Bubble Lab – Privacy Policy
Last updated: September 30, 2025
At Bubble Lab, we respect your privacy. This Privacy Policy explains what information we collect, how we use it, and what rights you have.
1. Scope
This Policy applies to:
- Bubble Studio (our hosted service where we manage credentials and execute workflows).
- bubblelab.ai and related websites.
It does not apply to:
- Self-hosted Bubble Lab deployments (you run the open source software yourself). In those cases, you control all data; Bubble Lab does not collect, store, or process your data.
2. Information We Collect
a) Account Information
When you sign up for Bubble Studio, authentication is handled by Clerk. We may receive:
- Name, email address, and account credentials (as managed by Clerk);
- Basic profile information provided via Clerk.
b) Service Usage Data
To operate Bubble Studio, we may collect:
- Metadata about workflow execution (timestamps, success/failure states, runtime logs);
- API calls and integration status;
- Limited diagnostic/error reports.
We do not access your workflow content or credentials, except as needed to provide support or resolve incidents.
c) Credential Data
If you connect third-party services (e.g., Slack, Google Sheets, Postgres), we store access tokens and credentials in encrypted form. These are used only to execute your workflows on your behalf.
d) Website & Analytics Data
When you use our website, we may collect:
- IP address, browser type, device information;
- Interaction data (pages viewed, referring pages).
We use this to improve site performance and understand usage trends.
3. How We Use Information
We use collected data to:
- Provide and operate Bubble Studio;
- Authenticate users via Clerk and secure accounts;
- Debug, monitor, and improve performance;
- Communicate about updates, features, and support;
- Comply with legal obligations.
We do not sell personal data.
4. Data Sharing
We may share information with:
- Service providers who help us operate (e.g., Clerk for authentication, hosting, monitoring, email);
- Legal authorities if required by law, subpoena, or to protect safety;
- Business successors in case of merger, acquisition, or sale.
We do not share workflow content or credentials with third parties except as necessary to provide the Service.
5. Data Retention
- Account data: retained while your account is active and as required by law.
- Credential data: retained securely until you remove integrations or delete your account.
- Workflow metadata: retained for operational and debugging purposes, typically [X days—insert retention window].
6. Security
We use industry-standard safeguards to protect your data:
- Encryption in transit and at rest;
- Credential management via Clerk;
- Access controls and monitoring;
- Regular vulnerability assessments.
No system is perfectly secure. You are responsible for protecting your account credentials and connected services.
7. International Data Transfers
If you access Bubble Studio from outside the U.S., your data may be processed in the United States or other jurisdictions where our service providers operate. By using Bubble Studio, you consent to such transfers.
8. Your Rights
a) General Rights
Depending on your location, you may have rights to:
- Access and obtain a copy of your data;
- Request correction or deletion of personal data;
- Restrict or object to processing;
- Data portability.
Requests can be submitted to hello@bubblelab.ai.
b) Rights Under the GDPR (EU/EEA & UK)
If you are located in the EU, EEA, or UK, the following apply:
- Controller: Bubble Lab Inc. is the controller of your personal data processed via Bubble Studio.
- Legal Bases: We process personal data based on:
- Performance of a contract (to provide Bubble Studio services);
- Legitimate interests (e.g., to improve and secure services);
- Consent (where required, e.g., for marketing communications);
- Legal obligations (compliance with applicable laws).
- Cross-border Transfers: If data is transferred outside the EEA/UK, we rely on standard contractual clauses or equivalent safeguards.
- Supervisory Authority: You may lodge complaints with your local data protection authority.
c) Rights Under the CCPA/CPRA (California)
If you are a California resident, you have the following rights:
- Right to Know what personal data we collect and how we use it;
- Right to Delete personal data, subject to certain exceptions;
- Right to Correct inaccurate personal data;
- Right to Opt Out of the sale or sharing of personal data (Bubble Lab does not sell personal data);
- Right to Non-Discrimination for exercising your rights.
California users may exercise these rights by emailing hello@bubblelab.ai.
9. Children's Privacy
Bubble Lab is not directed to children under 13 (or the digital age of consent in your country). We do not knowingly collect personal data from children.
10. Changes to This Policy
We may update this Privacy Policy from time to time. If changes are material, we will notify you (by email or in-product). Continued use after changes indicates acceptance.
11. Contact Us
If you have questions or requests regarding this Policy:
Bubble Lab Inc.