bubbltag

bubbltag Privacy Policy

Effective date 16 September 2026 | Last updated 14 October 2026

This Privacy Policy (the "Policy") explains how bubbltag collects, uses, shares and retains personal information in connection with its app, AI services, event-registration pages and support services in the United Kingdom, the European Economic Area and the United States. It also sets out your privacy rights. The Terms of Service govern use of the service and responsibility for users' conduct; they do not replace this Policy or any consent that data protection law requires.

1 Controller and contact details

bubbltag UK Ltd provides the service and is the controller for the platform processing described in this Policy, for people in the United Kingdom, the European Economic Area and the United States. Its company number is 16907701 and its registered office is 9th Floor, 107 Cheapside, London, EC2V 6DN, United Kingdom. Contact: support@bubbltag.com.

Our parent company, Bubbltag, Inc., is incorporated in Delaware, United States, with its correspondence address at 2261 Market Street STE 46278, San Francisco, CA 94114, United States. It may receive information for authorised group support, administration, engineering, security and legal purposes. Bubbltag, Inc. publishes the bubbltag app in the Apple App Store and on Google Play; bubbltag UK Ltd remains the controller. Unless otherwise expressly stated, "we", "us" and "our" mean bubbltag UK Ltd.

2 Age and accuracy of information

You must be at least 13 years old to use bubbltag, and you must state your age truthfully. If you state an age under 13, registration stops. Your age and any date of birth you give are self-declared. A self-declared date of birth indicating an age below 18 is used to prevent access to events designated 18+. Facial checks do not verify or estimate age, do not establish legal identity and do not involve checking an identity document. False details may lead to an account being restricted or closed under the Terms.

If you live in the European Economic Area, you must have reached the age at which your country allows you to consent to the use of your personal information, which is between 13 and 16. We rely on the age you state.

We do not knowingly collect personal information from people under 13. If we learn that we have done so, we delete that information.

Where an account is identified as belonging to a person under 13, it is restricted or closed and information no longer lawfully required is removed, subject to a specific legal obligation or proportionate necessity to preserve limited evidence. A false declaration does not automatically authorise retention of a child's biometric information for three years. A user's responsibility for false statements does not reduce our statutory duties or children's rights.

For members aged 13 to 17, photographs, communications, event participation and proximity information may disclose identity or location to the recipients described below. These members keep their privacy rights, and may ask us or a trusted adult for help in understanding or using them. Underage accounts, inaccurate age details and privacy concerns may be reported to support@bubbltag.com.

3 Personal information and sources

We obtain information from you and your device; from other users who communicate with you or report you; from event organisers and their authorised teams; and from the verification, payment and other providers identified below. We process the following categories.

Facial biometric information

Veriff processes live selfies, liveness information, profile photographs for comparison, facial templates or embeddings, and associated session and fraud indicators. A facial template is a mathematical representation used for facial matching. The purposes are to check that a photograph is of the account holder, to authenticate later sign-ins on a phone, to confirm deletion requests, to keep an account with the same person, to detect duplicate accounts and to prevent re-registration during a lawful active ban. This processing does not establish age, legal identity, character or safety.

Veriff conducts the biometric checks and stores verification material. bubbltag does not retain verification selfies, face embeddings or facial biometric templates; it receives results, relevant review details, account and verification references, and restriction dates. Ordinary profile photographs are separately stored for app purposes. Section 8 governs retention. Relevant matching is confined to bubbltag records.

Biometric recognition through Veriff requires your separate, explicit consent, obtained before anything is collected and naming Veriff and the purposes. Consent must be informed, specific and freely given, including for younger members. Submitting a selfie, or accepting the Terms or this Policy, is not that consent. Registration, later sign-ins on a phone and profile-photograph changes require a facial check, and cannot be completed if you decline the consent or the check. Deleting an account in the app also begins with a facial check, to confirm that the request is yours; where that check is not available or is not completed, a code sent to the phone number on the account may be used instead. An account cannot continue to be used with facial verification switched off. To withdraw biometric consent, request account deletion through the app. Retention, deletion and statutory withdrawal rights are governed by sections 8 and 10, and this service requirement remains subject to applicable law.

Veriff acts as our processor to the extent that it processes on our instructions. Any independently determined purposes disclosed in its own notice are governed by that notice and applicable law. The fact that Veriff stores the material does not relieve us of our obligations as controller. Veriff's Privacy Notice gives further details.

Sensitive information and AI

Health, religion, sexual orientation and other special-category information require an additional legal condition. Where explicit consent is relied on, it must cover the particular use and disclosure; consent to storage does not automatically authorise disclosure, or sending the information to an AI provider. Sensitive profile suggestions are not intentionally generated. Holding another person's information does not, by itself, entitle a user or host to consent on that person's behalf.

Optional AI processing uses Anthropic's commercial services. Information about another participant may be included only where the relevant permissions and legal conditions permit. We do not authorise general-purpose model training on private messages, profile information or biometric data. You may switch bubblAI off. Messages you send while your bubblAI is off are never sent to Anthropic through our integration, including when another person uses bubblAI. Messages sent before you switched it off may still be included in later bubblAI requests. Shared-interest hints involving you stop completely while bubblAI is off. Switching it off does not itself delete existing records. Any continued use of earlier messages remains subject to the applicable permissions and a lawful basis, including your right to withdraw any consent it relies on. Retention and rights are addressed in sections 8 and 10.

bubblAI listens to a voice message, looks at a picture or reads a file in a chat only when a person in that chat asks it to, and only what they ask about (up to three things in one message). Google Cloud turns a voice recording into text in the European Union, and the text, the picture or the file is sent to Anthropic to write a reply. Only the person who asked sees the reply. Another person's voice message, picture or file is used only if that person has bubblAI on and had it on when it was sent. Voice messages, pictures and files in chats are not listened to, looked at, read or analysed in any other case. Nobody is identified from a voice or a picture: no voiceprint or face template is made and nothing about the speaker is worked out from a recording. When a person asks bubblAI about a link shared in a chat, Anthropic's service opens that page to write the reply.

bubblAI looks at your posts for another person only while your bubblAI is on. Where bubblAI cannot use something you sent or posted because your bubblAI is off, or was off at the time, the person who asked may be told that this is the reason.

Photo and video filters

Photo and video filters detect faces and use facial points to retouch skin. The facial points used by these filters are not stored. Photographs and videos you save or share remain subject to the ordinary content and retention provisions of this Policy.

4 Purposes and lawful bases

Under the UK GDPR and, for people in the European Economic Area, the EU GDPR, we rely on the following legal bases for the purposes shown.

Biometric matching for ban enforcement requires a valid Article 6 basis and Article 9 condition throughout processing. General safety interests, the existence of a ban or acceptance of the Terms is not enough by itself.

You must provide the information needed to administer your account, carry out required facial checks or complete a transaction you request in order to receive that service. If you refuse an optional permission, the feature that depends on it may be unavailable; unrelated services are not affected. You may withdraw consent as described in section 10; this does not affect the lawfulness of earlier processing.

5 Disclosure to users and event participants

Your profile and content are shared according to the audiences, permissions and privacy settings you choose, subject to the exceptions below. Recipients receive the messages, posts, exports and other content shared with them. Only approved profile suggestions are disclosed. Being nearby does not, by itself, disclose your full profile; approved shared-interest information may be disclosed, with the relevant permissions, while bubblAI is on. A connection who uses bubblAI in a conversation with you may receive general hints drawn from your approved profile information, such as a topic to ask about, but never your own words. Information recognised as sensitive is excluded from those hints. These hints stop while your bubblAI is off. Sensitive information requires the applicable specific permission and legal condition. What has already been disclosed, and copies held by recipients, cannot necessarily be recalled.

Safety disclosures

Your photograph may be shown to an affected user so that they can assess a possible safety concern, even where your ordinary visibility settings would otherwise hide it. Disclosure does not establish misconduct. Blocking does not prevent recognition or contact outside the service or guarantee exclusion from shared event or staff contexts.

Public event information

Listings, host names, an organisation's name, picture, description and website link, event locations, descriptions and images may be publicly accessible and redistributed. An organisation's picture, description and website link are deleted when an Admin removes them or the organisation closes. Anyone who has an invitation link may be able to see its content. A person holding a valid unclaimed registration code may access the registrant's full name and event and registration details without signing in. Guest lists and registration-email fields are not publicly displayed.

Female or male designation and pronouns

You tell us whether you are female or male when you register or, if you registered earlier, in response to a one-time request in the app, so that bubbltag's own wording can refer to you as she or he. People who are able to see your profile photograph (people nearby while your profile is visible, and your connections) may see that wording. In incognito or discreet mode, it is not sent to people nearby who are not shown your photograph, and the wording uses your first name where that is shown, or neither she nor he. bubblAI receives the designation when you use it yourself, when a connection uses it in a conversation with you while your own bubblAI is on, and when it generates a shared-interest hint about you for a nearby person while your profile is visible and your bubblAI is on. Shared-interest hints do not refer to you as she or he while you are in incognito or discreet mode. There is no setting in the app to change it; contact us to correct it.

Connections at an event

On an event's in-app page, your connections may be shown your first name and profile photograph where you hold a confirmed place or the event has been sent to you through a chat, and may open your profile from that page as your connections already see it. That disclosure is not made to other users, except that the hosts and co-hosts of an invitation-only event may see who it has been sent to, as set out under "Event personnel". You may switch off the disclosure to your connections at any time in Settings, Privacy & Safety, "Mutual Events". Where you host an event, your connections who can see its page are also shown your profile photograph beside your first name and may open your profile from it. Other people are shown your first name only. The "Mutual Events" setting does not change what is shown about a host. Records identifying recipients to whom an event was sent are deleted approximately 30 days after the event and on account deletion.

Event personnel

Hosts and co-hosts may receive first names, registration answers, status, account photographs and attendance information. For an invitation-only event they may also receive the first names and account photographs of people to whom the event has been sent through a chat and who have not registered, until those people register or remove the invitation. While an event is on, hosts and co-hosts may see, as a figure only, how many of the people who joined it have been present. After it has finished, they may also receive, in the app and by email, a summary of it in figures only: passes confirmed, people scanned in at the door, the number of people who joined the event and were present at it, the times at which most people were present, the number of tags sent by or to people taking part in the event while it was on and the number of connections made through those tags. A summary does not name anyone or show who was present, or who tagged or connected with whom. To count the people present, bubbltag notes which accounts were present while the event is on and deletes that note when the summary is recorded. At a small event a figure may relate to very few people. Staff guest records exclude registration full-name and email fields, although answers may themselves reveal such details. Admission personnel may receive photographs before the event and first names and check-in details. Photographs may persist in local device storage. These disclosures apply whatever your ordinary visibility settings are; a visual check by event personnel is separate from Veriff's biometric processing. For Chip in, hosts and co-hosts may receive the amount and attendee's first name or, where the attendee chooses not to be named, the amount alone.

Event groups

Registering or being admitted may make you a member of the event group, and disclose your first name, username, photograph and contributions to the other members, including people registered for different dates of a recurring event. Event-presence information remains account-linked even where only an aggregate figure is displayed.

While an event is on, event-presence information is also used to send up to three reminders, in the app or by notification, to people with a confirmed place or a role at the event who have been detected at it, encouraging them to connect with others there. A person who has left may still receive one where the departure has not been detected. The reminders are sent to the individual alone and are not disclosed to hosts or other participants. You may switch them off at any time in Settings, Notifications, "At my events".

Hosts must use guest information only for lawful event purposes, keep it secure and provide privacy information for any processing under their own control. Registration does not constitute general consent to sensitive-data processing or unrelated marketing. Optional host-follow emails may be sent to both the registration address and linked account address only where the opt-in covers both. You may unsubscribe from these emails; essential booking messages are separate.

6 Other recipients

Authorised personnel and providers receive information for the relevant purpose subject to appropriate access, confidentiality and security controls. Recipients include the following.

Use of the app at particular premises, or being protected under the Terms, does not give a partner, host, business or venue access to private messages, reports or biometric templates. Incident information may be disclosed only where necessary, proportionate and lawful for the specific response, investigation or claim. Confidentiality and retaliation risks are considered, and disclosure is limited to what is required. Nothing permits facial blacklists to be circulated among hosts or venues.

Information may be disclosed in connection with a proposed or completed financing, reorganisation or business transfer, subject to a lawful basis, confidentiality and appropriate restrictions. A successor remains bound by applicable data protection law. Independent recipients are responsible for their processing, without diminishing our responsibility for our disclosures.

Public event pages do not currently use optional analytics or advertising trackers. Hosting requests, images, email delivery and device caches may nevertheless involve technical information. Necessary storage and access remain subject to applicable legal exceptions; optional tracking requires the consent or other conditions required by law. The separate bubbltag.com website is hosted by Squarespace and governed by its website-specific privacy and cookie information, except that the founding host form also sends your name, email address and intended hosting arrangements to bubbltag, which uses them only to email your founding host code, recognise that code when it is redeemed and tell you when hosting opens.

7 International processing

Information may be processed in the United Kingdom, European Economic Area and United States, including through authorised overseas support or group access. The cloud database is hosted in the United States; photographs and other files are stored in London, United Kingdom. Additional countries may be used by other suppliers as identified in their applicable service arrangements.

A restricted transfer requires a valid adequacy decision or appropriate safeguards, including, where applicable, the UK International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses, together with required supplementary measures. Reliance on a Data Privacy Framework route is confined to covered recipients and transfers and, where applicable, the UK extension. Provider location or execution of a standard contract is not treated as sufficient without assessment of the relevant transfer requirements.

For European Economic Area residents, corresponding EU GDPR requirements apply. The United Kingdom is covered by a European Commission adequacy decision. A transfer to another country relies on an adequacy decision or on the European Commission's Standard Contractual Clauses, with any supplementary measures required.

You may ask at support@bubbltag.com which safeguards apply to your information and for a copy of them, subject to lawful redaction. Information processed overseas may be subject to different laws, including lawful access by public authorities.

8 Retention and deletion

The following periods, deletion events and criteria govern retention by category. Where no fixed period is set, we consider the purpose of collection, the status of the account and event, sensitivity, complaints and disputes, legal requirements and whether less identifying records would serve. All retention is subject to applicable legal limitations and section 10 rights.

Accounts and content

Information is retained while necessary to provide the account or requested service, until applicable deletion or expiry, subject to a separate lawful retention requirement. Account deletion does not remove copies independently held by recipients.

Location and proximity

Current location readings and ordinary nearby observations are retained only as necessary to establish proximity. Temporary safety proximity records are deleted within two hours after the other person is no longer nearby; corresponding notification records may be retained for up to 24 hours. Shared encounter records remain associated with the relevant conversation. Standalone confirmations of attendance at an activity are deleted within two hours after it starts; event-registration and presence records follow the separate criteria below.

Events

A website event draft, its picture, code and supplied email address are deleted seven days after creation unless the event is published. Unclaimed registrations and codes are scheduled for deletion 30 days after the event starts. Other event and claimed-registration records do not automatically expire on conclusion or cancellation. Retention depends on continuing account access, event administration, complaints, payments, legal claims and statutory requirements. Cancellation alone does not erase guest records. Account deletion removes the individual's registration, team and follow records; records of cancelled hosted events and other participants are assessed separately.

Marketing and technical records

Follows persist until withdrawal or deletion of the relevant account. Limited consent and suppression records are retained as necessary to evidence consent and honour withdrawal. Email queues and delivery records are retained for delivery and dispute resolution. Security logs, rate-limit records and device caches are retained according to operational necessity, fraud and security risk, investigative requirements and sensitivity. Backups remain restricted pending routine replacement or deletion, and deletion restrictions are reapplied on restoration.

AI

Ordinary AI conversations are retained with the account until deleted, subject to lawful exceptions. Chat comparisons and event-drafting conversations are temporary and are not stored by bubbltag as continuing AI history. Usage and cost records are separately retained for service limits, cost monitoring and dispute resolution. Anthropic's standard commercial API retention is generally up to 30 days, subject to legal and abuse exceptions; flagged inputs and outputs may be retained for up to two years and associated safety scores for up to seven years under its applicable policy. The fact that bubbltag handles something only temporarily does not mean the supplier deletes it immediately. Further details appear in Anthropic's commercial data retention policy.

bubbltag does not keep the text of a voice message after the reply is written, and makes no copy of the recording, the picture or the file. The reply stays in the conversation of the person who asked and may quote or describe what was said or shown. The number of seconds turned into text is kept with usage and cost records.

Facial records

Veriff keeps each facial-check record, including captures, biometric templates and comparison records, for about six and a half months and then deletes it automatically, except for the active-ban retention described below. If the account is deleted sooner, the associated verification and biometric information is deleted at that point, subject to the active-ban provision or a specific overriding legal obligation. Rejected pending profile photographs held by bubbltag are deleted; deleting them does not by itself erase the corresponding Veriff check. Your rights to seek earlier erasure and to withdraw consent remain as set out in this Policy.

Active bans

For a banned account, Veriff retains facial verification and biometric records, linked account references and restriction dates until expiry of the ban, subject to a maximum of three years from initial deactivation inclusive of any uninterrupted provisional restriction. Account deletion does not, by itself, trigger deletion of lawfully retained ban records. Retention and matching require continuing necessity, a valid legal basis and a special-category condition. Attempted re-registration does not restart the period. Records are removed from active matching and deleted on expiry, lifting or an earlier applicable legal or contractual deadline. Backups awaiting deletion are excluded from matching. A permanent ban does not extend this maximum: facial records are deleted at three years. After that we keep only the account reference, the dates and the reason for the ban, for as long as it lasts, so that a new account belonging to the same person can be recognised and closed.

Support correspondence is ordinarily retained for two years after closure. The copy made when a post or an event is reported is retained for two years after the report is closed, or until the end of any restriction that relies on it if that is later, and is then deleted. It is retained for that period even if the post, the event or an account is changed or deleted in the meantime, and may be accessed only by authorised reviewers. Relevant safety evidence, review records and appeals may be retained during an active restriction where necessary. Financial, tax and consent records are retained for the applicable legal, accounting or claims period. A specific legal hold may preserve necessary evidence for longer, but neither extends an expired ban nor authorises continued biometric matching.

Account deletion should be requested through the app. Requests are proportionately verified, and eligible information removed without undue delay, with any lawful refusal or delay explained. Deletion across recipients and backups is not necessarily instantaneous. A valid restriction does not extinguish privacy rights. Where consent is the only valid basis, withdrawing it ends that biometric processing, even if a separately valid account restriction remains. On expiry or lifting of a ban, a fresh application may be made under the then-current eligibility requirements.

9 Automated processing and review

Automated facial analysis assesses liveness, similarity and matches with active accounts or active-ban records. Results may prevent activation, later sign-ins on a phone or a photograph change and may be erroneous. A failed check does not, by itself, prevent deletion, which remains subject to proportionate authentication and law. Reports and blocks from different accounts may trigger warnings or temporary automatic deactivation pending assessment; numerical thresholds do not establish misconduct. Serious concerns may warrant immediate protective measures without warning.

A human reviewer assesses the account and the supporting material before a ban is confirmed. Findings and the length of a ban must be supported by evidence, taking account of context, harm, mistaken or coordinated reports and any response. For children, age, understanding, best interests and proportionality are additionally considered. Reasons, duration and a review route are provided subject to lawful confidentiality limits.

An explanation, opportunity to contest results, submission of information and meaningful human review may be requested at support@bubbltag.com. Review is not conditional on continuing account access or renewed biometric consent, and the reviewer may amend the outcome. Processing subject to automated-decision restrictions requires the applicable additional safeguards and authorisation; acceptance of the Terms does not provide them. Optional AI and personalisation involve inferences and suggestions, which you are free not to accept.

10 Your rights and complaints

Subject to applicable statutory conditions, you may request access, rectification, erasure, restriction and portability. Portability concerns qualifying information supplied by you and processed automatically on consent or contractual grounds. You may object to legitimate-interest processing on grounds arising from your circumstances; the processing then stops unless the law permits it to continue. Objection to direct marketing may be made at any time.

To withdraw consent to Veriff's facial biometric processing for bubbltag, request account deletion through the app. An account cannot continue to be used with facial verification switched off. Veriff deletes associated verification and biometric records subject to the lawful exceptions in section 8.

Consent may be withdrawn at any time without affecting the lawfulness of prior processing. Processing that depends on that consent stops when it is withdrawn, without waiting for account deletion to be completed. Any separately continued processing requires an applicable lawful basis and special-category condition. The access requirement in section 3 does not waive statutory rights.

Rights requests and complaints should be addressed to support@bubbltag.com. Proportionate information may be requested to verify identity or authority. We will not make a rights request conditional on fresh consent to biometric processing that you have declined or withdrawn. Requests are ordinarily answered within one month; any extension, suspension, fee or refusal must be legally permitted and accompanied by the required explanation.

Data protection complaints are acknowledged within 30 days, appropriately investigated, and subject to progress information and communication of the outcome without undue delay. This procedure does not replace the separate rights-request deadline. Complaints may be made to the Information Commissioner's Office through its complaints service, and available judicial remedies pursued. European Economic Area residents may also complain to the data protection authority of their country of residence or work. Our procedure does not waive those entitlements.

10A United States residents

Categories, purposes and recipients

Section 3 specifies the information collected; section 4 its purposes; sections 5 and 6 its recipients; and section 8 the applicable retention.

No sale or cross-context advertising

Personal information is neither sold nor shared for cross-context behavioural advertising. bubbltag does not track users across other companies' apps or websites.

Sensitive information

We use precise location and facial biometric information only to provide the service you ask for and to keep it safe, as described in this Policy.

State-law rights

Depending on the state where you live, you may have the right to know what personal information we hold, to obtain a copy, to have it corrected or deleted, and to exercise those rights without being treated unfairly. Requests should be sent to support@bubbltag.com and are subject to verification that they originate from you. A refusal may be appealed by replying to our response and requesting reconsideration.

Biometric information

Written consent is requested before every facial check. Acting on our behalf, Veriff collects a live selfie and produces a facial template from it and the profile photograph. The purposes are to assess whether you are a real person, whether the photograph depicts you, whether an account already exists and whether an active ban applies. Veriff deletes facial records approximately six and a half months after each check or on earlier account deletion. For a banned account, the facial record used to prevent re-registration is retained for the duration of the ban, which will not exceed three years, subject to the lawful-basis and withdrawal limitations elsewhere in this Policy. Biometric information is not sold, leased, traded or otherwise exploited for profit and is disclosed only to Veriff or as required by law.

Children

bubbltag is not directed to people under 13.

11 Security

Technical and organisational safeguards appropriate to risk are applied, including encryption in transit, access controls and security checks. No system guarantees immunity from unauthorised access, disclosure or loss. You must keep your devices and sign-in codes secure and promptly report any suspected compromise. Incidents are investigated and affected people and authorities notified where required. A third party's wrongdoing does not relieve us of our security or breach-notification obligations.

12 Changes to this Policy

Material amendments are subject to appropriate notice, and fresh consent is obtained where required before new consent-based processing. Continued use does not substitute for consent. New purposes, data categories or recipients require the applicable notice and lawful basis before use.

13 Contact

Privacy requests and complaints: support@bubbltag.com.

Safety and content reports: reportaproblem@bubbltag.com.

Postal address: bubbltag UK Ltd, 9th Floor, 107 Cheapside, London, EC2V 6DN, United Kingdom.