Privacy and cookie policy

Last revised: April 21, 2025 Effective date: May 21, 2025

Bubble Group, Inc. ("Bubble" or "we") is committed to safeguarding your privacy. This Privacy and Cookie Policy ("PrivacyPolicy") describes our practices regarding information collected through our Site, the Bubble Sites, Bubble Marketplace, the Platform, and other services we provide (collectively, the "Bubble Service").
By using the Bubble Service, you consent to this Privacy Policy and our Terms.

1. DEFINITIONS

"Direct User" means an individual with an Account who can build Bubble Sites.

"End User" means an individual who visits a Bubble Site or https://bubble.io without registering.

This Privacy Policy applies to both Direct Users and End Users except where specified.

Capitalized terms used but not otherwise defined herein shall have the meanings given to them in our Terms.

2. IMPORTANT INFORMATION

Data Controller: Bubble Group, Inc., 22 West 21st Street, Floor 2, New York, NY 10010

Key Sections: Pay special attention to International Data Transfers and Your Privacy Rights.

Policy Updates: We may modify this Privacy Policy at any time. Material changes will be communicated via email or website notice before taking effect.

3. LEGAL BASES FOR PROCESSING

We use your personal information only as permitted by law, including under these legal bases:

• Legal compliance: We may need to collect, use, and otherwise process your personal data to comply with our legal obligations, such as regulatory monitoring and reporting obligations.
  
• Legitimate interests: We may process your personal data where we have a legitimate interest in doing so, provided that our interests are not outweighed by any potential impact of the processing on you, or your fundamental rights and freedoms.
  
• Contract: We may need to process your personal data to perform a contract with you or to take steps that you have requested prior to entering into the contract.
  
• Necessity: We may need to process your personal data to protect your vital interests, or those of another person.
  
• Consent: In some cases, we may rely on your consent to process your personal data. Where we rely on your consent, you have the right to withdraw it at any time in the manner indicated when we requested the consent or by contacting us as described in this Privacy Policy.
  

4. ARTICLE 27 REPRESENTATIVE

We have appointed the following representatives in Europe as required by the GDPR – you can also contact them directly should you wish:

Our EU Representative:
Under Article 27 of the EU GDPR, we have appointed Instant EU GDPR Representative Ltd. You can contact them:
Instant EU GDPR Representative Ltd.
Adam Brogden 
[email protected]
Tel +35315549700
Office 2, 12A Lower Main Street, Lucan Co. Dublin
K78 X5P8
Ireland

Our UK Representative:
Under Article 27 of the UK GDPR, we have appointed GDPR Local Ltd.. You can contact them: 
GDPR Local Ltd.
Adam Brogden 
[email protected]
Tel +44 1772 217800
1st Floor Front Suite
27-29 North Street, Brighton
England

5. NOTICE ON EU-US DATA PRIVACY FRAMEWORK; UK EXTENSION AND SWISS-US DATA PRIVACY FRAMEWORK

Bubble complies with (i) the EU-U.S. Data Privacy Framework (EU-U.S. DPF), (ii) the UK Extension to the EU-U.S. DPF, and (iii) the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) (collectively, the “Data Privacy Framework”) as set forth by the U.S. Department of Commerce. Bubble has certified to the U.S. Department of Commerce that Bubble adheres to (i) the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the EU in reliance on the EU-U.S. DPF, and (ii) from the UK (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF, and (iii) the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF (collectively, the “DPF Principles”). If there is any conflict between the terms in this Policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles shall govern. To learn more about the Data Privacy Framework (DPF), and to view our certification, please visit https://www.dataprivacyframework.gov/. 

As described in the DPF Principles, Bubble is accountable for personal data that it receives and subsequently transfers to third parties. If third parties to whom Bubble has disclosed personal data process it in a manner that does not comply with the DPF Principles, Bubble will be accountable, unless Bubble proves that Bubble is not responsible for the event giving rise to the damage. The types of third parties with which Bubble may share your personal data and for which purposes are set out in the section of this Policy entitled “HOW BUBBLE MAY SHARE YOUR INFORMATION.” The categories of personal data Bubble may receive, as well as the purposes for which Bubble collects and uses the personal data, are set out in other sections of this Policy, including in those entitled “HOW WE COLLECT YOUR INFORMATION” and “HOW BUBBLE USES YOUR INFORMATION.”

With respect to personal data received or transferred pursuant to the Data Privacy Framework, the U.S. Federal Trade Commission has jurisdiction over Bubble’s compliance with the Data Privacy Framework. In certain situations, Bubble may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Depending upon the context in which Bubble processes personal data received in reliance upon the Data Privacy Framework, relevant individuals may have rights to access personal data about them, and choices to limit the use and disclosure of their personal data. Please submit a written request to exercise your rights or choices to the contact information provided in this Privacy Policy (see Section 21). We may request specific information from you to confirm your identity. 

In compliance with the Data Privacy Framework, Bubble commits to resolve DPF Principles-related complaints about our collection or use of your personal data. EEA, UK and Swiss users with inquiries or complaints regarding our handling of personal data received in reliance on the Data Privacy Framework should first contact us by email at [email protected], or please write to the following address:

Bubble Group, Inc. 
22 W 21st Street
2nd Floor
New York, NY 10010
ATTN: Privacy

In compliance with the Data Privacy Framework, Bubble commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Gibraltar Regulatory Authority (GRA) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the Data Privacy Framework.

Additionally, under certain conditions, you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted. For more information on this option, please see the Data Privacy Framework website: https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction

We may amend this Notice on the Data Privacy Framework from time to time consistent with Data Privacy Framework requirements.

6. HOW WE COLLECT YOUR INFORMATION

Information You Provide

Direct Users. As described below, we collect personal data from Direct Users when they register, post content on the Bubble Service (including forum participation), communicate with us (e.g. through the Contact page on our site, via chat, or when requesting technical support), make purchases, and provide feedback. We may also collect personal data at other points in the Bubble Service when clearly identified.

• Registration: Direct Users provide email and password to create accounts, with optional information (profile photos, location, job title) and payment details for paid accounts. Direct Users can update information via their account settings.
  
• Forum Use: Direct Users provide email, password, and username to post on our Forum, with optional information like profile photos. Updates can be made via "Account Preferences."
  

End Users. We do not collect personal data directly from End Users unless they contact us. Each individual operator of a Bubble Site determines what End User information they collect and is responsible for compliance with applicable laws. However, the Information Collected via Technology section below applies equally to End Users and Direct Users.

Bubble Marketplace. We don't collect personal data through the Marketplace, but Direct Users must submit payment information to our third-party processor to license components. Some account information may be shared between transaction participants.

Information Collected via Technology

• Server Information: To make the Bubble Service more useful to you, our servers (which may be hosted by a third party service provider) collect information from you, which may include your browser type, operating system, Internet Protocol (“IP”) address (a number that is automatically assigned to your computer when you use the Internet, which may vary from session to session), domain name, and/or a date/time stamp for your visit. 
  
• Log Files: Like most websites, we automatically collect IP addresses, browser type, Internet Service Provider, referring/exit pages, operating system, timestamps, and clickstream data. We use this information to analyze trends, administer the Bubble Service, track users’ movements around the Bubble Service, gather demographic information about our user base as a whole, and better tailor the Bubble Service to our users’ needs. Except as noted in this Privacy Policy, we don't link this automatically-collected data to personal data.
  
• Do Not Track Signals: We don't currently respond to "do not track" signals other mechanisms that might enable you to opt out of tracking on our site. To find out more about “do not track,” visit http://www.allaboutdnt.com.
  
• Mobile Services: We may collect non-personal data from mobile devices, including location and device information, to deliver relevant content and improve performance. If the Bubble Service crashes on your mobile device, we may receive information about your mobile device model software version and device carrier, which allows us to identify and fix bugs and otherwise improve the performance of the Bubble Service. This information is sent to us as aggregated information and cannot be used to identify an individual. 
  
• Analytics Services: In addition to the tracking technologies we place, other companies may set their own Cookies or similar tools when you use the Bubble Service. This includes third party analytics services, like Google Analytics (“Analytics Services”), that we engage to help analyze how users use the Bubble Service, as well as third parties that deliver content or offers. We may receive reports based on these parties’ use of these tools on an individual or aggregate basis. We use the information we get from Analytics Services only to improve the Bubble Service. The information generated by the Cookies or other technologies about your use of the service (the “Analytics Information”) is transmitted to the Analytics Services. The Analytics Services use Analytics Information to compile reports on user activity. The Analytics Services may also transfer information to third parties where required to do so by law, or where such third parties process Analytics Information on their behalf. Each Analytics Services’ ability to use and share Analytics Information is restricted by such Analytics Services’ Terms of Use and privacy policy. By using the Bubble Service, you consent to the processing of data about you by Analytics Services in the manner and for the purposes set out above. See our subprocessor list for a full list of Analytics Services. We may also partner with ad companies to support our marketing efforts, including by serving you ads better tailored to your likely interests. If you don’t want to take advantage of these services, you can opt-out by visiting http://www.aboutads.info/ or http://networkadvertising.org/choices/, or, if you are located in the EU, http://www.youronlinechoices.eu/.  
  
• Social Media Login: Direct Users may use certain social media site (“SNS”) credentials to log into the Bubble Service, in such case, we collect personal data from the social media website. For example, when you log in with your Google credentials, we may collect the personal data you have made publicly available in Google, such as your email address, name, and profile picture/logo. You are solely responsible for your use of the SNS and it is your responsibility to review the terms and privacy policy of such SNS. Any information that we collect from an SNS account will depend on the privacy settings you have with that SNS, so please consult the SNS’ privacy and data practices. We will not be responsible or liable for: (a) the availability or accuracy of such SNS; (b) the content, products or services on or availability of such SNS; or (c) your use of any such SNS. You can revoke our access to this information anytime by amending the appropriate settings from within your account settings on the applicable SNS.
  

7. COOKIES

Like many online services, we use Cookies to collect information. “Cookies” are small pieces of information that a website sends to your computer’s hard drive while you are viewing the website. We may use both session Cookies (which expire once you close your web browser) and persistent Cookies (which stay on your computer until you delete them).

We use first-party Cookies, served directly by us to your computer or mobile device, which are used only by us to recognize your device when it revisits the Bubble Service; and third-party Cookies, which are served by service providers on the Bubble Service, and are used for recognition across websites.

We use the following types of Cookies:

• Essential Cookies: these Cookies are required for basic functionality, such as to allow you to log in to secure areas of the Bubble Service. Without these Cookies, the services cannot be provided.
  
• Functionality Cookies: these Cookies allow our Services to remember preferences and settings, such as language and login details. These provide you with a more personalized experience.
  
• Analytics and Performance Cookies: these Cookies are used to collect information about traffic to the Bubble Service, and do not identify any individual visitor. The information is aggregated and anonymous. It includes the number of visitors to our Services, the websites that referred them to our Services, the pages they visited on our Services, what time of day they visited our Services, whether they have visited our Services before, and other similar information. We use this information to help operate our Services more efficiently, to gather broad demographic information and to monitor the level of activity on our Services. We use Analytics Services for this purpose, including Google Analytics, which you can find about here. You can find out more about how Google protects your data here. You can prevent the use of Google Analytics relating to your use of our Services by downloading and installing the browser plugin available via this link.
  
• Social Media Cookies: these Cookies are used when you share information using a social media sharing button or “like” button on the Bubble Service or you link your account or engage with our content on or through a social networking website such as Facebook, X, LinkedIn, or Google+. The social network will record that you have done this.
  
• Chat Cookies: we use chat technologies, such as through Intercom, that employ cookies and software code to operate the chat features you can use to communicate with us through the Service. We and our third-party vendors may access and use information about webpages visited on our website, your general geographic information (e.g., city, state), your email, subscriptions, applications, invoices, purchased templates and other personal information you share through online chats for the purposes described in this Privacy Policy.
  

Pixels. We may also use pixel tags (which are also known as web beacons and clear GIFs) on the Bubble Service to track the actions of users on our Services. Unlike Cookies, which are stored on the hard drive of your computer or mobile device by a website, pixel tags are embedded invisibly on webpages. Pixel tags measure the success of our marketing campaigns and compile statistics about usage of the Bubble Service, so that we can manage our content more effectively. With the exception of the Facebook Pixel (see below), the information we collect using pixel tags is not linked to our users’ personal data. 

Bubble may use the Facebook Pixel to gather information about your activities on the Bubble Service in order to provide you with tailored Bubble ads. For example, if you sign up for Bubble, you may see a Bubble ad on your Facebook newsfeed. Facebook’s use of information collected is set forth in its privacy policy. You may opt out of Facebook’s interest-based ads here.

Disabling Cookies: You can typically remove or reject Cookies via your browser settings, though some features may not work without Cookies. Many browsers are set to accept Cookies until you change your settings. Further information about Cookies, including how to see what Cookies have been set on your device and how to manage and delete them, visit www.allaboutcookies.org and www.youronlinechoices.com.uk. Direct Users must accept Cookies in order to access certain features of the Bubble Service. You can erase or block Cookies from your computer if you wish to do so (your internet browser help screen or manual will thoroughly explain this process), but certain parts of the Bubble Service will not work correctly or at all if your browser is set to not to accept Cookies.

8. HOW WE USE YOUR INFORMATION

In general, we use your personal data to deliver the Bubble Service or respond to requests that you make. We use your personal data to:

• Create and secure your account;
  
• Identify you as a user of the Bubble Service
  
• Operate, maintain, and improve our services
  
• Enhance the user experience
  
• Manage your account, including to send administrative notifications
  
• Respond to inquiries related to employment opportunities or other requests, provide chat functionality, and to provide support
  
• Send marketing communications, including newsletters, surveys, offers, and other promotional materials related to the Bubble Service. You may opt out of receiving such information at any time, as noted on the marketing email. Please note that if you opt out of receiving marketing emails, we may still send you transactional emails (e.g. about your account or our business dealings with you).
  
• Process payments via the Bubble Service;
  
• Comply with legal obligations, including to respond to requests from lawful government authorities, enforce our Terms, and to comply with applicable law;
  
• Protect rights and safety, including ours and those of our users ; and
  
• As otherwise described in Section 9.
  

Anonymized Data. We may create anonymized data by removing identifying information that makes the data personally identifiable to you. We may use this anonymized data for analytics and service improvement. We may use anonymized data and aggregated and other de-identified information for any purpose and disclose anonymous data to third parties in our sole discretion.

Automated decision-making or profiling. We do not use your personal data for the purposes of automated decision-making. However, we may do so in order to fulfill obligations imposed by law, in which case we will inform you of any such processing and provide you with an opportunity to object.

9. HOW WE MAY SHARE YOUR INFORMATION

We may share your personal data with:

• Third parties designated by you (i.e. with your consent)
  
• With Subprocessors (as defined in our DPA) that help deliver our services, including to conduct quality assurance testing, facilitate creation of accounts, provide online chat functionality, provide technical support, conduct data analysis, process payments, provide information technology and related infrastructure provision, customer service, email delivery, or provide other services. Click here for a full list of Subprocessors.
  
• With Stripe, a third party payment processor, to process payments made through the Bubble Service and Bubble Marketplace. Such information is provided directly to Stripe, whose use of your personal data is governed by their privacy policy available here.
  
• Public forums when you post content on the Bubble Service, including via user forums or reviews on the Bubble Marketplace. Any such information will become public information and will be available to other users of the Bubble Service and to the general public.
  
• Social networks when you connect them to our service. If you choose to do this, we will provide information to such SNS in accordance with your elections. You agree that you are solely responsible for your use of an SNS and that it is your responsibility to review the terms of use and privacy policy of such SNS.
  
• Legal authorities when required by law, including to comply with valid legal process, enforce this Policy or our Terms; respond to claims that any content violates the rights of third parties; respond to law enforcement; investigate and prevent unauthorized transactions or other illegal activities; or protect our or others’ rights, property, or personal safety.
  
• A corporate event, including if we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another provider, your information may be sold or transferred as part of such a transaction. We cannot control how such entities may use or disclose such information.
  
• With your consent or permission
  

10. AI TECHNOLOGIES

We may use AI technologies to enhance your experience on the Bubble Service, including to improve our services and develop new features. As described in our Terms, we provide access to certain Bubble AI Tools as part of the Bubble Service. When you use Bubble AI Tools, we process your Inputs and the Outputs (where applicable) in accordance with this Privacy Policy. This processing may involve your personal data. We may use the Input and Output from your interactions with Bubble AI Tools to train, refine, and develop Bubble AI Tools and otherwise improve the Bubble Service. When using personal data for AI development and training, we implement appropriate safeguards to mitigate potential privacy impacts.

Bubble AI Tools may utilize Third Party AI Services as described in our Terms. When you use these features, your data may be processed according to both our Privacy Policy and the privacy policies of these services.

11. THIRD PARTY SITES

The Bubble Service may link to third-party websites and features not covered by this Privacy Policy. These third parties have their own privacy policies and we do not accept any responsibility or liability for their websites, features or policies. Review their privacy policies before submitting information to them.

12. SECURITY

We use reasonable organizational, technical and administrative measures designed to protect personal data within our organization. Unfortunately, no transmission of information via the internet is completely secure. If you have reason to believe that your interaction with us is no longer secure, please notify us immediately.

By using the Bubble Service or providing personal data to us, you agree that we may communicate with you electronically regarding security, privacy, and administrative issues relating to your use of the Bubble Service. If we learn of a breach of personal data, we may attempt to notify you electronically or in writing as required by law.

13. RETENTION

We retain your data only as long as necessary to provide the Bubble Service or as required by law.

14. JOB APPLICANTS

When you apply for a job with us, we collect the information that you provide in connection with your job application. This includes but is not limited to business and personal contact information, professional credentials and skills, educational and work history and other information of the type that may be included in a resume. This may also include diversity information that you voluntarily provide. We use this information for our legitimate business interests to facilitate recruitment activities and process employment applications, including for evaluating your candidacy, monitoring recruitment statistics, and responding to surveys. 

We may also use this information to provide improved administration and as otherwise necessary (i) to comply with relevant laws or to respond to subpoenas or warrants served on us, (ii) to protect and defend our or others' rights or property, (iii) in connection with a legal investigation and (iv) to investigate or assist in preventing any violation or potential violation of the law, this Privacy Policy or our Terms.

For information about your rights under applicable state law, please refer to the Your Privacy Rights section of this Privacy Policy, which applies to job applicants as well as Direct Users.

15. INFORMATION ABOUT CHILDREN

Our services are not directed to children under 13. We do not knowingly collect, maintain, or use personal data from children under 13, and no part of the Bubble Service is directed to children under the age of 13. If you learn that a child has provided us with personal data without your consent, please contact us using the details provided herein and we will delete such information as soon as reasonably practicable.

16. INTERNATIONAL DATA TRANSFER

If you're outside the U.S., your data may be transferred, stored or processed in the United States or other countries with different privacy laws. By using the Bubble Service or visiting a Bubble Site, you agree to this transfer, storing and/or processing.

17. SENSITIVE PERSONAL DATA

Please do not send us Sensitive Personal Data (e.g., social security numbers, racial/ethnic information, political opinions, religious beliefs, health data, biometrics, criminal background). If you include Sensitive Personal Data in user-generated content submitted through the Bubble Service, you consent to our processing and use in accordance with this Privacy Policy. If you do not consent to our processing and use of such Sensitive Personal Data, you must not submit it.

18. YOUR PRIVACY RIGHTS

The following rights may be available to you, including if you are in the EEA, Switzerland or the UK.

• Opt-out: Request to opt-out of direct marketing, automated decision-making/profiling, sensitive data collection, new processing beyond original purpose, or data transfers outside the EEA, where we rely on your consent for such transfer. Please note that your use of some of the Bubble Service may be ineffective upon opt-out.
  
• Access: Request access to information we hold about you.
  
• Correction: Request updates or corrections to inaccuracies in your data.
  
• Portability: Request that we move your data to other service providers.
  
• Deletion: Request deletion of your data when no longer relevant or incorrect.
  
• Non-Discrimination: Not be discriminated against for exercising your privacy rights.
  

Additional state-specific rights

Certain U.S. states have enacted privacy laws providing specific rights to their residents. The following rights may apply depending on your state of residence:

• Opt-out of Sale: We do not "sell" personal information as defined under state laws.
  
• Opt-out of Profiling: Residents of certain states may opt out of automated processing used to evaluate aspects of your behavior.
  
• Appeal: Residents of certain states may appeal declined requests.
  

California residents have additional rights to receive specific disclosures about data collection categories, limit use of sensitive personal information, and receive information about third-party data sharing.

How to Exercise Your Rights    
To exercise any of your rights, please email us at [email protected] or using Section 21 below. When submitting a request, please: specify which right(s) you wish to exercise, provide sufficient information to verify your identity, and describe your request with sufficient detail.

For deletion requests, you may also use your account settings.

We will respond within the timeframe required by applicable law (typically 45 days), and may extend this period by an additional 45 days when reasonably necessary with notice.

We may deny requests where permitted by law. For your protection, we may only implement requests for the personal data associated with your specific email address and may need to verify your identity.

Please note that we may need to retain certain information for recordkeeping purposes and/or to complete any transactions that you began prior to requesting such change or deletion.

Authorized Agent
An authorized agent may submit a request on your behalf by sending a written authorization signed by you to [email protected]. We may still require you to directly verify your identity and confirm that you provided the agent permission to submit the request.

Appeals
If we decline a request and you are a resident of a state that allows appeals, you may appeal our decision by emailing [email protected] with the subject line "Privacy Rights Appeal" including: (1) a description of the original request; (2) the reason for the appeal; and (3) any additional information that might help us reconsider. We will respond to appeals within the timeframe required by applicable law.

19. COMPLAINTS

To file a complaint about our privacy practices, please contact us at [email protected]. We'll respond to your complaint as soon as we can, and in any event, within 45 days. If you feel your complaint has not been adequately resolved, you may contact your local data protection authority.

20. CHANGES TO THIS POLICY

We post all Privacy Policy changes on this page with the Effective Date. Material changes will be communicated to Direct Users via email or website notice.

21. CONTACT INFORMATION

We welcome your comments or questions about this Policy. Please use the “Contact us” link of the Bubble Service or contact us in writing at: 

Bubble Group, Inc. 
22 W 21st Street
2nd Floor
New York, NY 10010
ATTN: Privacy
[email protected]