Privacy Policy

Who is responsible

The controller of the personal data described here is the seller of Buum:

Individual Entrepreneur Boris Zubarev (Georgia), Identification Number 305627952.

Legal Address: Georgia, Tbilisi, Vake district, Leo and Nodar Gabunieb str., N 39, flat N 103.

Support: [email protected].

Your account

You can sign in with a one-time code sent to your email or with your Google account. We keep your email address, your name and the name you prefer to be called by, and the conversations you have with projects so you can return to them. A request for a sign-in code is kept with your email address until about a day after the code expires.

When you sign in with Google, Google shares your name, email address, profile photo and Google account identifier with Buum. We ask only for these basic profile details and get no access to your Gmail, Drive, contacts or any other Google data. We use them to sign you in, link the sign-in to your Buum account and show your name and photo in the product. They are not sold, not used for advertising and not shared with anyone except the processors listed below and, once you subscribe to a project, the owner of that project as described below.

Buum’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Conversations and visits

When you chat on a project’s page, Buum stores your messages and the answers. With each message it also records the date and time and your time zone; your browser languages; the type and model of your device, its operating system and browser with their versions; and your approximate location derived from your IP address — country, region, city and the coordinates of the city centre — together with the number of your internet provider’s network (ASN). For the first message of a conversation it records where the visit came from: the referring site, the page you landed on and any campaign tags in the link.

Buum also records visits to project pages: the pages and cards you open, when, and the same device, location and referral details. These records are tied to an anonymous browser identifier and, once you sign in, to your account.

Before you sign in, you chat as a guest: a guest is an anonymous browser, not a person we know. When you sign in, the conversation you began as a guest moves to your account.

What the project owner sees

The owner of the project whose page you chat on, and the people of their team, can read your conversations with their agent: the questions you ask and the answers you get, earlier conversations included. They see the activity on their page — visits and opened cards with the country, city, device and referring site — but not who you are, unless you subscribe to them.

You subscribe to a project by pressing Subscribe on their page, by sending them a message while signed in, or when a conversation you began as a guest moves to your account as you sign in; the page tells you so before you continue. The owner of a project you subscribe to receives your name and email address and sees when you subscribed, when you were last active and how many messages you sent them, and can export the list of their subscribers. From then on the owner is an independent controller of the contact details they received and handles them under their own responsibility.

You can unsubscribe on the project’s page at any time: the owner of the project then no longer sees your name and email address in Buum. If you message that project again, you are subscribed again. Signing in on its own does not subscribe you and shares your name and email address with no project.

Cookies

Buum sets only the cookies the site needs to work and to count its visits. A guest cookie lets you chat before signing in: it lasts 24 hours from your last use and at most 7 days, and the server keeps only a fingerprint of it, not the value. A session cookie keeps you signed in and expires after 24 hours without use. A visitor cookie holds a random identifier that tells one browser’s visits apart; it lasts 400 days and is renewed when you return. Anti-forgery cookies protect sign-in and forms and last up to 24 hours; the one that binds a sign-in to your browser lasts 30 minutes.

Product analytics (PostHog) keeps its own identifier in your browser for this site only.

IP addresses

Your IP address is used to derive your approximate location and to enforce the message and sign-in limits that protect the service. For the limits it is kept for about a day. To tell the Buum team’s own traffic apart from visitors, your network is kept for 30 days as a keyed fingerprint from which the address cannot be read back. Your IP address also reaches the hosting edge and the bot check (Cloudflare) and is passed to product analytics (PostHog) to derive the location of events.

Product analytics

We measure how the site and project pages are used with PostHog: the pages you open, the buttons you click, technical details such as browser and device, and errors that occur. Sessions may be recorded to show where the product is confusing; what you type and the conversations, names and email addresses on the page are masked before recording. Signed-in users are identified by an internal account identifier, never by email, so product events can be tied together.

The founder call

Booking a call with the founder opens a Cal.com booking. What you enter there — your name, email, the meeting answers and the chosen time — is submitted to Cal.com and reaches the Buum team as a meeting invitation.

Payments

Orders are processed and payments are accepted by our authorized reseller shown at checkout, which acts as the merchant of record for the purchase. The reseller’s terms of sale and buyer refund policy also apply to the purchase. You enter your card and billing details with the reseller; Buum does not receive or store them. The reseller processes the payment data needed to take the payment, issue receipts and handle refunds.

Why we use it

Account data is used to sign you in and run your conversations. Conversations and their context run the chat, let the project’s agent answer with your place and time in mind, for example the weather for tomorrow where you are, and let project owners understand their audience. IP addresses, limits and visit records protect the service from abuse and keep the chat within its limits. Usage data is used to find defects and improve Buum. None of it is sold or used for unrelated marketing.

Processors

Answers in the chat are generated by AI models reached through OpenRouter, which receives the conversation and the project’s content needed for an answer and passes them to the model provider serving the request. Messages are checked for abuse with OpenAI’s moderation service. When the agent searches the web, its search queries go to Parallel.

Buum runs on DigitalOcean (United States), which hosts the service, its files and backups. Cloudflare serves the site and runs the bot check. Sign-in codes are emailed through Resend. Sign-in with Google is provided by Google. Product analytics, session recordings and error reports are processed by PostHog (PostHog Inc., United States); the browser talks to Buum only, and Buum forwards the data without cookies or credentials. Founder calls are booked through Cal.com and held on Google Meet. Payments are processed by the reseller shown at checkout.

International transfers

The processors listed above process data in the United States and in the other countries where they operate, under their own terms and privacy policies. Your data therefore leaves the country where you live.

How long we keep it

Sign-in code requests and the IP addresses used for limits are deleted about a day after they expire. Sessions are deleted once they expire. Network fingerprints are deleted after 30 days. The AI agent’s working memory of a conversation is deleted 30 days after its last message.

Your account, conversations, visit records have no fixed retention period: they are kept while you use Buum and deleted when you ask us to delete them.

The record that you accepted the Terms of Use and this Privacy Policy (which version, when, and for a purchase, which organization) is kept while your account exists and for as long as a claim about a payment can still be brought against us.

Your choices

Write to [email protected] to ask what account, conversation or usage data we hold, to correct it, or to have your account and its data deleted. You can unsubscribe from a project on their page at any time, and remove Buum’s access to your Google account in your Google Account settings under third-party connections. Cancelling the meeting in Cal.com withdraws a booking.

Changes

The version of this policy published on this page is the one in force.