Privacy Policy

BuzzBomb is operated by [Company legal name], a company registered in England and Wales with its registered office at [Registered address] (“BuzzBomb”, “we”, “us”). ICO registration number: [ICO registration number, if applicable].

We are the controller of personal data about visitors to buzzbomb.com and about the people who create BuzzBomb accounts. For customer content that our agents process on your behalf (for example, leads you upload or replies drafted to your audience), we act as your processor and our Terms of Service, including the data processing terms in them, govern that processing.

Questions, requests or complaints: privacy@buzzbomb.com.

Information you give us

• Account data: name, work email, password (hashed), company name, the website URL you paste in, and your plan and billing status.
• Workspace content: briefs, brand voice settings, guardrails, drafts you edit, comments, approvals and rejections.
• Connected accounts: when you connect a social, ads, search or analytics account (for example LinkedIn, Meta, X, Google Ads, Reddit) via OAuth, we store the access tokens, the account identifiers and the data those platforms return that we need to plan, draft, publish and report. We never see or store your passwords for those platforms.
• Support and sales: anything you send us by email, chat or on a call, including information you choose to share during support calls.

Information we collect automatically

• Usage data: pages viewed, features used, approvals made, timestamps, referring URL, and error logs.
• Device data: IP address, browser type and version, operating system, screen size, language, and cookie or local-storage identifiers.

Information from other sources

• Your public website and public web pages we read (via Firecrawl) to understand your positioning, products and audience.
• Public information about competitors and prospects that our Competitor and Outbound agents gather from public sources so they can research and draft for you. This may include the business contact details of third parties. See “Third-party data our agents process” below.
• Payment status from Stripe (whether a payment succeeded, the last four digits of the card, expiry date). Full card numbers never touch our systems.

Under the UK GDPR we need a lawful basis for each use of personal data. Ours are:

We do not sell personal data. The Meta Ads workspace uses platform data to provide the account reporting and approved actions you request; its reporting flow does not use that data to train or prompt an AI model.

Website analysis and drafting features send relevant website content, briefs and prompts to the providers used for those features. The Meta Ads workspace displays account data and reporting separately from these AI features. Specifically:

• Enabled text drafting and research features use Anthropic’s Claude models. Provider retention and processing depend on the applicable service configuration and terms.
• Enabled image-generation features send creative prompts and relevant brand assets to fal.ai.
• Website reading is performed by Firecrawl on public URLs only. We do not read pages behind a login.

Autopilot is disabled in the current Meta Ads workspace. Reading reports does not change your ads. Creating a campaign through this workspace requires review and explicit approval of the exact action, and creates it in a paused state. The workspace does not send its Meta account metrics to an AI model.

When you connect Meta Ads, we obtain an OAuth access token, your Meta user identifier and account label, granted permissions and token expiry details. Tokens are encrypted before storage. We store connection metadata and the ad account identifiers you select for your workspace in Supabase.

On your request, our server reads accessible ad accounts and, for selected accounts, campaigns, ads, creative metadata and performance insights from Meta. Reports and creative previews are returned to your browser to display in your workspace. This can include account names and currency, ad text and image URLs, delivery status, impressions, clicks and spend. The report view does not save a separate copy of the full insights response in our database.

We retain action approval records, including the exact requested inputs, account identifiers and decision, and connector audit events for operation and review. Vercel processes application requests; Supabase stores account, connection and approval records. Meta receives API requests needed for the actions you request. Creative preview images are loaded from the image URLs returned by Meta. These workspace reports are not sent to an AI provider by the Meta Ads workspace.

Disconnecting removes the stored connection and requests revocation at Meta. It does not delete your Meta campaigns or erase existing approval and audit records. See data deletion instructions to request removal of Meta-sourced data held by BuzzBomb.

Some agents work with personal data about people who are not our customers: the prospects your Outbound agent researches, people who reply to your posts, or named individuals at competitors. For that data you are the controller and we are your processor. You are responsible for having a lawful basis (typically legitimate interests for B2B outreach), honouring opt-outs, and complying with PECR and the rules of the platforms you connect.

Availability of a connected platform does not mean automated outreach or publishing is enabled. Contact us to request access to or removal of third-party personal data held in a workspace. These requests require an assessment of the data and the relevant customer’s instructions.

If you are one of these people and want to know what a BuzzBomb customer holds about you, contact that customer directly, or email privacy@buzzbomb.com and we will pass your request on.

The following providers support BuzzBomb features. Which providers receive data depends on the features you use and the services configured for them. The Meta Ads workspace uses Vercel for application hosting, Supabase for authentication and storage, and Meta for connected-account API requests.

We may also share data:

• With the platforms you connect (for example LinkedIn or Meta) when you approve a post, reply, ad or message to be published there. Their own privacy policies apply.
• With professional advisers (lawyers, accountants, insurers) under confidentiality.
• With regulators, courts or law enforcement where the law requires, or to protect the rights and safety of BuzzBomb, our users or others.
• With a buyer or successor if BuzzBomb is acquired or merges, in which case this policy continues to apply to your data.

Providers may process data outside the UK. The applicable processing locations depend on the provider and deployment configuration. Contact us for information about the locations and safeguards applicable to your data.

The applicable international-transfer arrangements must be confirmed for each provider. This notice does not represent that a particular adequacy decision, certification or contractual transfer mechanism has been verified for every service listed above.

Account and workspace records remain available while needed to provide your workspace. Disconnecting an integration removes its connection record, including the encrypted token, from the active connection store after the removal succeeds. Provider revocation is attempted separately and may fail.

Disconnecting does not automatically erase approval records, audit events, workspace content or backups. To request deletion of those records or your account, follow our Data Deletion instructions. We assess the scope of your request and any information that must be retained for an applicable legal obligation or dispute, and explain the outcome. We do not promise that backups or third-party copies are erased immediately.

We use a minimal set of cookies and browser storage:

Advertising cookies (Meta Pixel) are only set where we have asked for and received your consent, and you can withdraw consent at any time by clearing your browser storage or emailing privacy@buzzbomb.com. Analytics is used only to understand how BuzzBomb itself is used, not to track you across other sites. You can also block cookies in your browser settings; strictly necessary cookies are needed for the app to work.

OAuth access tokens are encrypted before they are stored. Meta connector requests check the signed-in user’s workspace membership; supported write actions also require an approval for the exact input. Connection and action events are logged for review. Payment card entry is handled by Stripe.

No system is perfectly secure. If we become aware of a personal data breach that is likely to result in a risk to you, we will notify the ICO within 72 hours where required and tell affected users without undue delay.

Under the UK GDPR (and the EU GDPR if you are in the EEA) you have the right to:

• Access the personal data we hold about you and get a copy.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”) where there is no overriding reason to keep it.
• Restrict or object to processing, including objecting to direct marketing at any time.
• Port your data to another provider in a machine-readable format.
• Withdraw consent at any time where consent is our lawful basis, without affecting processing already carried out.
• Not be subject to solely automated decisions with legal or similarly significant effects. BuzzBomb agents draft and recommend; a human (you) approves.

To exercise any right, email privacy@buzzbomb.com from the address on your account. We respond within one month, subject to extensions allowed by law, and we may ask you to verify your identity. Exercising your rights is free unless a request is manifestly unfounded or excessive.

Right to complain

If you are unhappy with how we handle your data, we would like the chance to put it right first: contact privacy@buzzbomb.com. You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. If you are in the EEA you may complain to your local data protection authority.

BuzzBomb is a business tool and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We will post any changes here and update the “Last updated” date. If a change materially affects how we use your personal data, we will email account owners at least 14 days before it takes effect. Continuing to use BuzzBomb after that date means you accept the updated policy.

Privacy requests: privacy@buzzbomb.com
General: hello@buzzbomb.com
Post: [Company legal name], [Registered address]