tags, attachments, profile picture
• Location (converted to latitude/longitude for map view)
• Relationship type, mutual benefit, check-in cadence, preferred contact method, snooze/dismiss dates

Used to help you organize, manage, and maintain your relationships.

1.4 Interactions You Log

• Interaction type, date, title, description, tags
• Attachments, photos, and voice notes
• For recorded meetings: full audio recording, transcript, AI-generated title, summary, key notes, action items, follow-up drafts, and next-interaction suggestions

Used to help you track conversations, meetings, and relationship history.

1.5 Calendar & Event Data

• Event/meeting name, date, start and end time
• Attendees, location (converted to latitude/longitude), notes, reminders, recurrence rules, and links

1.6 Tasks

Title, details, type, priority, due date/time, tags, and any linked person or interaction

1.7 Community Events (User-submitted)

Event name, header image, date, time, industry, description, location (converted to latitude/longitude), and submitter name

Used to display community events within the app.

1.8 Billing & Subscription Data

Email, Stripe customer ID, subscription ID, subscription status, plan type, and renewal date

BubbleLink does not store your credit card number or bank details. All payment information is handled directly by Stripe.

1.9 Automatically Collected Data

• IP address and standard request logs
• Created/updated timestamps
• Basic analytics events (via the Base44 SDK, where enabled)
• If you enable notifications, a push notification token for your device, used only to send you reminders and account notifications. You can turn notifications off at any time in your device settings.
• Usage counts for AI features (used to apply fair-use limits) and records of important account actions, such as data exports and account deletion, kept for security and troubleshooting.

Used to maintain security, improve performance, and understand app usage.

10.1 California consumers (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the right to:

• Know what personal information we collect about you and whether we sell or share it
• Access and obtain a copy of your personal information
• Correct inaccurate personal information we maintain about you
• Delete your personal information, subject to legal exceptions
• Opt out of the sale or sharing of your personal information for cross-context behavioral advertising
• Limit the use of sensitive personal information
• Not be discriminated against for exercising these rights

We do not sell or share your personal information for cross-context behavioral advertising, and we have not done so in the past 12 months. Because we do not sell or share your data, a “Do Not Sell or Share My Personal Information” link is not required; you may still opt out of analytics as described in our Cookie Policy.

You may designate an authorized agent to submit requests on your behalf by providing them written permission and having them contact us at the email below. We may request information to verify your identity before processing a request.

10.2 Other U.S. state rights

If your state grants additional privacy rights (for example, opt-out of targeted advertising or profiling), you may exercise them through the same request process. We do not process your personal information for targeted advertising or sell it to third parties.

10.3 European Union, UK, and EEA residents (GDPR / UK GDPR)

If you are in the European Union, the European Economic Area, or the United Kingdom, you have the following rights under the GDPR and UK GDPR, subject to applicable conditions:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure — ask us to delete your data (the “right to be forgotten”), subject to legal exceptions
• Restriction — ask us to limit how we process your data
• Data portability — receive your data in a structured, machine-readable format and transmit it to another service
• Object — object to processing based on legitimate interests or for direct marketing
• Withdraw consent — where we rely on your consent, you can withdraw it at any time without affecting processing done before the withdrawal
• Lodge a complaint — with your local supervisory authority (for example, the UK Information Commissioner’s Office or your national data protection authority)

Lawful basis. We process your data under the following lawful bases: (a) contract — to provide the Service you signed up for; (b) consent — for optional features like integrations, analytics, and marketing emails (you can withdraw consent anytime); (c) legitimate interests — to maintain security, prevent fraud, and improve the Service, balanced against your rights and expectations; and (d) legal obligation — to meet record-keeping and tax requirements.

International transfers. Your data may be processed outside the EU/UK (for example, in the United States, where BubbleLink and its hosting and AI providers are based). We rely on recognized safeguards such as the European Commission’s adequacy decisions and Standard Contractual Clauses, and supplementary measures where required, to ensure your data is protected to a standard equivalent to EU/UK law.

Automated decisions. Connection strength scores and AI-generated summaries are automated outputs, not automated decisions with legal or similarly significant effects on you. You can contest an output by editing the underlying data in the app or contacting us.

To exercise any of these rights, use our Privacy / data request page or email us at the address below. We will respond within one month, extendable by two further months where necessary for complex requests.