Account and identity information
Name, username, email address, encrypted password hash, verification status, account plan, account status and team role.
Privacy Policy
Last updated: 17 July 2026. This notice explains how personal information is handled when you visit or use BubblFlow during beta.
1. Who is responsible for your information
BubblFlow is operated by Richard France as an individual. BubblFlow is the product name used for this service.
- Data controller
- Richard France
- Service address
- 26 Hyrst Garth, Batley, WF17 7AD, United Kingdom
- Support form
- Contact BubblFlow support
If BubblFlow later becomes a sole-trader business or limited company, this notice will be updated to identify the new controller or operator. Where required, users will be told before responsibility for their information changes.
2. Scope
This policy applies to BubblFlow websites, accounts, canvases, projects, teams, support tools, beta feedback and AI-assisted features. It does not control independent websites or services that you visit through external links.
BubblFlow is available worldwide but is operated from the United Kingdom. UK data-protection law applies to our processing, and local privacy laws may also give you additional rights.
3. Information we collect
User-created content
Projects, canvases, bubbles, notes, comments, drawings, links, templates, uploaded images and media, settings, thumbnails and version or activity history needed to operate the workspace.
Team and sharing information
Team membership, invitations, roles, project access, guest access, collaboration presence and actions taken in shared workspaces.
Support and feedback
Your contact details, request category, subject, message, reference number, delivery status, internal support notes and beta feedback.
Technical and security information
IP address, browser or device information, session identifiers, timestamps, login and security events, rate-limit records, error references and service activity.
AI information
Prompts, recent AI chat context and relevant canvas or selected-bubble content sent when you choose to use an AI feature. BubblFlow also records limited usage metadata such as provider, model, request type, character or token estimates, status and time.
Cookies and browser storage
Essential session and security cookies, plus optional functional browser storage for interface preferences. BubblFlow does not currently use analytics or advertising cookies.
4. Where information comes from
Most information is supplied directly by you when you register, create content, collaborate, upload media, use AI tools or contact support. We also receive technical information automatically from your browser or device, and collaboration information from other users who invite you to a team or project.
5. How and why we use information
| Purpose | Typical lawful basis |
|---|---|
| Create and operate accounts, workspaces, canvases, projects, teams and sharing tools. | Performance of our contract with you, or steps requested before entering it. |
| Save, display, synchronise, export and restore your content. | Performance of our contract and our legitimate interest in providing a reliable service. |
| Provide requested AI assistance. | Performance of our contract and our legitimate interest in providing the feature you selected. |
| Verify accounts, secure sessions, prevent misuse, investigate incidents and enforce policies. | Our legitimate interests in security, fraud prevention and protecting users; legal obligation where applicable. |
| Answer support requests, manage beta-access requests and respond to complaints. | Performance of our contract and our legitimate interests in customer support and service administration. |
| Measure service usage, diagnose faults and improve beta features. | Our legitimate interests in maintaining and improving BubblFlow, using proportionate information. |
| Meet legal, regulatory, tax, accounting or law-enforcement requirements. | Legal obligation and, where relevant, legitimate interests in establishing or defending legal claims. |
| Remember optional interface preferences in browser storage. | Your choice or consent where required by applicable cookie law. |
We do not currently use personal information for advertising, sell personal information, or make solely automated decisions that produce legal or similarly significant effects.
6. AI-assisted features
AI features are optional. When you submit an AI request, BubblFlow sends the prompt, recent AI conversation context and relevant selected canvas content to the configured AI provider so it can generate a response. The current provider is Groq. The provider or model may change in future; this policy will be updated when a material change affects how information is handled.
BubblFlow does not run its own foundation model. AI output may be inaccurate, incomplete or unsuitable. Do not include passwords, payment-card details, private API keys, special-category personal information, confidential business information or personal information about another person unless you have authority and a lawful reason to do so.
BubblFlow stores limited AI usage metadata for up to 12 months. The current usage table does not store the full prompt or full AI response, although prompts and responses may remain temporarily in the active browser session or be processed by the AI provider under its own service arrangements.
7. Who receives information
We share information only where needed to operate the service, provide a feature, comply with law or protect BubblFlow and its users.
| Recipient | Purpose |
|---|---|
| Hetzner | Website, application and database hosting infrastructure. |
| Hostinger | Email mailbox and SMTP delivery for verification, support and service messages. This provider may change in future. |
| Groq | Processing AI prompts and relevant context when you request an AI feature. |
| Other users you collaborate with | Displaying shared projects, team content, comments, roles, presence and actions according to workspace permissions. |
| Professional advisers, authorities or courts | Only where reasonably necessary for legal compliance, safety, fraud prevention or legal claims. |
| A future operator or company | If BubblFlow is reorganised, transferred or incorporated, subject to appropriate notice and safeguards. |
Google, Microsoft and Apple sign-in are not currently enabled. Analytics and advertising services are not currently used. We will update this notice before enabling services that materially change the information shared.
8. International transfers
Some service providers may process information outside the United Kingdom. Where UK data-protection law requires it, we will use an approved transfer mechanism or another lawful safeguard and assess the protection available. Users outside the UK should understand that their information will be processed in the UK and in locations used by our providers.
9. Cookies and browser storage
- Essential cookies and storage: used for login sessions, CSRF protection, temporary actions, real-time collaboration safety and security. The signed-in service cannot work properly without them.
- Functional storage: can remember interface preferences such as open panels, canvas position, dashboard layout and similar settings. Signed-in users can control and clear optional browser data in User Settings.
- Analytics cookies: not currently used.
- Advertising or marketing cookies: not currently used.
If analytics, advertising or other non-essential tracking is introduced later, BubblFlow will update this policy and add any consent controls required by law before activation.
10. How long information is kept
| Information | Typical retention |
|---|---|
| Active account and user-created content | While the account remains active and as needed to provide the service. |
| Account scheduled for deletion | 30-day restoration period before permanent deletion or anonymisation processing. |
| Deleted information in backups | Up to a further 30 days, unless a longer period is required for security, legal claims or law. |
| Security and activity logs | Normally 90 days. |
| AI usage metadata | Normally 12 months. |
| Support requests and delivery logs | Normally 24 months after the request is closed. |
| Beta feedback | Normally 24 months. |
| Expired invitations and verification records | Normally 90 days. |
These periods are operational defaults, not guarantees that every record is retained for the full period. Information may be removed sooner when no longer needed, or kept longer where reasonably required for security, legal obligations, dispute resolution or legal claims.
11. Account deletion and shared content
You can schedule account deletion from User Settings. The account is deactivated and enters a 30-day restoration period. Logging in during that period allows you to restore the account. After the restoration period, eligible account information and personally owned content will be deleted or anonymised through BubblFlow’s deletion process.
Content owned by another user or held in a shared team workspace is not automatically deleted merely because you leave the team or delete your personal account. Shared team content remains available to the team owner and authorised members. If you own a project inside another person’s team, project ownership may be transferred to that team owner so the shared work is not lost. Personal attribution in retained comments, history and membership records may be anonymised. Team owners must transfer ownership or archive or delete their team before deleting their own account.
Backups may retain deleted information for up to a further 30 days before normal rotation. Some minimal records may be retained where required for security, fraud prevention, legal obligations or legal claims.
12. Security
BubblFlow uses measures including encrypted password hashing, hardened sessions, CSRF protection, permission checks, rate limits, controlled database migrations, restricted error reporting and access logging. No online service can guarantee absolute security. Please use a unique password and report suspected account misuse promptly.
13. Your privacy rights
Depending on the law that applies, you may have rights to request access, correction, deletion, restriction, objection and portability, and to withdraw consent where processing relies on consent. You may also complain to a supervisory authority.
For UK concerns, you can complain to the Information Commissioner’s Office. We ask that you contact BubblFlow first so we have an opportunity to resolve the issue.
Submit a request through BubblFlow support or email support@bubblflow.com. We may need to verify your identity before acting on a request.
14. Age requirements
BubblFlow beta is for users aged 16 or over. It is not currently designed or promoted for schools or children under 16. If the law where you live requires a higher minimum age or parent or guardian involvement, you must meet that requirement before using BubblFlow.
A future education or school offering will require separate safeguards, age-appropriate design work and updated legal documents before release.
15. Changes to this policy
We may update this policy as BubblFlow develops, processors change or legal requirements evolve. Material changes will be highlighted through the service, the What’s New page, email or another reasonable method. The date at the top shows the current version.
16. Contact
Privacy questions and rights requests can be sent to support@bubblflow.com or through the support form.
Richard France
26 Hyrst Garth
Batley
WF17 7AD
United Kingdom