Bubbot Privacy Policy

Applicable Scenarios

• Our websites (including but not limited to bubbot.ai);
• Our mobile application (the "Bubbot App");
• Non-public interactions between you and us (e.g., submitting feedback, contacting customer service, participating in user surveys).

Applicable Users

• Users in all member states of the European Union (EU) and the European Economic Area (EEA);
• Users in the United States (including but not limited to users subject to state-level privacy regulations such as the California Consumer Privacy Act (CPRA), Virginia Consumer Data Protection Act (VCDPA), and Colorado Privacy Act (CPA)).

2.1 Information You Voluntarily Provide

• Account Information: Username, email address, password (stored in encrypted form), age (only used to verify whether you meet the minimum age requirement for using the service), and avatar (non-mandatory to provide).
• Contact Information: Full name, shipping address, billing address, and phone number (only provided when you need order delivery or after-sales communication; non-mandatory to collect).
• Payment Information: We do not directly store sensitive payment data such as bank card numbers or credit card numbers. Payments are only processed through compliant third-party payment service providers (e.g., PayPal, Stripe). We will receive "payment status" (e.g., successful/failed) and "transaction ID" feedback from the payment service provider, which is used for order verification.
• Content Information: Photos and videos (only collected when you actively choose to upload them, such as submitting product experience feedback or sharing in official activities; you can delete uploaded content at any time).
• Parent/Guardian Information: For users under the age of 16 (or the lower age threshold specified by applicable national laws), we will collect the guardian's full name, email address, and phone number to obtain "verifiable consent" (see Chapter 6 "Children's Privacy Protection" for specific methods).
• Communication Information: Emails, chat records, and customer service ticket content from your communications with us (only used to handle your inquiries, complaints, or requests, and not for other purposes).

2.2 Information Automatically Collected

We only automatically collect the following information when it is necessary to "ensure the normal operation of services" or "optimize user experience". You can disable non-essential collection through the channels specified later:

Device and Network Information

• Mandatory Collection Items: Device type (e.g., iPhone 15), operating system version (e.g., iOS 17.1), and IP address (only used to identify regions and match local service rules; not linked to personal identity).
• Network Diagnostic Information: When you actively submit a fault report, we may collect network connection status or error codes to troubleshoot issues. However, we will not automatically collect or store your Wi-Fi name (SSID).
• Optional Collection Items: Device ID (e.g., IDFA) and Bluetooth information (only used to support the "inter-device data synchronization" function). You can disable the collection of this information in "App Settings - Privacy - Device Information".

Usage Data

Log data (including access time, accessed pages/features, page stay duration, and operation records) is only used to analyze user behavior trends and optimize product functions (e.g., fixing frequently lagging pages), and is not linked to personal identity.

Cookies and Similar Technologies

• Necessary Cookies: Used to maintain login status and record basic settings (e.g., language preferences); cannot be disabled.
• Optional Cookies: Used for personalized recommendations, advertising delivery, and performance analysis. You can disable these Cookies in "Cookie Settings" at the bottom of the website or "Privacy Settings - Cookie Management" in the App.

2.3 Information from Third Parties

When you log in or share content through third-party services such as Google or Facebook, we only receive information that these services are allowed to share "based on your privacy settings", for example:

• During Login: Only the "unique identifier" of the third-party account (e.g., Google Account ID) is received to create a Bubbot account. No information such as the email or address book linked to the account is received.
• During Sharing: Only the "content itself" you choose to share (e.g., images, text) is received. No other personal data from the third-party service is received.

Legal Bases for Data Processing for EU and EEA Users

• Your explicit consent;
• Performance of a contract;
• Compliance with legal obligations;
• Legitimate interests (without impairing your privacy rights).

4.1 Sharing

• Intra-Group Companies: Necessary information is shared among parent companies, subsidiaries, and affiliated companies.
• Third-Party Service Providers: Payment service providers (order amount, payment status), logistics service providers (shipping address, recipient's name), cloud storage service providers (encrypted data), and analytics service providers (anonymized usage data).
• Advertising/Marketing Partners: Only with your explicit consent may we share pseudonymized data (e.g., Cookie ID). You can opt out of personalized advertising at any time.
• Third Parties Authorized by You: Sharing only occurs with your explicit consent or request.

4.2 Disclosure

• Legal Requirements: Compliance with court orders and regulatory requests;
• Security and Rights Protection: Prevention of fraud, attacks, and abuse;
• Corporate Transactions: Information may be transferred in the event of mergers, acquisitions, or restructurings, and the new entity must comply with this Policy;
• Public Information: Information you actively upload to public areas may be viewed by other users.

For EU and EEA Users

• If data is transferred to a "country with an adequacy decision", the transfer is based on the adequacy decision;
• If data is transferred to a country without an adequacy decision (e.g., the United States), we will sign the EU Standard Contractual Clauses (SCCs) with the recipient. The recipient must comply with EU data protection standards.

For U.S. Users

If your data needs to be transferred outside the United States, we will ensure the recipient complies with legal requirements and only transfer necessary information.

Minimum Age for Service Use

Bubbot is intended for users aged 8 and above.

Requirements Under Different Laws

• COPPA (U.S.): Children under the age of 13 require parental consent;
• GDPR (EU): Children aged 13–16 require parental consent, with specific age thresholds varying by country;
• Ages 16 and Above: Can independently consent to this Policy.

Protection Measures

• Provide a child-friendly version of the Privacy Policy;
• Children's data is only used to provide services, not for advertising or personalized recommendations;
• Parents/guardians may request access to, deletion of, or modification of their child's information at any time, or withdraw consent.