Privacy Policy

Bubblerock LLC (BubbleRocks)
Last updated: October 11, 2026

This Privacy Policy explains what information Bubblerock LLC, a Wyoming limited liability company doing business as BubbleRocks ("BubbleRocks," "we," "us," or "our"), collects when you visit https://bubblerocks.dev (the "Site") or use our done-for-you IT services (the "Services"), how we use it, and the choices you have. Effective date: October 11, 2026.

1. Information we collect

Information you give us.

Contact information: your name, email address, business name, phone number (if you provide it), and anything else you include when you email us.
Project information: your goals, deadlines, requirements, website content, logos, text, images, code, configuration details, and other materials you send so we can quote and do the work.
Access credentials: to do the work, you may share logins, API keys, DNS or domain registrar access, hosting or cloud account access, email account settings, or similar credentials ("Credentials"). See Section 6 for how we handle them.
Billing information: your billing name, email, and address, and the details of what you purchased.

Payment information. Payments are processed by Stripe, Inc. ("Stripe"). When you pay, your card or bank details go directly to Stripe. We do not see or store your full card number. Stripe shares limited information with us, such as your name, email, billing address, the last four digits and brand of your card, and payment status. Stripe's use of your information is governed by the Stripe Privacy Policy.

Information collected automatically. Like most websites, our Site and the service providers that host and protect it may automatically collect basic technical information, such as IP address, browser type, device type, pages visited, referring page, and date and time of visit. This is used for security, troubleshooting, and understanding how the Site is used.

Cookies and analytics. The Site may use cookies or similar technologies that are needed for it to work and be secure (for example, cookies set by our content delivery or security provider), and may use privacy-respecting analytics to count visits and see which pages are useful. Stripe may set cookies on its own checkout pages for fraud prevention. We do not sell data collected through cookies, and we do not use it for cross-site advertising. You can block or delete cookies in your browser settings; essential features may stop working if you do.

2. How we use your information

To respond to your emails, prepare quotes, and confirm scope in writing.
To perform the Services you purchased, including building, deploying, configuring, maintaining, and supporting your website, services, email forwarding, and automations.
To process payments, send receipts and invoices, and manage Maintenance subscriptions.
To communicate with you about your project, your account, and changes to our terms or policies.
To keep the Site and Services secure, prevent fraud and abuse, and fix problems.
To keep business, tax, and accounting records and comply with legal obligations.
To enforce our Terms of Service and protect our legal rights.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use your project materials or Credentials for any purpose other than doing the work you asked for.

3. How we share information

We share information only as needed to run our business and provide the Services, including with:

Payment processing: Stripe, to process payments and subscriptions and to prevent fraud.
Infrastructure and security: providers such as Cloudflare (DNS, content delivery, HTTPS, and security) and website or application hosting providers.
Email and productivity tools: email providers and similar tools we use to communicate with you and store project files.
Providers you choose: when the work requires it, we will enter information into your own accounts with third parties (for example, your domain registrar, hosting provider, or email provider). Those providers handle the information under their own policies.
Legal and safety: when required by law, subpoena, or court order, or when reasonably necessary to protect the rights, property, or safety of BubbleRocks, our customers, or others.
Business transfers: if BubbleRocks is involved in a merger, sale, or transfer of assets, information may be transferred as part of that transaction, subject to this Policy.

Our service providers may only use your information to perform services for us or as described in their own privacy policies.

4. How long we keep information

Credentials: only for as long as needed to complete the project or, for Maintenance customers, while the subscription is active. See Section 6.
Project information and communications: generally for the duration of the project and up to 3 years afterward, so we can support you, answer questions, and handle disputes, unless you ask us to delete it sooner and we are not required to keep it.
Billing and transaction records: as long as required for tax, accounting, and legal purposes (typically up to 7 years).
Website technical logs: for a limited period, as set by our hosting and security providers.

5. Security

We use reasonable administrative, technical, and physical safeguards to protect information, such as access-controlled accounts, multi-factor authentication where available, encrypted connections (HTTPS), and limiting access to what each project needs. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a security incident that affects your personal information, we will notify you as required by law.

6. How we handle your access credentials

Least access: where possible, please give us a separate user, delegated, or limited-permission account (for example, a team member or collaborator invite) rather than your main password. We will tell you what level of access a task needs.
Secure sharing: please avoid sending passwords in plain email when a safer option is available. We can suggest a password manager share, a one-time secret link, or an account invitation.
Use limited to your project: we use Credentials only to perform the work you approved, and we do not share them with anyone except as needed to perform that work or as required by law.
Storage: we store Credentials in a password manager or other encrypted storage, not in plain-text notes.
After the project: when a one-time project is finished (or when a Maintenance subscription ends), we will delete the Credentials we hold, remove or ask you to remove our access to your accounts, and hand over any accounts, keys, or passwords we created for you. We recommend that you change any passwords you shared with us once the work is done.

7. Your rights and choices

Depending on where you live, you may have the right to:

Know and access the personal information we have about you, and get a copy of it;
Correct information that is inaccurate;
Delete your personal information, subject to legal exceptions (for example, records we must keep for taxes);
Opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioral advertising);
Not be discriminated against for exercising these rights.

California residents. The California Consumer Privacy Act, as amended (CCPA), gives California residents the rights listed above. In the past 12 months, we have collected the categories of information described in Section 1 (identifiers, commercial information, internet activity information, and project-related information you provide), for the purposes in Section 2, and disclosed them to the categories of service providers in Section 3. We have not sold personal information or shared it for cross-context behavioral advertising, and we do not knowingly sell or share the personal information of consumers under 16. You may use an authorized agent to make a request; we may ask for proof of the agent's authority.

How to make a request. Email hongdihe@bubblerocks.dev with the subject "Privacy Request" and describe what you are asking for. We will verify your request, usually by confirming you control the email address associated with your account or project, and respond within the time required by applicable law (for CCPA requests, generally within 45 days). Residents of other states with privacy laws may make the same requests, and may appeal a decision by replying to our response.

Marketing emails. We do not send marketing newsletters unless you ask for them. If we ever do, you can unsubscribe at any time. We will still send messages about your projects, payments, and account.

8. Children

The Site and Services are intended for businesses and adults. They are not directed to children under 13 (or under 16 where applicable), and we do not knowingly collect personal information from children. If you believe a child has given us personal information, please contact us and we will delete it.

9. Third-party links and services

The Site and the work we deliver may link to or rely on third-party services (such as Stripe, Cloudflare, domain registrars, and hosting providers). We are not responsible for the privacy practices of those third parties, and we encourage you to read their policies.

10. Location of processing

BubbleRocks is based in the United States, and we and our service providers process information in the United States and possibly other countries. The Services are intended for customers in the United States.

11. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page. If the changes are significant, we will take reasonable steps to let active customers know, such as by email.

12. Contact us

Bubblerock LLC (BubbleRocks)
Pittsburgh, PA, USA
Email: hongdihe@bubblerocks.dev