GDPR Compliance

Your Role, Our Role

You: Data Controller

As our customer, you determine the purposes and means of processing personal data collected through your chatbot. You're responsible for:

• Obtaining consent from your website visitors
• Your own privacy policy disclosures
• Responding to data subject requests from your visitors

BubblaV: Data Processor

We process personal data on your behalf according to your instructions. Our responsibilities include:

• Processing data only per your instructions — we do not use your visitors' data for our own analytics or marketing
• Implementing security measures
• Assisting with data subject requests

How We Comply

We've implemented the following measures to ensure GDPR compliance:

• Lawful basis for all processing (contract performance, legitimate interest)
• Data minimization - we only collect what's necessary for the service
• Storage limitation - conversations are deleted automatically after your plan's retention period; visitor profiles and other data are kept until the website or account is deleted, or until deletion is requested
• Encryption at rest (AES-256) and in transit (TLS 1.2 or higher, TLS 1.3 preferred)
• Access controls with role-based permissions
• Regular security assessments and vulnerability scanning
• Documented incident response procedures
• Data subject rights facilitation within 30 days

AI & Your Data

Your Data is NOT Used for AI Training

We want to be absolutely clear: your website content and conversation data is never used to train AI models.

BubblaV uses Retrieval-Augmented Generation (RAG). This means your content is stored in a vector database for retrieval during conversations - it does not modify or improve the underlying AI model weights.

Our AI providers (Anthropic as the primary provider, OpenRouter as the fallback to OpenAI and Google models, Google, Voyage AI and TypeSafe AI) process customer data through their APIs under terms that do not allow it to be used for model training.

Sub-Processors

We use the following third-party services to provide our platform:

International Data Transfers

Our database is located in the European Union (Stockholm, Sweden), and our application runs on Cloudflare's network next to it. Requests first reach the Cloudflare data center nearest to the user, which can be outside the EU.

Some of our sub-processors (AI model providers, Ably, Vercel, Gravatar, Polar.sh, Stripe) process data in the United States. For any transfers of personal data outside the EU/EEA, we rely on:

• Standard Contractual Clauses (SCCs) - EU-approved contract terms for international transfers
• Supplementary measures - Encryption and access controls as additional safeguards

Our providers (Cloudflare, Supabase, Ably, Sentry, Vercel, Polar.sh, Stripe and the AI model providers) maintain their own GDPR compliance programs and DPAs.

Data Processing Agreement (DPA)

We offer a Data Processing Agreement (DPA) to customers who need formal documentation of our processing relationship under GDPR Article 28.

Our DPA covers:

• Subject matter, duration, nature and purpose of processing
• Types of personal data and categories of data subjects
• Technical and organizational security measures
• Sub-processor authorization and notification procedures
• Data subject rights assistance
• Data return and deletion obligations

Standard Agreement Only

To keep our service affordable and efficient for everyone, we do not sign custom Data Processing Agreements or non-disclosure agreements manually. We have invested significant legal resources to create a balanced, standard DPA that complies with GDPR and protects both parties.

To request a DPA: Contact us at support@bubblav.com or through our contact form.

Chat Widget Privacy

No Tracking Cookies

The BubblaV chat widget is designed with privacy in mind. It sets no cookies and uses LocalStorage only for a random visitor ID, a session token and small preferences. Conversations are stored on our servers in the EU so that you can read and answer them.

• No third-party tracking cookies
• No cross-site tracking: the visitor ID is different on each website
• We do not send your visitors' data to our own analytics
• Live visitor view: while a visitor is on your website, your team can see their approximate location (country and city, derived from the IP address by Cloudflare), current page and the pages visited during the visit. This live data is not stored; the country is stored with conversations
• If your website uses Google Tag Manager or Google Analytics, the widget reports chat events to it (including the text of chat messages) so you can measure chat usage

GDPR Clause for Your Privacy Policy

If you use BubblaV on your website, you should inform your visitors. You can use this template snippet in your own Privacy Policy:

We use BubblaV to provide customer support via chat on our website. BubblaV processes data on our behalf, such as the chat messages and contact information you provide, the pages you visit on our website while the chat widget is loaded, and your approximate location (country and city) derived from your IP address. Data is stored in the European Union. Some processing, such as AI response generation, may take place in the United States, in which case GDPR Standard Contractual Clauses apply. BubblaV does not use your conversation data to train their AI models.