Privacy Policy

1. Who we are and how to reach us

BuboMap is the organisation responsible for personal information under our control. Our privacy contact can be reached at architect@bubomap.com. We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply to you, other privacy laws such as the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended (CCPA).

2. Customer data and our role

Organisations that use BuboMap ("Customers") put information about their applications, systems, vendors, costs, people, teams and processes into their workspaces ("Customer Data"). Customers own their Customer Data. We process it only to provide the Service on the Customer's instructions. For Customer Data we act as a service provider (a "processor" under GDPR); the Customer is responsible for having a lawful basis to put personal information into BuboMap. If your information is in a Customer's workspace, please contact that organisation first.

3. Information we collect

Account information

You sign in with Google or Microsoft through Firebase Authentication. We receive your name, email address, profile picture (if any) and a unique account identifier from that provider. We never see or store your Google or Microsoft password.

Organisation and billing information

Your organisation name, members and roles, plan and subscription status. Payments are handled by Stripe: card details go directly to Stripe and never touch our servers. We may receive limited billing records from Stripe such as customer ID, plan, invoice status and the last four digits and brand of a card.

Information you send us

Messages through our contact and Business "Get started" forms (name, work email, company, licences needed, billing preferences and your message).

Customer Data and AI questions

The content of your workspaces and the questions you ask the Ask feature.

Technical information

Server and security logs kept by our hosting providers, such as IP address, browser type, requested pages, timestamps and error details.

4. How we use information

• To provide, operate, secure and maintain the Service and your account;
• To answer questions with the AI Ask feature;
• To process subscriptions, invoices and payments;
• To send service emails such as email verification, invitations and billing notices;
• To respond to your requests, including Business plan requests and support;
• To detect, prevent and investigate fraud, abuse and security incidents;
• To comply with law and enforce our Terms of Service.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use Customer Data to train our own or third-party AI models.

5. The AI Ask feature and Google Gemini

When you use Ask, relevant parts of your workspace data and your question are sent to Google's Gemini API to generate an answer. Google processes this data as our subprocessor under its API terms. AI answers can be wrong; see our Terms of Service. Don't put information into BuboMap that you are not permitted to share with such providers.

6. Subprocessors

We use these service providers to run BuboMap:

• Vercel: website and application hosting;
• Google Cloud: hosted PostgreSQL database;
• Google Firebase Authentication: sign-in with Google or Microsoft;
• Microsoft and Google: identity providers you choose to sign in with;
• Google Gemini API: AI answers in the Ask feature;
• Stripe: payments, subscriptions and invoices;
• Resend: transactional email.

Each is bound by contract to protect personal information and use it only to provide services to us. We may update this list as our providers change.

7. Where information is stored

BuboMap is operated from Canada. Our providers may store and process information in the United States and other countries, where it may be accessible to courts and authorities under local law. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for international transfers.

8. Cookies and local storage

BuboMap uses only what is needed to sign you in and run the app. We do not use advertising cookies or third-party analytics trackers.

• Authentication: Firebase Authentication keeps your signed-in session in your browser's storage, and Google or Microsoft may set their own cookies during sign-in.
• Preferences: the app stores interface preferences (such as panel widths and recently saved questions) in your browser's local storage. These never leave your device unless you save them to a workspace.
• Payments: Stripe's checkout and billing pages, which are hosted by Stripe, set their own cookies for fraud prevention.

You can clear these in your browser settings; you will then need to sign in again.

9. Retention and deletion

We keep account information and Customer Data for as long as your account or your organisation's subscription is active. If you ask us to delete your account or your organisation's data, we will delete or anonymise it within 30 days, except where we must keep records to comply with law (for example tax and billing records, which we generally keep for seven years) or to resolve disputes. Deleted data may remain in encrypted backups for up to 90 days before being overwritten. Contact form and Business request submissions are kept for up to two years. You can request deletion at any time by emailing architect@bubomap.com.

10. Security

We use reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit, access controls and providers with recognised security programmes. No system is perfectly secure, and we cannot guarantee absolute security. If a breach creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by PIPEDA.

11. Your rights

Everyone (PIPEDA)

You may ask to access the personal information we hold about you, correct inaccurate information, and withdraw consent (subject to legal or contractual restrictions, which may mean we can no longer provide the Service). You may complain to the Office of the Privacy Commissioner of Canada.

EEA, UK and Swiss residents (GDPR)

You have the right to access, rectify, erase, restrict and object to processing, and to data portability. Our legal bases are performance of a contract, our legitimate interests in running and securing the Service, legal obligations, and consent where we ask for it. You may lodge a complaint with your local supervisory authority.

California residents (CCPA)

You have the right to know what personal information we collect, use and disclose; to request deletion and correction; and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA. You may use an authorised agent.

To exercise any right, email architect@bubomap.com. We will verify your request and respond within the time required by law (generally 30 days). If your information is Customer Data, we may refer you to the relevant Customer.

12. Children

BuboMap is a business service and is not directed to anyone under 16. We do not knowingly collect personal information from children.

13. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new "Last updated" date and, for material changes, notify account owners by email or in the app.

14. Contact

BuboMap (Harvinder Minhas), Ontario, Canada. Email: architect@bubomap.com.