Skip to content
Bubba Startup — Powered by Productized OS
Legal

Privacy Policy

What we collect when you apply, why we hold it, how long we keep it, and the rights you have over it.

Last updated 10 August 2026

1. Who we are

Bubba Startup ("we", "us") operates bubbastartup.com and the founder portal. This policy explains what personal information we collect, why we collect it, how long we keep it, and what rights you have over it.

If you have any question about this policy or want to exercise a right described in it, contact hello@bubbastartup.com.

2. What we collect

When you submit an application, we collect what you enter in the form:

  • Your name, email address, phone number, and country or city
  • What you are building, your current stage, what best describes you, your budget readiness and timeline, and the program you are applying for
  • Your main blocker, a description of your idea or opportunity, and — optionally — a short description of your background
  • A record that you accepted the Terms and Privacy Policy, with the date and time
  • Technical data sent by your browser with the submission: your IP address and user-agent string

If you are accepted and join the program, we additionally hold:

  • Your portal account: name, email, a securely hashed password, role and account status, timezone, and the time of your last sign-in
  • Session records so you stay signed in — these store only a hash of the session token, never the token itself, together with expiry, IP and user-agent
  • Your enrollment record: program dates, stage progress and deadlines, and pause or extension history
  • A payment ledger: the events recorded against your enrollment, such as amount, currency, method, and an invoice or wire reference
  • Your stage submissions: the notes and links you submit for review, and your mentor’s feedback
  • Internal administrative notes made by our team about your enrollment
  • An audit log of significant actions on your record, used for security and accountability

3. Why we use it, and our lawful basis

Application data is used to review your application and to contact you about the program. Our basis is your consent, given when you submit the form, and our legitimate interest in assessing applicants for a program we operate.

Once you join, we use your data to deliver the program you paid for, to run the portal, to track your stage progress, and to administer payment. Our basis is performance of our agreement with you.

We use security and audit data — session records, IP addresses, the audit log — to keep accounts secure, detect misuse and investigate incidents. Our basis is our legitimate interest in operating a secure service.

We may keep records where we are required to for legal, tax or accounting reasons. Our basis is compliance with a legal obligation.

4. What we do not do

  • We do not sell, rent or trade your personal information
  • We do not use your data for advertising or share it with advertising networks
  • We do not use your application content to build a mailing list you did not ask to join
  • We do not make automated decisions with legal or similarly significant effects — every application is reviewed by a person
  • We do not disclose the substance of your venture outside the team delivering your program

5. Who can see it

Access is limited to the Bubba Startup team members who need it to review applications and deliver the program — including your assigned mentor.

Our infrastructure providers necessarily process data on our behalf: the hosting provider that runs our server, and our domain and certificate providers. They act on our instructions and do not use your data for their own purposes.

We may disclose information where we are legally required to, or where necessary to establish, exercise or defend legal claims.

6. Where it is stored, and how it is protected

Application and program data is stored in our own database on a server we control, not in a third-party CRM. Data may be processed in a country other than yours; where that happens we rely on appropriate safeguards.

The site is served over HTTPS. Passwords are stored only as salted hashes and are never recoverable in plain text. Session and invite tokens are stored only as hashes. Administrative areas sit behind separate authentication, and significant actions are recorded in an audit log.

No system is perfectly secure, but we work to keep your data safe and will notify you and any relevant regulator where we are required to after a breach affecting your data.

7. How long we keep it

Applications that are not accepted are kept for up to 24 months so we can recognise a re-application and evidence how a decision was made, then deleted — or deleted sooner on request.

Records of founders who join the program are kept for the duration of the program and for up to 7 years afterwards, to meet accounting and legal obligations and to support alumni.

Session records expire automatically. Audit records are retained for security and accountability purposes.

8. Your rights

Depending on where you live, you have rights over your personal information. In practice we extend the following to everyone who contacts us:

  • Access — ask for a copy of the personal information we hold about you
  • Correction — ask us to fix anything inaccurate
  • Deletion — ask us to delete your data, subject to records we must keep by law
  • Restriction and objection — ask us to stop or limit a particular use
  • Portability — ask for your data in a portable format
  • Withdraw consent — withdraw consent at any time, without affecting processing already carried out
  • Complain — raise a complaint with your local data protection authority

To exercise any of these, email hello@bubbastartup.com from the address you applied with, or tell us which address you used. We will respond within 30 days. We may ask you to confirm your identity before we act on a request.

9. Cookies

We do not use advertising or third-party tracking cookies, and we do not run third-party analytics that profile you across sites.

The portal sets a single essential cookie to keep you signed in after you log in. It is strictly necessary for the portal to function and is cleared when you sign out or when the session expires. The public marketing pages set no cookie of their own.

10. Children

The program is intended for adult founders. We do not knowingly collect personal information from anyone under 18. If you believe a minor has submitted an application, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the program develops. The date below shows when it was last updated, and material changes will be notified to active participants.

This policy describes our actual practice. If anything here is unclear, or you want to know exactly what we hold about you, ask us — we will tell you.