Draft, pending legal review by a qualified Australian lawyer. Not yet effective.
Legal
Privacy Policy
Operated by LOGIX 26 PTY LTD (trading as BubbaChat), ABN 71 649 099 730, ACN 649 099 730.
Last updated: 20 June 2026. Effective: 20 June 2026
1. Who we are
LOGIX 26 PTY LTD (ABN 71 649 099 730, ACN 649 099 730), trading as BubbaChat, operates the BubbaChat mobile application, web application, and associated services (“Service”). Our contact for privacy matters is:
Email: [email protected]
Postal address: PO Box 502, Caloundra QLD 4551
2. What this policy covers
This policy explains how we collect, use, disclose, store, and protect personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It also addresses obligations under the Spam Act 2003 (Cth) and, for users outside Australia, the EU General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA).
3. Information we collect
3.1 Account information
- First name, last name, email address (collected at sign-up via Supabase Auth)
- Password (hashed by Supabase Auth; we never store plaintext passwords)
- Subscription status and billing cycle (via Stripe; we do not store full card numbers)
3.2 Baby profiles
- Baby's first name, middle name, last name, date of birth
- Multiple babies may be associated with one account
3.3 Content you create
- Photos, videos, and other media files you upload
- Post titles, captions, and text
- Comments and likes
3.4 Usage and technical data
- Device type, operating system, app version (via the Flutter mobile app)
- IP address and timestamp of API requests (Cloud Run logs, retained for 30 days)
- Push notification token, if you grant permission, stored against your account
3.5 Payment data
Billing email and subscription status (via Stripe). Stripe stores payment card data on our behalf under PCI DSS; we only receive a masked card reference and subscription identifiers.
3.6 Information about other people
When you create a baby profile and invite family members, you provide names and email addresses of third parties. You are responsible for ensuring you have their permission to share this information. We process it solely to provide the Service.
4. Sensitive information
Photos and videos of babies and children are sensitive information under Australian law and are treated with the highest level of protection. We do not use this content for any purpose other than delivering the Service to you and the members you explicitly authorise.
5. How we collect information
- Directly from you at sign-up, when you create a profile, upload media, or contact us
- From your device via the mobile app (camera/photo library, only when you grant permission)
- From third parties: Supabase Auth when you authenticate; Stripe when you subscribe
6. Why we collect and use your information
| Purpose | Legal basis (GDPR) | APP principle |
|---|---|---|
| Creating and managing your account | Contract | APP 3, 6 |
| Delivering the Service (feed, media, notifications) | Contract | APP 3, 6 |
| Processing subscription payments via Stripe | Contract | APP 3, 6 |
| Sending transactional email | Contract / Legitimate interest | APP 3, 6 |
| Sending push notifications (with your permission) | Consent | APP 3, 6 |
| Complying with legal obligations | Legal obligation | APP 3 |
| Detecting and preventing fraud or abuse | Legitimate interest | APP 11 |
We do not use your information for advertising, and we do not sell your data.
7. Who we share information with
| Third party | Purpose | Data shared | Location |
|---|---|---|---|
| Supabase | Authentication, database, media storage | Account data, all uploaded content, session tokens | Sydney, AU (ap-southeast-2) |
| Google Cloud / Cloud Run | API hosting | API request logs | Sydney, AU (australia-southeast1) |
| Stripe | Subscription billing | Email, subscription status | United States |
| Resend | Transactional email delivery | Name, email address, notification content | United States |
| Google (Firebase Cloud Messaging) | Mobile push notifications | Push token, notification title/body | United States |
We require all sub-processors to maintain appropriate security standards and contractual data protection obligations. We do not share your information with advertisers, data brokers, or any party not listed above, except as required by law.
8. Cross-border data transfers (APP 8)
Some sub-processors (Stripe, Resend, Google Firebase) process data in the United States. Before transferring personal information overseas, we take reasonable steps to ensure these parties are subject to binding privacy obligations at least equivalent to the APPs, including by entering into data processing agreements that incorporate Standard Contractual Clauses (SCCs) where applicable.
9. Data storage and security
All user content and database records are stored in Supabase's Sydney (ap-southeast-2) data centre. We protect your information through TLS encryption in transit, encrypted credentials via GCP Secret Manager, Supabase Row Level Security (RLS) policies, and access controls limiting staff access to production data.
We will notify you and the Office of the Australian Information Commissioner (OAIC) of any eligible data breach under the NDB scheme as soon as practicable after becoming aware of it, as required by section 26WK of the Privacy Act 1988 (Cth).
10. How long we keep your information
| Data type | Retention period |
|---|---|
| Account and profile data | Until account deletion + 30-day grace period |
| Uploaded media (photos/videos) | Until post or account deletion |
| Notification logs | 30 days |
| Stripe billing records | As required by Australian financial/tax law (typically 7 years) |
| Cloud Run API logs | 30 days (Google Cloud logging default) |
| Deleted account data | Queued for hard-delete 30 days after soft-delete |
11. Your rights
Under the Privacy Act and (where applicable) GDPR and CCPA, you have the right to:
- Access your personal information (APP 12)
- Correct inaccurate information (APP 13)
- Delete your account and all associated data (via account deletion in the app)
- Export your data (available in your profile)
- Object to or restrict processing (contact us)
- Withdraw consent for push notifications (via device notification settings)
- Complain to the OAIC at oaic.gov.au if you believe we have breached the APPs
To exercise any right, email [email protected]. We will respond within 30 days.
12. Children's privacy
BubbaChat is designed to share content about babies and children, not for them. We do not knowingly create accounts for children under 13. If you believe a child under 13 has created an account, contact us at [email protected] and we will delete it promptly.
13. Content moderation and Online Safety
BubbaChat provides a moderation mechanism for members to report content. Reported content is reviewed under our Acceptable Use Policy. We comply with our obligations under the Online Safety Act 2021 (Cth).
14. Cookies and tracking
The BubbaChat mobile app does not use advertising cookies or third-party tracking SDKs. The BubbaChat web app (app.bubbachat.au) may use functional cookies required for authentication. No analytics cookies are used.
The BubbaChat marketing site (bubbachat.au) does not currently use analytics cookies. If analytics are added in future, this policy will be updated and a cookie banner will be shown.
15. Changes to this policy
We will notify you of material changes via email or in-app notification at least 14 days before they take effect. Continued use of the Service after that date constitutes acceptance.
16. Contact us
Privacy enquiries: [email protected]
Postal address: PO Box 502, Caloundra QLD 4551
Complaints
If we do not resolve your complaint satisfactorily, you may contact the Office of the Australian Information Commissioner (OAIC): oaic.gov.au Phone: 1300 363 992. GPO Box 5218, Sydney NSW 2001