Privacy Policy

The short version

• For merchants, partners and visitors to our websites, we collect only what we need to run the service, bill for it and keep it secure.
• For the shoppers our clients text, we act on the brand’s behalf. The brand decides; we follow its instructions.
• We don’t sell personal information, we don’t share it for targeted advertising, and our websites have no advertising trackers.
• Conversations go to AI model providers to write replies, under terms that don’t let them train on the data.
• You can ask to see, correct or delete your information at privacy@bubblesms.com.

1. Who we are and what this policy covers

BubbleSMS (“BubbleSMS”, “we”, “us”) is an AI messaging service, based in the United States, that holds consented text conversations with the customers of online stores, on the stores’ behalf.

This policy covers personal information we handle about:

• visitors to bubblesms.com and help.bubblesms.com;
• merchants: the businesses that use BubbleSMS, and their team members, using app.bubblesms.com and our Shopify app;
• partners: agencies, affiliates, creators and sales representatives in our partner program, using partners.bubblesms.com; and
• people who contact us, for example to book a call.

It also explains, in section 5, what we do with information about shoppers (the customers of the brands that use BubbleSMS). For that information we are a service provider to the brand, and the brand’s own privacy policy applies.

2. Information we collect

Information you give us

• Account details: name, work email address, phone number (only if you choose text sign-in codes), role, and the store you connect.
• Business details for carrier registration: legal business name, EIN, business address, contact person and the customer support email to show on your SMS policy pages. Needed only if you ask us to register your brand for SMS.
• Billing details: billing contact name and email. Your card is entered on a page hosted by our payments processor. We receive only the card brand, last four digits and expiry date, never the full card number.
• Partner details: name, email, referral link and code. Before your first payout, also your payout method (an email address for Wise or PayPal, or US bank account details for ACH), your tax form (W-9 or W-8BEN, which includes your legal name, address and taxpayer identification number) and your invoice details.
• Messages and forms: what you send us by email, through “book a call” and contact forms, or through newsletter sign-up.

Information we collect automatically

• Log and device data: IP address, browser type, pages requested, and dates and times, collected by our servers for security and troubleshooting.
• Referral data: when someone clicks a partner’s referral link, we record the time, the browser’s user agent, the referring page, and a salted one-way hash of the IP address (never the IP address itself), and we set a referral cookie (see section 7).
• Usage data in the app: actions you take in the dashboard, such as changing settings or taking over a conversation, recorded in an audit log.

Information from others

• Shopify: when you install our app, details of your store such as its name, domain and owner email, plus the store data described in section 5.
• Partners: if a partner referred you, the fact of the referral.
• Public sources: for merchants, your store’s public website and policies, which we read to set up your brand profile.

3. How we use information

We use the information in section 2 to:

• create and secure accounts and sign you in with one-time codes;
• provide, set up, support and improve the service, including building your brand profile and reviewing it before go-live;
• register your brand with mobile carriers when you ask us to;
• calculate fees, charge them and send invoices and receipts;
• track referrals, calculate commissions, make payouts and meet tax reporting duties;
• send service messages, such as sign-in codes, alerts, receipts and summaries;
• send occasional product news to merchants and partners, which you can unsubscribe from at any time;
• detect and prevent fraud, abuse and security incidents; and
• comply with the law and enforce our agreements.

4. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose it only to:

• Service providers that process it for us under contract, in these categories: cloud hosting and databases; payments processing; payout providers (for partner payouts); transactional email delivery; error monitoring; network security and DNS; website hosting and forms; and business email and office tools. For the service itself, also messaging platforms and carriers and AI model providers. See our Subprocessors page.
• Referring partners: if a partner referred a merchant to us, the partner sees the merchant’s store name and account status, and summary performance and billing figures needed to show their commission. Partners never see shoppers’ information or conversations.
• Mobile carriers and their registries: the business details you give us for carrier registration.
• Professional advisers, such as lawyers and accountants, under a duty of confidentiality.
• Authorities, where the law requires it, or where we need to protect our rights, our users or the public.
• A buyer or successor, if we sell, merge or transfer all or part of our business, subject to this policy.

5. Shoppers: information we process for brands

When a brand uses BubbleSMS, we process information about its customers (“shoppers”) on the brand’s behalf and on its instructions. The brand is responsible for this information (the “controller” or “business”), and we act as its service provider (or “processor”).

What we process

• Contact details: mobile number, first name, email address and the store’s customer ID.
• Location for timing: state or province and country (from the shipping address) to work out the time zone and which state rules apply; and, where the brand turns on the address check, the delivery address for that order.
• Order and cart details: products, order number, order amounts, discount codes and fulfillment status.
• Conversations: the full text of messages sent and received, any images the shopper sends, delivery status and timestamps.
• Consent records: whether the shopper agreed to texts, when and how, the wording version, and any opt-out.
• Outcomes: whether the conversation led to an order with one of our codes, for the brand’s reporting and billing.

Why

Only to provide the service to the brand: to decide whom to text and when, write and send messages, reply to shoppers, create single-use discount codes and review links, hand conversations to the brand’s team, report results, bill the brand, honor opt-outs and quiet hours, and keep the service secure.

AI

Messages are written by AI. To write a reply, we send the conversation, the order or cart details and the brand’s information to our AI model providers. Their terms do not allow them to use this data to train their models. We do not use shoppers’ information to train general-purpose AI models.

People

Members of our team may read conversations when reviewing a brand’s setup before go-live, checking quality, handling support or a handoff, or investigating a problem. Access is limited to people who need it.

What we don’t do

We don’t sell shoppers’ information, use it for advertising, combine it across brands, or infer sensitive characteristics such as income, health or ethnicity.

Shoppers’ choices

Reply STOP to any message to stop texts from that brand. To see, correct or delete your information, please contact the brand directly. If you contact us instead, we will pass your request to the brand and help them respond.

6. How long we keep information

We may keep information longer where the law requires it, or to resolve a dispute or legal claim, and only for as long as that need lasts.

7. Cookies

Our websites and app use a small number of cookies to keep you signed in, to remember a partner referral for 90 days, and to remember display preferences. We use no advertising or cross-site tracking cookies. Details are in our Cookie Notice.

8. Security

We protect information with measures that include: encryption in transit (TLS); encryption at rest by our hosting providers; additional application-level encryption for partner bank details, which only authorized staff can view, with every view logged; sign-in by one-time code, so there are no passwords to steal; access limited by role and by need; checking the signature on every webhook from Shopify and our messaging providers; and removing secrets and tokens from logs and error reports. No system is perfectly secure. If a breach affects your information, we will tell you as the law requires.

9. Your privacy rights

Depending on where you live, US state privacy laws (such as the California Consumer Privacy Act, as amended by the CPRA) may give you the right to:

• know and access the personal information we hold about you, and get a portable copy;
• correct inaccurate information;
• delete your information;
• opt out of the sale or sharing of personal information, or of targeted advertising (we do neither); and
• limit our use of sensitive personal information. We use sensitive information, such as a partner’s taxpayer ID or bank details, only to pay you and meet tax duties, which the law allows without that option.

We will not treat you differently for using these rights.

How to make a request. Email privacy@bubblesms.com from the address linked to your account, or tell us how to reach you. We will confirm your identity before acting, usually by sending a code to that address. You can use an authorized agent; we will ask for proof that you gave permission. We reply within 45 days. If we need more time (up to another 45 days), we will tell you why.

Appeals. If we turn down your request, you can appeal by replying to our decision. We will respond within 60 days. If you are still not satisfied, you may contact your state attorney general.

Global Privacy Control. We honor browser opt-out signals such as Global Privacy Control. Because we don’t sell or share personal information, there is nothing further to switch off.

Shoppers: see section 5. Requests about a brand’s texts go to that brand.

10. California notice at collection

In the last 12 months we collected the following categories of personal information, for the purposes in section 3 and with the retention in section 6. We sold or shared none of them.

For shoppers’ information we act as a service provider. The brand gives its own notice.

11. Children

Our websites and services are for businesses and are not directed to children under 16. We do not knowingly collect personal information from them. If you think we have, contact us and we will delete it.

12. Where we process information

BubbleSMS serves the United States. We store and process personal information in the United States. If you contact us from elsewhere, your information will be transferred to and processed in the United States.

13. Changes to this policy

We will post any update here with a new “last updated” date. If a change is material, we will also tell merchants and partners by email or in the app before it takes effect.

14. Contact

BubbleSMS. Privacy questions and requests: privacy@bubblesms.com. Other legal matters: legal@bubblesms.com.