Privacy Policy

Our role in processing personal data

Data protection laws often distinguish between a “controller” (who decides why and how personal data is processed) and a “processor” (who processes personal data on a controller’s behalf, following their instructions). Our role depends on the data in question.

We are the controller of personal data we process for our own purposes: visitors to our website, people who join the waitlist, account holders who open a room, and our communications with you.

We act as a processor for the content inside a customer’s room — the messages, threads, uploads, and member information that a room owner and their members create. The room owner is the controller of that content. If you are a member of someone’s room and have a request about your data in it, please contact that room owner. We will support them in responding, but we generally cannot act on that content on our own. If you were invited to a room but have not yet joined, please ask the person who invited you.

Your data inside a room

Visible to other members. A room is a shared space. When you post a message, reply in a thread, upload a file, or fill in your profile, that content and your basic profile details — such as your display name and the email or identity you signed in with — may be visible to, and discoverable by, other members of the same room.

Room owners and moderators. The owner of a room, and anyone they appoint to help moderate it, controls that room. Depending on their plan, they can view, search, export, and delete content; manage who is a member; remove or restrict members (for example, kick, ban, or slow mode); and, where available, use moderation rules and audit logs. Because the room owner is the controller of this content, please direct any request about your data inside a room to them.

Personal data we collect

The categories of personal data we collect depend on how you interact with us.

Data you provide

• Waitlist information. When you join the early-access waitlist, we collect your email address and the short description you give of what you would use Bamlo for.
• Account information. When you open a room, we collect your email address and the credentials used to sign in. Passwords are never stored in plain text (see Security).
• Billing information. When you subscribe to a paid plan, we collect billing details such as your billing name, billing address, and the plan you are on. Payment card details are collected and processed directly by our payment processor (see Billing and payments); we do not store full card numbers ourselves.
• Room content (as processor). When you use a room, we process the messages, threads, files, and member details that you and others put into it, on behalf of the room owner.
• Support and other communications. When you email us or otherwise contact us, we collect the content of your message and your contact details so we can respond.

Data collected automatically

• Request and log data. When you use our website or product, we automatically collect basic technical data such as your IP address, user agent (browser and device type), timestamps, and the pages or actions involved in a request. We may use your IP address to approximate your general location for security and localization.
• Usage metadata. As you use a room, we generate metadata about how the service is used — for example, which rooms and channels you open, when you sign in, the messages and threads you send, and the types of files you share. We use this to operate the service, power features such as search, and keep rooms secure.
• Waitlist attribution. When you join the waitlist, we record limited first-touch attribution — such as campaign parameters (UTMs), advertising click identifiers, the landing path, and the referring page — to understand how people find us.
• Essential cookies. We use cookies and similar technologies only where they are needed to keep you signed in and to operate the service. We do not use third-party advertising trackers, and we do not sell personal data or use it for cross-site targeted advertising.

How we use personal data

We use personal data to:

• operate the waitlist, confirm submitted email addresses, and send early-access and access updates;
• create and administer accounts and rooms, and provide the features and functionality of the product;
• process payments, manage subscriptions, and handle billing and invoicing for paid plans;
• communicate with you about your account, your use of the service, and support requests;
• maintain the security, integrity, and reliability of the service, and prevent duplicate, fraudulent, or abusive use;
• understand how people find and use the service so we can improve it;
• comply with our legal obligations and enforce our terms; and
• fulfill any other purpose you consent to or that you provide the data for.

How we disclose personal data

We do not sell your personal data. We disclose it only in the following ways:

• Service providers (subprocessors). We rely on a small set of providers to run the service. The website and product run on Cloudflare (Pages hosting, the D1 database, and R2 object storage), confirmation and access emails are sent through Fastmail, and payments for paid plans are handled by our third-party payment processor. These providers process data only as needed to provide hosting, storage, email delivery, and payment processing on our behalf.
• Legal and safety. We may disclose personal data to comply with law or lawful requests, to enforce our agreements, to detect or prevent fraud or security incidents, or to protect the rights, property, or safety of Bamlo, our customers, or others.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction.
• With your consent or direction. We may disclose personal data to others when you ask us to or otherwise consent.

Billing and payments

Paid plans are billed through a third-party payment processor. When you subscribe, you provide your payment card details directly to that processor, which handles them under its own privacy notice; we do not receive or store your full card number. We receive confirmation of payment and limited billing details — such as your billing name, billing address, the last four digits and type of card, and your subscription and payment history — which we use to manage your subscription, issue invoices and receipts, and keep our financial records.

Retention

We keep personal data for as long as it is needed for the purposes described above — to run the waitlist, provide accounts and rooms, send updates, prevent abuse, and keep basic operational records — or for as long as required by law. Unconfirmed, invalid, duplicate, or abusive waitlist submissions may be deleted earlier.

Room content is retained while the room is active and is handled according to the room owner’s instructions. The room owner controls deletion of their content, and deleting content or closing a room may also delete or de-identify the metadata associated with it. After you close your account, we may retain limited data where needed to meet legal obligations, resolve disputes, prevent abuse, or enforce our agreements.

Security

We use reasonable technical and organizational safeguards designed to protect personal data. Connections are encrypted in transit (TLS 1.2+ / HTTPS), and data is encrypted at rest using our cloud provider’s default protections. Account passwords are stored only as hashes using an industry-standard algorithm, never in plain text. Waitlist confirmation tokens are random, expire after 24 hours, and are stored only as SHA-256 hashes. No system can be guaranteed perfectly secure, so we cannot warrant the absolute security of your data.

To report a security issue, email security@bamlo.chat.

Your choices and rights

You can stop receiving promotional emails by using the unsubscribe link in any such message; we may still send service-related messages, such as confirmation or account notices. Where we rely on your consent, you may withdraw it at any time.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights for data we control, email contact@bamlo.chat; we respond to verified requests within 30 days. For data inside a room (where we act as a processor), please contact the room owner. You may also complain to your local data protection authority.

Children’s data

Our services are not directed to children under 13, and we do not knowingly collect personal data from them. Some regions set a higher minimum age for consenting to online services (for example, up to 16 in parts of the European Economic Area); where that applies, our services are intended for individuals who meet that age. If you believe a child below the applicable age has provided us personal data, contact us and we will delete it.

International data

Our infrastructure runs on Cloudflare’s global network, and personal data may be processed in countries other than your own. Where required, we rely on appropriate safeguards for such transfers.

Third-party websites

Our website and product may link to third-party sites or services. This Policy does not cover their practices; please review their own privacy notices.

Updates

We may update this Policy as our website, waitlist, or product changes. When we do, we will revise the effective date above, and for material changes we will provide a more prominent notice. The latest version will always be posted on this page.

Contact us

For questions or requests about this Policy or your personal data, email contact@bamlo.chat. For security reports, email security@bamlo.chat.