Privacy Policy

Bubble Rock Studio is the data controller for your Bubble Club data. If you have any question about this policy or your data, contact us at contact@bubblerockstudio.com.

When you join Bubble Club, we collect:

• Your name
• Your email address
• The avatar you choose, or a photo you upload for your card
• Your phone number, only if you choose to add one
• The card colour you pick
• Your member number, which we assign to you
• The date and version of this policy you agreed to
• Whether you chose to receive news and offers by email
• Your points balance and the record of each points change made in the boutique (the date and the amount)

We do not ask for a password. You sign in by entering a one-time code that we email to you.

We use your data only to run your Bubble Club membership: to identify you in the boutique, to keep your card and points up to date, and to contact you about your membership when needed. We send news and offers only if you opted in, and you can opt out at any time. We do not use your data for profiling, automated decision-making, or any third-party marketing, and we never sell it.

We process your membership data on the basis of your consent, which you give when you join. Sending you news and offers relies on your separate, optional consent. You can withdraw either consent at any time, without affecting the lawfulness of processing before you withdrew it.

Your data is stored in our database hosted on Supabase, and our website is hosted on Vercel. Membership emails, such as your sign-in code, are sent through Resend. If you email us, your message is handled through Gmail (Google). These providers act as our processors and may store data on servers inside or outside the European Economic Area under safeguards required by the GDPR, such as the European Commission’s Standard Contractual Clauses.

We keep your Bubble Club data for as long as you are a member. If you ask us to end your membership, we delete your personal data, keeping only what the law requires us to retain. If your account stays inactive for a long period, we may contact you and then delete it.

Under the GDPR, you have the right to:

• Access the data we hold about you
• Ask us to correct data that is wrong or incomplete
• Ask us to delete your data
• Ask us to restrict or object to how we use your data
• Receive your data in a portable, machine-readable format
• Withdraw your consent at any time

To exercise any of these rights, contact us at contact@bubblerockstudio.com. You also have the right to lodge a complaint with your local data protection authority. In France this is the CNIL (www.cnil.fr).

We rely on the following providers, who process your data on our behalf:

• Supabase – database hosting. See their privacy policy.
• Vercel – website hosting. See their privacy policy.
• Resend – sending membership emails. See their privacy policy.
• Gmail (Google) – handling emails you send us. See the Google Privacy Policy.