Effective date: 5 January 2026
Last updated: 5 January 2026
This Privacy Policy describes how Surf City Apps LLC ("we", "us", or "our") collects, uses, and protects your personal data when you use the Bubblz mobile app and related services (the “Service”).
We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR) for users in the European Economic Area (EEA).
1. Who We Are
Surf City Apps LLC is a U.S.-based company:
440 N Barranca Ave #2975
Covina, CA 91723, USA
Eメール privacy@bubblz.ai
ウェブサイト https://bubblz.ai
2. What Data We Collect
We collect personal and usage data in connection with the Bubblz app. This includes:
- Personal Information: Email address (account login); Firebase UID (unique user ID); nickname and gender (optional); native language and learning language; language proficiency level
- App Usage Data: Chat history (e.g. conversations with AI); daily streaks, session activity, timestamps; credits usage (lifelines and regular usage); feature usage (e.g. grammar correction, voice input)
- Device & Technical Data: Device model and operating system; IP address (ephemeral); app version; analytics identifiers (e.g. attribution IDs)
- Subscription Data: Plan type (e.g., Premium, Ultra); trial status and subscription state; expiration dates and platform type (iOS or Android)
3. How We Use Your Data
We use your data to:
- Provide access to and operate the Bubblz app
- Authenticate users and manage user profiles
- Personalize the app experience based on your language preferences
- Power AI-driven language conversations
- Send necessary notifications (e.g. password reset, service messages)
- Monitor and improve performance, troubleshoot errors, and enhance app features
- Understand user engagement to improve learning outcomes
- Send you optional email content (language tips, updates) when you opt in
4. Legal Bases for Processing (Under GDPR)
If you are located in the EU/EEA, we rely on the following legal bases under Article 6 of the GDPR:
- Legitimate Interests: Operating and securing the app
- Contractual Necessity: User authentication and profile storage
- 同意する： Analytics and performance optimization (where applicable); optional email communication (e.g. language tips)
- Legal Obligation: Responding to legal requests
How these legal bases apply
The following examples illustrate how we rely on these legal bases for specific processing activities:
- Operating and securing the app: Legitimate interests
- User authentication and profile storage: Contractual necessity
- Analytics and performance optimization: Consent (where applicable)
- Email communication (e.g. language tips): Consent
- Responding to legal requests: Legal obligation
5. How We Obtain Consent
Where we rely on consent, we obtain it through:
- iOS App Tracking Transparency: Consent is requested when tracking is enabled
- Email marketing: You are asked to opt in to receive language learning tips. You can unsubscribe at any time.
- In-app agreements: During onboarding or sign-in, users agree to our Terms and this Privacy Policy
6. Third-Party Services
We rely on third-party services to operate Bubblz, including tools for analytics, user authentication, messaging, AI processing, and notifications. These services help us understand user behavior, improve performance, manage subscriptions, deliver emails, and process your AI chat input.
Some of your data may be processed by:
- Firebase: Authentication, database, analytics, messaging, crash reporting
- PostHog: Product analytics and feature usage tracking
- AppsFlyer: Install attribution and session data
- Sentry: Crash and error monitoring
- OneSignal: Push notifications
- RevenueCat: Subscription management
- Superwall: Paywall and trial flow
- OpenAI: AI chat completions and moderation
- Mailchimp: Email marketing (if opted in)
- SendGrid / Amazon SES: Transactional emails
- Google / Apple: OAuth login services
These providers may process your data in the United States or other countries. Where required, international transfers are safeguarded using Standard Contractual Clauses (SCCs) or equivalent mechanisms.
7. Data Retention
We retain personal data only for as long as necessary for the purposes described in this policy:
- User profile & chat history: Until account deletion or after 24 months of inactivity
- Analytics & technical logs: Up to 24 months
- Subscription records: As required for compliance and account integrity
- Email marketing records: Until you unsubscribe or delete your account
When a user requests deletion of their account, we also initiate deletion from our third-party service providers where applicable.
8. Your Rights (Under GDPR)
If you are an EU/EEA resident, you have the right to:
- Access your personal data
- Rectify inaccurate or incomplete data
- Request deletion of your account and data
- Withdraw consent where processing is based on consent
- Restrict or object to how your data is used
- Port your data (receive it in a structured format)
- Lodge a complaint with your national data protection authority
To exercise your rights, email us at privacy@bubblz.ai. We may require verification before fulfilling your request.
9. Children’s Privacy
Bubblz is not intended for children under 16 years of age (in the EU) or under 13 years of age (in the US). We do not knowingly collect personal data from children without parental consent. If you believe we have collected such data in error, please contact us so we can delete it.
10. AI Features and Content Moderation
Bubblz uses AI services provided by OpenAI to power interactive chat-based language learning. When you use these features:
- Your input may be sent to OpenAI for processing
- Messages may be temporarily retained for content moderation and abuse prevention
- Inputs are subject to OpenAI’s usage policies
We do not use this data to build user profiles or for any unrelated purposes.
11. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Secure cloud infrastructure via Firebase and Google Cloud
- Data encryption in transit (HTTPS)
- Role-based access controls and authentication
- Error monitoring and anomaly detection
Our third-party vendors implement similar security measures and may be certified under relevant frameworks (e.g. ISO 27001, SOC 2).
12. International Data Transfers
Your data may be transferred to and processed in countries outside your country of residence, including the United States. In such cases, we ensure your rights are protected through:
- Standard Contractual Clauses (SCCs) where required
- Vendor commitments to GDPR-compliant processing
- Due diligence on data protection practices of service providers
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. When we do, we will update the "Last updated" date at the top of this page. You may also be notified of significant changes via in-app messaging or email.
We recommend reviewing this Privacy Policy periodically.
14. Contact Us
If you have any questions or concerns about this Privacy Policy or how we handle your data, contact us at:
Surf City Apps LLC
440 N Barranca Ave #2975
Covina, CA 91723, USA
Eメール privacy@bubblz.ai
15. EU Representative (GDPR – Article 27)
We have appointed a representative in the EU to handle GDPR-related requests:
BizLegal Ltd (trading as EU Rep)
27 Cork Road
Midleton, Co. Cork
Ireland
Company Number: 635921
ウェブサイト https://www.eurep.ie
