Who we are
Bubblegram is a chat widget and inbox service. Website owners receive visitor messages in a web inbox, Telegram, or email, and can turn on automated replies. The service is operated by an individual developer ("we", "us", "our").
For data-related questions, contact us at [email protected].
Roles
For visitor messages, the website owner decides what is collected and how it is used. They are the controller and we process that data on their behalf. For site owner accounts, we are the controller.
What we collect
We collect only what is needed to run the service:
- Email address: provided by site visitors when sending a message, and by site owners when creating an account.
- Messages: the content visitors type into the chat widget or send by email, and replies from the site owner's team.
- Session identifiers: signed tokens stored in your browser's localStorage to link messages to a session.
- Technical metadata: IP address (used for rate limiting, not stored long-term) and browser type.
- Automated reply records: when a site owner turns on automated replies, we store each generated reply, the model used, its token usage, and a one-way hash of a shortened IP address and browser type. The hash is used only to limit automated replies per visitor.
- Website content: pages a site owner adds as sources for automated replies. We keep a short summary of each page, not the full page.
We do not collect phone numbers, payment card details, or sensitive personal data. Payments are handled by our payment provider.
Why we collect it
- To deliver visitor messages to site owners in the inbox and their connected channels.
- To deliver replies from site owners back to the correct visitor.
- To write automated replies, when the site owner turns them on.
- To prevent abuse through rate limiting.
- To authenticate site owner accounts and secure API access.
- To send site owners occasional product update emails. You can unsubscribe from any of them.
Automated replies
Automated replies are off by default. A site owner can turn them on for their site. When on, we send the following to the AI provider that runs the selected model:
- Recent messages in the conversation.
- The site owner's business details and website summaries.
We do not send visitor email addresses or IP addresses to AI providers, other than what a visitor writes in a message. Under their API terms, providers do not use this data to train their models. Automated replies are labeled in the chat widget.
Where your data is stored
All data is stored on servers located within the European Union. Some service providers listed below, including AI providers, may process data in the United States. These transfers rely on Standard Contractual Clauses or the EU-US Data Privacy Framework.
How long we keep your data
- Messages, session data, and automated reply records are retained while the associated site owner account is active.
- When a site owner deletes a project or account, all associated data is permanently removed within 30 days.
- IP addresses used for rate limiting are not stored beyond the current request window.
Service providers
We share data only with providers needed to run the service:
- Telegram: message content, when a site owner connects Telegram.
- Resend: sending and receiving email, including the email channel, account emails, and product updates.
- OpenAI, Anthropic, and Google: conversation content and site sources, only when a site owner turns on automated replies. Only the provider of the selected model receives data.
- Polar: payments and billing for site owners.
Each provider's own privacy policy applies to data processed by their platform. We do not sell, rent, or share your personal data for marketing or profiling purposes.
Cookies and local storage
We use only essential session identifiers stored in the browser's localStorage. We do not use tracking cookies, advertising cookies, or any third-party analytics scripts.
Your rights (GDPR)
If you are located in the EU or EEA, you have the following rights under the General Data Protection Regulation:
- Access: request a copy of the personal data we hold about you.
- Rectification: ask us to correct inaccurate data.
- Erasure: ask us to delete your data ("right to be forgotten").
- Portability: receive your data in a machine-readable format.
- Objection: object to processing based on our legitimate interests.
To exercise any of these rights, email [email protected]. If you are a visitor on a site that uses Bubblegram, you can also contact that site's owner. We will respond within 30 days.
Security
Session tokens are cryptographically signed (HMAC). API keys are validated per request. Communications between the widget and our servers use HTTPS. We apply rate limiting to protect against abuse.
Changes to this policy
If we make material changes, we will update the date at the top of this page and notify site owners by email at least 14 days in advance.