Privacy Policy

Last updated: 5 October 2026

This policy explains what Better Run, Inc. does with personal data. We also use the names "Bubbling", "we", and "us" for Better Run, Inc.

This policy covers:

• Our websites at bubbling.ai and alerts.bubbling.ai.
• The Bubbling dashboards.
• The Bubbling Alerts product.
• Our API and embed SDK for conversation imports.
• Our email to you.

1. Our two roles

We are a controller of data about our own visitors and customers. We decide why and how we use that data. Sections 3 to 9 apply to data from these activities:

• You visit our site.
• You create an account.
• You pay us.
• You contact support.

We are a processor of the conversations our customers send us. A business connects its chat assistant to Bubbling. We review those conversations to produce alerts and analytics for that business. That business decides what to send and why. We act on its instructions. Section 10 applies.

If you talked to a business's chat assistant, we usually act as a processor. We do not have a direct relationship with you. We cannot identify which business holds your conversation without more information. Section 10 explains how we can help.

Contact the business you chatted with.

2. Who to contact

Better Run, Inc., 651 N Broad St, Suite 201, Middletown, DE 19709.

Privacy questions and requests: privacy@bubbling.ai.

3. The personal data we hold as a controller

Website visitors. We hold:

• The pages you request.
• The page that linked to our site.
• Your approximate location, which we derive from your IP address.
• Your browser and device type.
• The date and time of your visit.
• Browser identifiers that connect visits across our website and dashboard.
• Clicks on signup, sign-in, and platform links.
• Whether a contact form submission succeeds.
• Page URLs and referral information that the analytics service collects.

The Cookie Notice explains what we store in your browser.

Account holders. We hold:

• Your name.
• Your work email address.
• Your password credentials.
• Your company name.
• Your job role, if you provide it.
• Your profile picture, if you provide one.
• Your language.
• Your time zone.

Configuration you provide. We hold:

• The projects you create.
• The sources you connect.
• The monitors you write in plain English.
• The notification settings you choose.

Usage and diagnostics. We hold records of:

• The features you use.
• Your API calls.
• The volume of conversation imports.
• Errors and stack traces.
• Security actions, such as sign-in and key rotation.

Billing. We hold:

• Your company's billing details.
• Your plan.
• Your invoices.
• The last four digits and expiration date of your payment card.

Our payment processor holds the full card number. We never receive it.

Communications. We hold your email and support tickets, with anything you tell us in them. We also hold sales inquiries and the business contact details in them.

Our contact form sends your contact details and message to our support service through Inffuse. Google reCAPTCHA checks the submission for automated abuse.

Website and dashboard analytics. We use Mixpanel to understand website visits and product use. When you sign up or sign in, we can link earlier website visits to your account.

The website's contact form event contains no form contents or reCAPTCHA token. The form sends that information separately to our support service.

Dashboard session replay. The dashboard uses Fullstory to help us understand product use and diagnose problems. It sends Fullstory your account identifier and display name. Fullstory captures dashboard interactions and page content according to its privacy settings.

Applicants and partners. If you apply for a job or work with us commercially, we hold the data you send us for that purpose.

We collect this data from:

• You directly.
• Your use of the Service.
• The systems you connect.
• Our payment and email providers.

4. Why we use it, and on what legal basis

The table names the legal bases under the GDPR and the UK GDPR. The "Why" column explains our purposes, even where those laws do not apply.

Our security work includes abuse detection and audit logs. It protects our customers and their End Users.

You cannot opt out of required product and service email.

Where we rely on legitimate interests, we first assess them against your rights. You can object at privacy@bubbling.ai under Section 9.

We do not sell personal data or share it for cross-context behavioral advertising. These terms have the meanings that California law defines. We did not sell or share personal data in these ways during the last 12 months.

5. Who we share it with

Service providers. These vendors process personal data to help us run the Service. The Sub-processors page describes their roles and the data they receive. It includes Mixpanel for analytics and Fullstory for dashboard session replay. It also includes Google reCAPTCHA for contact form protection. Each vendor:

• Has obligations under a written contract.
• Processes data only on our instructions.
• Meets the standards in our Data Processing Addendum.

Professional advisors. These advisors have a duty of confidentiality:

• Lawyers.
• Accountants.
• Auditors.

Authorities. We share data where the law compels it, or to establish or defend a legal claim. We assess every request. We resist requests that are overbroad or unlawful. Unless the law forbids it, we tell the affected customer.

A successor. We share data with a successor, subject to this policy, in these cases:

• A merger.
• An acquisition.
• A financing transaction.
• A sale of assets.

If a new entity becomes the controller, we will tell you.

We do not share personal data with anyone else, and we do not disclose Customer Data to advertisers or data brokers under any circumstances.

6. Where the data goes

We run the Service on Google Cloud infrastructure in us-central1, Iowa, United States. Our browser services use their providers' infrastructure. The Sub-processors page includes provider details.

For transfers from these places, we use contractual safeguards when the destination has no adequacy decision:

• The European Economic Area (EEA).
• The United Kingdom (UK).
• Switzerland.

For these transfers, we rely on the European Commission's Standard Contractual Clauses. For UK transfers, we also use the UK International Data Transfer Addendum. For Swiss transfers, we use the Swiss adaptations.

We assess each transfer and apply these safeguards:

• We encrypt data in transit and at rest.
• We control access to data.
• We follow a policy to challenge unlawful government requests.

To request a copy of the clauses, write to privacy@bubbling.ai.

7. How long we keep it

We overwrite backups on a separate schedule, within 7 days. Where a legal claim or a legal duty requires it, we keep data longer. When that reason ends, we delete or anonymize the data.

8. How we protect it

We use these security measures:

• We encrypt data in transit with TLS and at rest.
• We restrict access to the people who need it for their job.
• We require multi-factor authentication and limit permissions to what each person needs.
• We keep audit logs.
• We apply patches to our systems.
• We separate our production environment from our development environment.
• We require every employee and contractor to sign a confidentiality agreement.
• We review our vendors before we use them.

Annex II of the Data Processing Addendum describes these measures in full.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant regulator as the law requires.

To report a vulnerability, write to privacy@bubbling.ai.

9. Your rights

EEA, UK, and Switzerland

In these places, you can ask us to:

• Give you a copy of your personal data.
• Correct your personal data.
• Delete your personal data.
• Restrict how we use your personal data.
• Send your personal data to another provider in a portable form.

You can object to our use of personal data based on legitimate interests. You can also object to direct marketing at any time, without a reason.

Where we rely on consent, you can withdraw it. This does not affect what we did before you withdrew consent.

California

If you are in California, you can:

• Ask what personal data we collected about you and where it came from.
• Ask for a copy of your personal data.
• Ask us to correct your personal data.
• Ask us to delete your personal data.
• Limit our use of sensitive personal information.

We do not sell or share personal information, so there is nothing to opt out of. You can use an authorized agent. If you exercise a right, we will not discriminate against you.

Other US states

Other US states with a comprehensive privacy law grant broadly the same rights. We honor them on the same terms.

How to make a request

To make a request, write to privacy@bubbling.ai.

We answer within one month. For a complex request, we can extend that period by two months. If we extend it, we will tell you why. We will verify your identity before we act. We will ask only for the information that we need to verify your identity.

How to make a complaint

If you are unhappy with our answer, you can complain to your supervisory authority:

• The ICO in the United Kingdom.
• Your national data protection authority in the EEA.
• The FDPIC in Switzerland.
• The California Privacy Protection Agency.

10. Conversations we process for a customer

This section covers the conversations a business sends us about its own End Users.

The business is the controller. We are the processor. The business decides:

• What data to send.
• Why it sends that data.
• How long we keep that data.

The business must tell its End Users what it does and obtain any consent required. Our Data Processing Addendum is the contract that governs this.

What is in the data. The data includes:

• Message text from the End User and the assistant.
• Timestamps.
• The identifier that the business uses for that End User.
• Technical metadata about the session.

The message text includes any personal data that the End User typed into the chat. The Service reviews that text.

What we do with it. We store conversations and review them with a large language model. The results include:

• A summary.
• An outcome.
• A sentiment.
• An intent.
• A product area.
• A match against the monitors that the business wrote.

We deliver the results to the business through:

• Email.
• Slack.
• Its dashboard.

What we do not do with it. We do not use the data to train our own or anyone else's generative models. Our AI sub-processor's contract imposes the same restriction. That sub-processor does not use the data to train models.

We also do not:

• Sell the data.
• Use the data for advertising.
• Use the data for our own purposes.
• Combine one customer's data with another's.

How long we keep it. We keep the data for as long as the business instructs. When the business deletes a conversation or closes its account, we delete the data within 90 days. Section 13 of the Terms of Service governs this deletion. We overwrite backups on the separate schedule in Section 7.

If you are an End User, contact the business you chatted with.

That business has a direct relationship with you. It knows which conversation is yours and can contact us. If you write to privacy@bubbling.ai, we will send your request to the customer that we can identify as responsible. We will tell you if we send it. We cannot act on the data without that customer's instruction.

11. Children

The Service is a business tool. Children are not its intended audience. We do not knowingly collect personal data from a child under 16 as a controller. If a business sends us a conversation held with a child, that business is responsible for the lawful basis for it.

If you believe we hold a child's data as a controller, tell us at privacy@bubbling.ai.

We will delete that data.

12. Changes

We can update this policy. The date at the top shows when we last updated it. For a material change, we will tell account holders by email or in the dashboard. We will give at least 30 days of notice before the change takes effect. You can request previous versions at privacy@bubbling.ai.