This Privacy Policy applies to Bubuu Inc., and describes how Bubuu Inc. (“Bubuu,” “we,” “us”) collects, uses, shares, and protects personal data when you visit bubuu.ai, use the Bubuu service, or interact with Bubuu where it is made available on a partner website.
This Policy applies globally. Bubuu serves users in Austria and the United States. Region-specific rights and disclosures for the Austrian (GDPR) and for U.S. residents, including California (CCPA/CPRA), are set out in the relevant sections below. By registering for an account or by otherwise using the website, network, application, or services provided by Bubuu (collectively, the “Services”), or accessing any content provided by Bubuu through the Services, you agree to the terms contained in this Privacy Policy.
1. Who We Are and Who Is Responsible
BUBUU is the controller (and, for U.S. purposes, the business) responsible for the processing described in this Policy. At Bubuu, we are committed to protecting the privacy and security of your data. Our users trust us to provide frictionless experiences, to keep their data safe and to protect their privacy, and we’re obsessed with delivering on that promise. We are transparent about the information we have, how we protect and use it, and how users engage with Bubuu from the very beginning—starting with our Privacy Policy below.
Privacy contact: info@bubuu.ai.
Where Bubuu and a partner (for example, a publisher hosting Bubuu on its website) jointly determine the purposes and means of processing, we will document and disclose that arrangement as required. When you request or consent to broker matching, a matched agent generally acts as an independent controller for its own activities and may provide its own privacy notice.
2. Personal Data We Collect
The categories below correspond to the personal data that we collect (categories of personal information identified under the California Consumer Privacy Act (as amended by the CPRA)): identifiers; commercial information; internet or other electronic network activity; geolocation data; audio and electronic information; professional or inferred information; and sensitive personal information. The service supports listing URLs, typed property information, and files you upload, such as photos, documents, floor plans, and PDFs, and may support additional formats, including video, over time.
| Category & examples | How we collect it | Why we use it | Who we share it with |
|---|---|---|---|
| Contact data and identifiers: first name, surname, email address, phone number; online identifiers, cookie IDs, IP address. | You provide it; collected automatically by using Service. | Operate the service, respond to you, broker matching, service follow-up, security, and direct marketing and promotional communications. | Service providers (including email, SMS, and communications providers); matched agents (with your consent). |
| Device, network & usage data: device and browser information, server and request logs, approximate location derived from technical data, pages viewed and interactions, cookie and consent preferences. | Collected automatically. | Operate and secure the website, prevent abuse, analytics. | Hosting, security, and analytics providers. |
| Authentication & session data: login and session identifiers, authentication metadata, session and security data (where login is used). | Collected automatically. | Authentication, session management, security. | Authentication, identity, and security providers. |
| Property & report data: listing URL, property address or location, listing details fetched from a public link, property details you type, files you upload (such as photos, documents, floor plans, PDFs, and, where supported, video), generated report, market and neighborhood information, buyer or seller intent, and budget, affordability, financing, mortgage, tax, or transaction-cost assumptions you provide. | You provide it; fetched from a public listing link you submit or uploaded attachments | Generate AI reports and analysis, broker matching. | AI/model providers; matched agents (with your consent). |
| AI chat & call data: chat messages, prompts and AI responses, AI-generated analysis, AI call transcripts, temporary call audio processed for transcription, scheduling and follow-up information. AI chat and calls are stored summarized. Actual transcript will be deleted after 30 days | You provide it during chat or calls. | Deliver the AI service, transcription, follow-up. | AI/model and AI voice/transcription providers; matched agents (with your consent). |
| Broker-matching data: matched agent details, the data shared with a matched agent, broker-sharing consent and action logs, handoff status, CRM or lead status and notes. | Created by the service; provided by you; received from the matched agent. | Perform broker matching and keep records of it. Legal compliance. | CRM/lead-management providers; matched agents. |
| Support, compliance & security data: support messages, communication history, deletion/withdrawal/opt-out requests, legal and compliance records, anti-abuse and security logs, and records of the terms, notices, and consents shown or accepted. | You provide it; created by the service. | Provide support, comply with law, security, and proof. | Service providers; authorities where legally required. |
3. How We Collect Personal Data
We collect personal data: (a) directly from you, when you chat, submit a listing link, type property information, request a report, request or consent to broker matching, contact support, or sign up for marketing; (b) automatically (where lawful) or with your consent through cookies and similar technologies and from your use of the website; and (c) from public sources, such as the public listing link you submit. Where Bubuu operates on a partner website, we may receive data through that placement, and notice will be provided at the point of collection.
4. Why We Use Personal Data and Our Legal Bases (GDPR)
For users in the EEA and UK, the table below maps each of our processing activities to the personal data involved and the legal basis we rely on for that processing. Our legal basis attaches to what we do with your data — collecting and using it for the activity described — not to the act of collection on its own, so the same data may rely on different legal bases for different activities. Where we rely on consent, you may withdraw it at any time for future processing. This section does not limit Bubuu’s ability to provide the service to users outside the EEA/UK based on the processing described in Section 2.
| Processing | Data | Legal basis | Notes |
|---|---|---|---|
| Website operation and security | Website and device data, logs, security data. | Legitimate interests — Art. 6(1)(f). | We use this to operate, protect, debug, and secure the service. |
| Provide AI chat and generate reports | Listing URLs, typed property data, files you upload (photos, documents, floor plans, PDFs, and, where supported, video), chat data, report data. | Performance of the requested service — Art. 6(1)(b). | AI outputs are indicative and may be inaccurate or limited. |
| Unlock and provide report access | Contact data, report data, browser-based report/session URL, acceptance logs. | Performance of the requested service — Art. 6(1)(b). | Report availability is described in our retention section. |
| Service follow-up about your specific report, property, AI call, broker request, or requested workflow | Contact data, property/report data, follow-up status. | Performance of the requested service — Art. 6(1)(b). | Separate from newsletters, promotions, and general marketing. |
| Broker matching and lead sharing | Contact data, property link/address, report, AI chat transcript, AI call transcript, buyer/seller intent, budget if available, broker-sharing logs. | Your separate request or consent — Art. 6(1)(a). | Not bundled into report unlock or marketing consent. |
| AI call and transcription | Phone number, temporary call audio, transcript, call metadata, property information. | Performance of the requested AI call service — Art. 6(1)(b). | Consent is also requested where required for recording or communications-law reasons — Art. 6(1)(a). |
| Marketing and newsletters | Contact data, marketing consent logs, engagement data, and relevant interaction or lead context. | Consent — Art. 6(1)(a). | Separate from Terms acceptance, report unlock, and broker sharing. You can withdraw or unsubscribe at any time. |
| Non-essential cookies and tracking | Cookie IDs, device data, analytics or marketing identifiers. | Consent — Art. 6(1)(a). | Non-essential cookies/tracking do not load before consent unless an exemption applies. See the Cookie Policy. |
| Create aggregated/anonymized analytics and improvement data; improve products, services, and AI models | Usage data, product/report interaction data, submitted URLs, typed information, uploads, chats, reports. | Legitimate interests in creating aggregated/anonymized data — Art. 6(1)(f). | Truly anonymized data is not personal data and may be shared with research and academic partners and used in published research. Identifiable data is used to train AI models only with your consent. |
| Legal compliance, claims, and consent evidence | Consent logs, acceptance records, support records, compliance data. | Legal obligation — Art. 6(1)(c). | We also rely on legitimate interests (Art. 6(1)(f)) to establish, exercise, or defend claims and keep records. |
| Special-category data you voluntarily provide (including in uploads) | Special-category data, if any. | Explicit consent — Art. 9(2)(a). | In addition to a basis above. Provide such data only if necessary for the requested workflow. |
5. AI Transparency and Automated Decision-Making
Bubuu uses AI chat, AI-supported reports, and may use AI-generated calls. You will be told when you are interacting with an AI system. AI calls collect, structure, and route property information; they do not provide professional advice.
Reports and AI outputs are estimations and for general information only. They are not formal appraisals, expert valuations, or legal, tax, financing, insurance, investment, or brokerage advice. Bubuu does not make solely automated decisions that produce legal or similarly significant effects. Reports, scores, and broker matching are informational and routing tools only and do not guarantee any valuation, financing, agent availability, or transaction outcome. You can request human follow-up where available. Any output from the Services is informational only and does not encompass a decision, as the user makes such decisions on their own volition.
AI-generated call and message communication will be conducted with your prior consent only. For details see section 15 below.
6. How We Share Personal Data
We share personal data with the following categories of recipients, only as needed:
- Service providers / processors who act on our behalf under contract, including: hosting and infrastructure; AI/model providers for chat, analysis, recommendations, and report generation; AI voice, speech, and transcription providers; CRM and lead-management providers; communications providers (email, SMS, phone, voice, WhatsApp); authentication, identity, and security providers; and analytics, support/chat, and cookie-consent providers.
- Matched real-estate agents, only after a separate consent or action from you (to the extent lawfully required). After handoff, the agent generally becomes an independent controller for its own contact, advice, brokerage, transaction, and compliance activities.
- Partner / publisher websites where Bubuu is made available, where you direct or consent to such sharing (see Section 7).
- Authorities, regulators, or advisors where required by law, to protect our rights, or in connection with a corporate transaction.
Before you consent to broker matching, we describe the recipient category as one or more matched local real-estate agents; the exact agent identity may not be shown until after matching. After your consent or action, we may share: name and surname; email address; phone number; property link or address; the generated report; the AI chat summary; the AI call summary; buyer or seller intent; and budget or affordability information, where available. Matched agents may contact you about the relevant property or request by the channels you permit.
Confirmed public-user relevant providers include:
| Provider | Purpose |
|---|---|
| Freshworks | CRM, lead management, client tracking, communication history, lead status, and notes |
| Google / Gemini API | AI chat, recommendations, property/report analysis, lead handling, and AI-generated report support |
| Clerk | Authentication, identity, session management, and login methods including Google identity or other login methods |
| Twilio | Phone, SMS, voice, messaging, call routing, and related communications workflows |
| Vercel | Frontend deployment, hosting/deployment infrastructure, request handling, edge/runtime services, and logs |
| ElevenLabs | AI voice, AI calls, speech processing, and call transcripts |
| Posthog | Analytics, performance measurement, error tracking where used |
| Hetzner Online GmbH | Infrastructure hosting, dedicated and cloud server provision, data storage, and server management. |
| Redpanda Data, Inc | Event streaming, message queueing |
| Cloudflare | Content Delivery Network (CDN), DNS management, DDoS protection and SSL/TLS encryption |
| Mapbox | Interactive map rendering, geolocation services, geocoding (converting addresses to coordinates), routing, and spatial data visualization |
7. Sale or Sharing of Personal Information (U.S. State Privacy Laws)
Bubuu does not sell your personal information for money in the conventional sense. Where Bubuu shares your data with a matched agent or with a partner or publisher, it does so at your direction or with your consent. A disclosure made at your direction is treated as a consumer-directed disclosure under U.S. state privacy laws, rather than a “sale.”
Some of these disclosures may nonetheless be considered a “sale” or “share” under the CCPA/CPRA or similar laws, including where a partner or publisher pays Bubuu in connection with making the service available. Where that is the case, we provide a “Do Not Sell or Share My Personal Information” mechanism, honor opt-out preference signals such as the Global Privacy Control (GPC), and limit such disclosures accordingly. We do not knowingly sell or share the personal information of consumers under 16 years of age.
Where Bubuu operates on a partner or publisher website, Bubuu and that partner may act as separate or joint controllers/businesses depending on the arrangement, and notice will be provided at the point of collection.
8. Sensitive Information
Bubuu does not request special-category or sensitive personal data, such as health, biometric, religious, political, trade-union, or sexual-orientation data. You should not submit sensitive data unless Bubuu specifically asks for it and it is necessary for the requested workflow. If you voluntarily provide it (for example, in chat, calls, or financial or affordability details), we process it only as needed for the requested service, support, security, legal compliance, or proof, and, in the EEA/UK, on the basis of your explicit consent. U.S. residents may have the right to limit our use of sensitive personal information, including certain financial and precise-geolocation data, as described in Section 11.
9. Cookies and Similar Technologies
We use cookies and similar technologies for website operation, security, preferences, analytics, support/chat, authentication, and marketing where implemented. Non-essential cookies and tracking technologies require consent unless an exemption applies. For details and to manage your choices, see our Cookie Policy. We honor recognized opt-out preference signals (such as the Global Privacy Control) where required.
10. International Data Transfers
Bubuu operates across the EEA, the UK, and the United States, and personal data may be transferred in both directions — from the EU/EEA to the United States and from the United States to the EU/EEA — as well as to other countries where our service providers or their subprocessors operate.
For transfers of personal data out of the EEA or the UK, we rely on an appropriate safeguard, such as: an adequacy decision; the EU-U.S. Data Privacy Framework (and UK Extension / Swiss-U.S. framework) where the recipient is certified; or the European Commission's Standard Contractual Clauses (with the UK Addendum or IDTA, as applicable), supported by a transfer impact assessment and supplementary measures where needed. You may request information about the safeguards we use by contacting info@bubuu.ai.
11. Your Privacy Rights
EEA / UK residents (GDPR)
Subject to legal conditions, you may have the right to: access your personal data; correct inaccurate data; request erasure; restrict processing; data portability; object to processing based on legitimate interests; withdraw consent at any time for future processing; and lodge a complaint with a supervisory authority.
In Austria, the supervisory authority is the Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, Austria (dsb.gv.at). You may also contact the authority in your country of residence.
U.S. residents (California and other states)
Subject to legal conditions, you may have the right to: know and access the personal information we collect, use, and disclose; delete your personal information; correct inaccurate information; opt out of any “sale” or “sharing” of personal information; limit the use of sensitive personal information; and not receive discriminatory treatment for exercising your rights. California residents may also use the “Shine the Light” right regarding disclosures for third-party direct marketing.
How to exercise your rights
Because Bubuu operates as an online service, you may submit requests by email to info@bubuu.ai, or by using any “Do Not Sell or Share My Personal Information” or cookie-preference tools we provide. We may need to verify your identity before responding. You may use an authorized agent to submit a request on your behalf, with proof of authorization. We will respond within the timeframes required by law (generally one month under the GDPR and 45 days under U.S. state laws, each extendable as permitted). Where we decline a request, you may appeal by replying to our decision.
12. How Long We Keep Data
We keep personal data only as long as needed for the purpose for which it was collected, unless a longer period is required or permitted for legal, compliance, security, opt-out, or proof reasons. Reports and chat or call content are retained for the period needed to deliver and support the service and to evidence consents; anonymized or aggregated data may be kept longer.
13. Children
The Bubuu service is for individuals aged 18 or older. We do not knowingly provide the service to, or collect personal data from, children, and we do not knowingly sell or share the personal information of consumers under 16.
14. Third-Party and Partner Websites
Where Bubuu is embedded on or links to a partner, publisher, or other third-party website, that party's own privacy practices govern its processing. We encourage you to review the privacy notice of any site on which you interact with Bubuu or to which we refer you, including a matched agent's notice.
15. Telephone & SMS
If you provide your phone number and opt in, we may contact you by call or text message — including by automated dialing systems, prerecorded or artificial voice, and AI-generated voice — for service provision, marketing and promotional purposes. We obtain your prior express written consent before sending such marketing, and consent is not a condition of using the Bubuu limited service or receiving a report.
Message frequency varies. Message and data rates may apply. You can opt out of marketing texts at any time by replying STOP, and reply HELP for help, to the extent applicable. You can opt out of marketing calls by telling us during the call or by contacting info@bubuu.ai. We will honor opt-out requests promptly. We maintain an internal do-not-call list and honor applicable do-not-call and quiet-hours rules. Service and transactional messages tied to your requests may still be sent.
16. Updates to This Policy
We may update this Policy to reflect changes in law, technology, vendors, features, or business processes at will without notice. The current version will be available on bubuu.ai.
17. Contact Us
For privacy or support requests, contact us at info@bubuu.ai.
540 Graham Avenue, Brooklyn NY 11222