BubbleSense Privacy Policy

The controller of your personal data is Begins Foundry Co., Ltd., 92 Central Park Offices, 35th Floor, Rama IV Road, Silom, Bang Rak, Bangkok 10500, Thailand (the “Company”, “we”, “us”). For questions about this policy or to exercise your rights, contact contact@bubblesense.com.

Account and sign-in data

• Email, when you sign up or sign in.

• If you sign in with a Google account: email, display name, and profile picture, as sent to us by Google with your permission.

• User ID, membership tier, account creation date, and free-trial status.

• Sign-in session data, via strictly-necessary cookies.

Usage data

• Your preferences, such as your chosen language.

• Watch lists and account-linked feature settings, such as notifications you enable.

• Connection data for external notification channels, such as your LINE user ID when you choose to connect a LINE account (once available).

Payment data (for paid memberships)

• Payments are processed by Stripe, an external payment provider. We do not store and cannot see your card numbers. We receive payment status, billing history, and the data needed to issue receipts, and we may store your name, address, and tax information for legally required documents.

Technical and security data

• IP address and device/browser type, via standard hosting and server logs.

• Approximate location derived from your IP address, to enforce the service-area restrictions in the Terms of Service.

• A record of every discount or trial code you apply and every trial granted to you (IP address, device/browser type, time, and the code used), to prevent misuse and for the reporting our market-data provider contracts require (see section 6).

• Additional identifying data, such as a phone number if we enable additional verification in the future, or your name and address where your plan uses real-time data for which the data provider requires user identification (see section 6).

Service usage data (statistics and analytics)

• On the website before you sign in: anonymous visit statistics via PostHog, without cookies. Visitors are counted with a hash computed on the server from the IP address and browser details; the hash changes every day and cannot be traced back to you. Also via Vercel Web Analytics, which is cookieless as well.

• After you sign in, on the website and in the app: usage data linked to your user ID via PostHog, such as the pages or screens you open, the features you use or that are locked on your plan, sign-ups and sign-ins, the channel that brought you (utm campaign tags and referring website), your membership tier, device details (device type and model, operating system, browser or app version, language, time zone, and screen size), and app opens, closes, installs and updates. We do not send your email or name to this system.

• In the app before you sign in: usage statistics via PostHog that are not linked to an account, using a random ID stored in the app. When you sign in, the earlier statistics from that device are linked to your account as well.

• Requests to PostHog carry your IP address, as any internet connection does. We have set PostHog not to use it to look up your location.

• Subscription status: subscribe, renew and cancel events with the transaction amount, sent from RevenueCat, our subscription management system, to PostHog under the same user ID (no card data).

• You can stop linking your usage data to your account at any time, on the "My account" page on the website or in the app's settings. The setting belongs to your account and applies on every device you sign in on. When it is off, the website goes back to counting you anonymously like a visitor who is not signed in, and the app on that device stops sending usage data. In the app you can also turn it off before you sign in; it then applies to that device, and to your account once you sign in.

• Website visit statistics via Google Analytics 4: only if you consent to analytics cookies (see section 5). It records page views, device and browser type, and approximate location, and is not linked to your account.

We collect data in three ways: (a) data you provide directly, such as your email at sign-in and watch lists you create; (b) data collected automatically as you use the Service, such as cookies and similar technologies, technical data, and usage data (see sections 2 and 5); (c) data from external providers you use with the Service, such as Google when you sign in with a Google account, Stripe when you pay, and LINE when you connect your account.

• To provide the Service, manage your account, and display data according to your plan: performance of a contract.

• To process payments, issue receipts, and keep records under accounting and tax law: contract and legal obligation.

• To send notifications or data summaries you enable, by email or via channels you connect: performance of a contract.

• To keep the Service secure, prevent abuse, prevent repeat trial claims, and enforce service-area restrictions: legitimate interest.

• To prepare data-usage reports and cooperate with audits under our agreements with market data providers, which is a condition of our ability to display market data to you: legitimate interest, and performance of a contract to the extent necessary to provide the Service to you.

• To measure and improve the Service from usage data, such as which features are used or locked and which channels bring users to sign up or pay (PostHog, both anonymous and account-linked): legitimate interest. You can object at any time by turning off the account link described in section 2.

• Website visit statistics, and seeing which Google searches bring users to the website (Google Analytics 4 with Google Search Console): consent, which you can withdraw at any time on the cookie settings page.

• Marketing communications: only with your consent, which you can withdraw at any time without affecting your use of the Service.

We use cookies and similar technologies (such as the browser's local storage and session storage) as follows. Details and settings are on the cookie settings page.

• Strictly necessary cookies: your sign-in session, your language, your cookie choice, the display settings you pick (kept in local storage), a referral or promo code from a link you followed (kept for up to 30 days until you finish signing up), and a short-lived marker after you sign in (up to 5 minutes). These are required to run the Service, so they do not require consent.

• PostHog analytics: on the website before you sign in, no cookies are used; only the utm campaign tags and referring website of your first visit are kept in that tab's session storage until you sign in or close the tab. After you sign in, PostHog keeps a reference ID in a cookie and local storage to link usage data to your account (legitimate interest), and removes it when you sign out or turn off the account link described in section 2.

• Google Analytics 4 analytics cookies: set only if you choose "Accept all" or turn on analytics cookies on the cookie settings page. If you reject or withdraw consent, we do not load Google Analytics and we delete its cookies in that browser.

We do not use advertising or cross-site tracking cookies.

We do not sell your personal data. We disclose data only in the following three cases.

6.1 Data processors who help us operate, under data processing agreements:

• Supabase: authentication and database (stores email and account data).

• Vercel: hosting and anonymous usage analytics.

• Stripe: payment processing and recurring billing.

• RevenueCat: subscription status management across payment channels.

• PostHog: usage analytics for the website and the app (section 2).

• Google: Google Analytics 4 for website visit statistics, only if you consent to analytics cookies.

• Our email delivery provider: to send sign-in links and notifications you enable.

• LINE: when you connect your account to receive notifications (your use of LINE is also subject to LINE's own policies).

6.2 Market data providers. Our right to display market data comes from agreements with data providers, such as the Stock Exchange of Thailand, which require us to prepare data-usage reports and accept audits. We may therefore need to disclose data to a data provider or an auditor appointed by it, as follows:

• Normally: quantitative data, such as user counts and user IDs that are not linked to your identity outside our systems.

• For plans or trials that use real-time data: the data provider requires additional identifying information, such as your name and address. We will tell you clearly at the point where you subscribe to such a plan or claim such a trial.

• For audits: data-usage records within the scope set by the agreements.

6.3 Legal and business events. We may disclose data where required by law, under an order of a court or competent authority, to protect our legal rights, or to an affiliated juristic person or a transferee in a restructuring or business transfer, in which case the recipient must be bound by this policy.

Some of our providers, such as Supabase, Vercel, Stripe, RevenueCat, PostHog (which stores data in the United States), and Google, run servers or operate outside Thailand, so using the Service may involve transferring your data abroad. We transfer only what is necessary to provide the Service under our contract with you, and we choose providers with appropriate data protection safeguards as required by the PDPA.

• Account and usage data: for as long as your account is active. When you delete your account or the data is no longer needed, we delete or anonymise it.

• Payment records and tax documents: for the periods required by accounting and tax law, even after the account is deleted.

• Analytics data: in PostHog, for the retention period of the plan we use (currently 1 year), and in Google Analytics 4 for no more than 14 months. When you delete your account or ask us to delete your data, we delete the data linked to your user ID in PostHog.

• Market-data usage records: our agreements with data providers require us to keep data-usage records for a period that may be longer than the life of your account. We keep them only as long as the agreements and the law require, and use them only for reporting and audits.

• Hash of emails that claimed a free trial: when an account is deleted, we retain a one-way hash of any email address that has claimed a free trial, to prevent repeat sign-ups to claim the trial beyond the permitted limit (legitimate interest in preventing abuse). The hash cannot be reversed into an email address, is used only to detect repeat trial claims, is never used to contact you or for marketing, and is kept for no more than 1 year from the most recent trial claim, after which it is deleted.

We use appropriate technical and organisational measures to protect your data, such as encryption in transit (HTTPS), restricted server-side access to data, and separation of system privileges. However, no system is completely secure. If a personal data breach occurs that poses a risk to your rights and freedoms, we will notify the Office of the Personal Data Protection Committee and notify you under the criteria and timeframes set by the PDPA.

You have the right to: access and obtain a copy of your data, correct it, erase or destroy it, restrict its use, object to processing, request data portability, withdraw consent, and lodge a complaint with the Personal Data Protection Committee (PDPC).

To exercise these rights, contact contact@bubblesense.com. We will respond within the timeframes required by law. Some rights are limited by law: data we must keep under accounting and tax law, or records we must keep under our agreements with data providers (section 8), cannot be deleted until the required retention period ends, and requesting deletion of data necessary to provide the Service may make it impossible for us to continue serving you.

The Service is not directed to anyone under 20 years old without the consent of a legal representative. If we learn we have collected a minor's data without valid consent, we will delete it.

We do not make automated decisions that significantly affect you. The automated systems we use are limited to basic tasks, such as detecting repeat trial claims and restricting access by service area, and you can contest their results by contacting us.

We may update this policy from time to time. The effective date above shows the latest version. For material changes, such as new purposes or new data recipients, we will notify you through the Service or by email before they take effect, and where the law requires consent, we will ask for your consent first.

Data controller: Begins Foundry Co., Ltd.

92 Central Park Offices, 35th Floor, Rama IV Road, Silom, Bang Rak, Bangkok 10500, Thailand

Email: contact@bubblesense.com