BubblaV LogoBubblaV
ENSV

Data ProtectionEU-hosted · Standard DPA · Swedish law

GDPR
compliance

We're committed to protecting your data and respecting your privacy rights under the General Data Protection Regulation.

Read privacy policyContact us

Your role, our role

You: data controller

  • Obtaining consent from your website visitors
  • Your own privacy policy disclosures
  • Responding to data subject requests from your visitors

BubblaV: data processor

  • Processing data only per your instructions — we do not use your visitors' data for our own analytics or marketing
  • Implementing security measures
  • Assisting with data subject requests

This page provides information about our GDPR compliance practices. It is not legal advice. For specific legal questions, please consult with a qualified legal professional.

What is GDPR?

The General Data Protection Regulation (GDPR) is the EU's data protection law that gives individuals control over their personal data. It applies to any organization processing personal data of EU residents, regardless of where the organization is based.

As an AI chatbot platform, BubblaV processes personal data including website content you provide and conversations between your visitors and the chatbot. We take our GDPR obligations seriously.

How we comply

  1. Lawful basis for all processing (contract performance, legitimate interest)
  2. Data minimization - we only collect what's necessary for the service
  3. Storage limitation - conversations are deleted automatically after your plan's retention period; visitor profiles and other data are kept until the website or account is deleted, or until deletion is requested
  4. Encryption at rest (AES-256) and in transit (TLS 1.2 or higher, TLS 1.3 preferred)
  5. Access controls with role-based permissions
  6. Regular security assessments and vulnerability scanning
  7. Documented incident response procedures
  8. Data subject rights facilitation within 30 days

AI & your data

Your data is not used for AI training

BubblaV uses Retrieval-Augmented Generation (RAG). This means your content is stored in a vector database for retrieval during conversations - it does not modify or improve the underlying AI model weights.

Our AI providers (Anthropic as the primary provider, OpenRouter as the fallback to OpenAI and Google models, Google, Voyage AI and TypeSafe AI) process customer data through their APIs under terms that do not allow it to be used for model training.

Sub-processors

We use the following third-party services to provide our platform:

  • Cloudflare

    Application hosting (Workers), network and security, outbound email delivery, approximate location from IP address, website crawling

    Global network; application placed in the Stockholm regionSOC 2 Type 2, ISO 27001
  • Supabase

    Database, authentication, file and vector storage

    Europe (Stockholm, Sweden)SOC 2 Type 2
  • Ably

    Realtime chat messages and live visitor presence (online status, current page, pages visited during the visit, approximate location, name or email if given)

    Global (EU and United States)SOC 2 Type 2
  • Anthropic

    Primary AI model provider: chatbot responses, Copilot, translation, summaries, image and PDF understanding

    United StatesSOC 2 Type 2, ISO 27001
  • OpenRouter

    Fallback AI routing to OpenAI and Google models when the primary provider is unavailable

    United States—
  • Google

    Embeddings and search-grounded answers (Gemini), push notifications to the BubblaV mobile app (Firebase Cloud Messaging)

    United StatesSOC 2, ISO 27001
  • Voyage AI

    Reranking of retrieved content (visitor question and candidate content)

    United States—
  • TypeSafe AI

    Automated answer quality checks (question, retrieved content, draft answer, conversation history), with a fallback on Cloudflare Workers AI

    United States—
  • OpenAI

    Security screening of custom tool descriptions (no chat content)

    United StatesSOC 2 Type 2, ISO 27001
  • Sentry

    Error monitoring (technical error reports; no session recordings)

    Europe (Germany)SOC 2 Type 2, ISO 27001
  • Vercel

    Email relay for customer mailboxes connected with an app password (IMAP/SMTP)

    United StatesSOC 2 Type 2
  • Gravatar (Automattic)

    Profile picture lookup for chat visitors who give an email address (only a hash of the email address is sent)

    United States—
  • Polar.sh

    Payment processing and subscription management

    United States with EU data handlingPCI-DSS compliant
  • Stripe

    Legacy payment processing

    United StatesPCI-DSS Level 1

International data transfers

Our database is located in the European Union (Stockholm, Sweden), and our application runs on Cloudflare's network next to it. Requests first reach the Cloudflare data center nearest to the user, which can be outside the EU.

Some of our sub-processors (AI model providers, Ably, Vercel, Gravatar, Polar.sh, Stripe) process data in the United States. For any transfers of personal data outside the EU/EEA, we rely on:

Standard Contractual Clauses (SCCs) - EU-approved contract terms for international transfers

Supplementary measures - Encryption and access controls as additional safeguards

Our providers (Cloudflare, Supabase, Ably, Sentry, Vercel, Polar.sh, Stripe and the AI model providers) maintain their own GDPR compliance programs and DPAs.

GDPR Article 28

Data Processing Agreement (DPA)

We offer a Data Processing Agreement (DPA) to customers who need formal documentation of our processing relationship under GDPR Article 28.

Our DPA covers:

  • Subject matter, duration, nature and purpose of processing
  • Types of personal data and categories of data subjects
  • Technical and organizational security measures
  • Sub-processor authorization and notification procedures
  • Data subject rights assistance
  • Data return and deletion obligations

Standard agreement only To keep our service affordable and efficient for everyone, we do not sign custom Data Processing Agreements or non-disclosure agreements manually. We have invested significant legal resources to create a balanced, standard DPA that complies with GDPR and protects both parties.

Request a DPA

To request a DPA: Contact us at support@bubblav.com or through our contact form.

Chat widget privacy

No tracking cookies

The BubblaV chat widget is designed with privacy in mind. It sets no cookies and uses LocalStorage only for a random visitor ID, a session token and small preferences. Conversations are stored on our servers in the EU so that you can read and answer them.

  • No third-party tracking cookies
  • No cross-site tracking: the visitor ID is different on each website
  • We do not send your visitors' data to our own analytics
  • Live visitor view: while a visitor is on your website, your team can see their approximate location (country and city, derived from the IP address by Cloudflare), current page and the pages visited during the visit. This live data is not stored; the country is stored with conversations
  • If your website uses Google Tag Manager or Google Analytics, the widget reports chat events to it (including the text of chat messages) so you can measure chat usage
GDPR clause for your privacy policy

If you use BubblaV on your website, you should inform your visitors. You can use this template snippet in your own Privacy Policy:

We use BubblaV to provide customer support via chat on our website. BubblaV processes data on our behalf, such as the chat messages and contact information you provide, the pages you visit on our website while the chat widget is loaded, and your approximate location (country and city) derived from your IP address. Data is stored in the European Union. Some processing, such as AI response generation, may take place in the United States, in which case GDPR Standard Contractual Clauses apply. BubblaV does not use your conversation data to train their AI models.

Your data rights

Under GDPR, you have the following rights regarding your personal data:

support@bubblav.com

  • Right of access

    Request a copy of your personal data we hold

  • Right to rectification

    Request correction of inaccurate personal data

  • Right to erasure

    Request deletion of your personal data ('right to be forgotten')

  • Right to restriction

    Request limitation of processing in certain circumstances

  • Right to portability

    Receive your data in a structured, machine-readable format

  • Right to object

    Object to processing based on legitimate interests

To exercise your rights: Contact us at support@bubblav.com. We will respond within 30 days.

Governing law: BubblaV is operated under Swedish law. Any disputes relating to data protection will be subject to the jurisdiction of Swedish courts and the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

Have questions about GDPR?

Our team is ready to help with data protection inquiries and DPA requests.

Contact usRead privacy policy