BumbleB Terms of Service

Thank you for choosing BumbleB. These Terms explain what you can expect from us and what we expect from you.

1. About these Terms

1.1 Who we are. These Terms of Service ("Terms") are an agreement between BumbleB Technologies Pvt Ltd, a company incorporated in India ("BumbleB", “we”, “us”), and the customer that uses the Service ("you"). If you accept these Terms for an organisation, “you” means that organisation.

1.2 What the Service is. Service means BumbleB Crunch: the tracking tag, analytical engine, APIs, dashboards, integrations and documentation we provide. The Service collects behaviour data from your websites through a tracking tag, connects to data you provide, and answers your questions about it in plain language, with charts and tables as supporting evidence.

1.3 Accepting these Terms. You accept these Terms when you create an account, sign an Order Form that refers to them, or use the Service. If you do not agree, do not use the Service.

1.4 Other documents that form part of these Terms. The following are part of your agreement with us:

• any Order Form — a signed order form or other ordering document that you and we agree to and that refers to these Terms; and
• the DPA — our Data Processing Agreement, which applies to every customer, paid or free and is incorporated into these Terms by reference.

Our Privacy Policy explains how we handle personal data as a controller. Our How we use your data page explains our data commitments in plain language. Where that page and these Terms differ, these Terms apply.

1.5 Which document wins. On data-protection matters, the DPA prevails over these Terms and the Order Form, unless an Order Form expressly says that it overrides a specific clause of the DPA. On other matters, the Order Form prevails over these Terms. An Order Form may also name a different BumbleB entity and a different governing law. Where it does, that entity is “we” for your agreement, and the law and dispute terms in the Order Form replace Section 19.

1.6 Defined terms. Capitalised terms are defined where first used and collected in the Glossary in Section 23.

2. Who can use the Service

2.1 Business use. The Service is for business use. It is available to organisations and to individuals who verify that they own or control the websites they analyse. It is not a consumer product.

2.2 Age. Individuals must be at least 18 years old to create an account or to be a User.

2.3 Authority. If you accept these Terms for an organisation, you confirm that you have authority to bind it.

2.4 Approval before the tag goes live. We may ask you to verify your domain and confirm your responsibilities under Section 6 before we activate a tracking tag. We may decline an account or a website for a reasonable reason, such as a failed verification or a breach of Section 7.

2.5 Your account and Users. Users means the individuals you allow to use the Service under your account. You are responsible for all activity under your account, including your Users' activity and their compliance with these Terms. Keep passwords and API keys confidential, and tell us promptly at security@bumbleb.co if you suspect unauthorised access.

2.6 Moving an individual account into an organisation. If your individual account joins an organisation’s account, your connected data sources, Outputs and account history move under that organisation’s control. The organisation then becomes responsible for that data under Section 6, and you become one of its Users.

3. The Service

3.1 Conclusions grounded in your data. The Service delivers a plain-language answer to your question, with charts and tables as the evidence beneath it. Outputs support your decisions; they do not make them (Section 8).

3.2 Availability. We aim for 99.5% availability each calendar month, not counting scheduled maintenance. We schedule maintenance to keep disruption low and give advance notice of planned downtime where we can. Any service credits or enterprise service levels are set out in your Order Form or a separate service-level addendum.

3.3 Changes to the Service. We improve the Service over time and may add, change or remove features. If we remove a feature that is material to your paid plan, we will give you at least 30 days’ notice. If the change materially reduces what you paid for, you may end the affected plan and receive a refund of prepaid fees for the unused period.

3.4 Third-party services. If you connect the Service to third-party products, such as your data warehouse or tag manager, your use of those products is governed by your agreement with their provider. We are not responsible for them.

4. Fees and payment

4.1 The billable unit. We charge per Answered Question: a question submitted to the Service that returns an answer, excluding errors and clarification turns. Your plan may also include a subscription fee, seat fees or a usage allowance.

4.2 Plans and invoices. Your plan, prices, billing cycle and currency are set in your Order Form or online checkout. Unless an Order Form says otherwise, you pay in advance and fees are non-refundable except as these Terms provide.

4.3 Taxes. Fees do not include taxes. You pay applicable taxes, such as GST, other than taxes on our income. If you must withhold tax by law, tell us, and we will work with you on the paperwork so that we receive the full fee or you provide a valid withholding certificate.

4.4 Late payment. Overdue amounts may carry interest at 1% per month, or the maximum the law allows if lower. If an undisputed amount is more than 30 days overdue, we may suspend the Service under Section 16 after giving you at least 10 days’ written notice.

4.5 Disputed invoices. Tell us about a disputed charge in good faith within 30 days of the invoice date. You must pay the undisputed part on time while we resolve it together.

4.6 Free trials and free plans. A free plan needs no payment card and never turns into a paid subscription unless you choose to upgrade. These Terms apply in full to free trials and free plans, including every data commitment in Section 9. If a free trial ends without moving to a paid plan, we treat that as the end of your agreement for the purposes of Section 16.5.

4.7 Renewal and price changes. Unless your Order Form says otherwise, plans renew automatically for the same term unless you cancel before renewal. We will give you at least 30 days’ notice of a price increase, which applies from your next renewal. You may cancel before it applies.

5. Ownership and licences

5.1 You own your Customer Content. As between you and us, you own your Customer Content, including Outputs. To the extent we have any rights in Outputs, we assign them to you. Outputs may not be unique, and the Service may produce similar Outputs for other customers.

5.2 Your licence to us. You give us a non-exclusive, worldwide licence to host, copy, process and display Customer Content only to provide, secure and support the Service for you, as these Terms and the DPA describe.

5.3 We own the Service. We own the Service and all related technology, software, models and materials, and we own Usage Data. We control Account Data and handle it as our Privacy Policy describes. We grant you a non-exclusive, non-transferable right to use the Service during your subscription, under these Terms. We reserve all rights we do not expressly grant.

5.4 Feedback. Feedback means suggestions and ideas about the Service that you or your Users give us. You give us a perpetual, irrevocable, worldwide, royalty-free licence to use Feedback for any purpose, without obligation to you. Feedback does not include Customer Content. A Submitted Conversation is not Feedback and is covered only by Section 9.4.

6. Your responsibilities

6.1 You control your Customer Content. For Customer Content, you are the controller (under the GDPR), the Data Fiduciary (under India’s Digital Personal Data Protection Act 2023) or the business (under US state privacy laws). We act as your processor or service provider, on your instructions, as set out in the DPA.

6.2 Lawful basis and notices. You are responsible for having a lawful basis, and all notices and consents required by law, for the Customer Content you give us or ask us to collect. This includes Visitor Data. You will not give us data you are not permitted to share.

6.3 Tracking tag and cookie consent. You decide where the tracking tag is installed and how it is configured. You are responsible for:

• showing a compliant cookie or consent banner where the law requires one;
• getting valid consent for non-essential tracking where the law requires it; and
• telling your visitors, in your own privacy notice, that you use the Service.

We collect only what your configured tag sends. We honour the consent signals the tag receives, including Global Privacy Control and “necessary only” choices, and we do not collect beyond what you have authorised.

6.4 Requests from your visitors. Your visitors’ requests to access, correct or delete their data are addressed to you, as their controller. We help you respond, as the DPA describes.

6.5 No properties directed at children. We do not onboard websites or apps directed at children. You confirm that no property you track with the Service is directed at children under 18. If we find that one is, we will stop collecting data from it, delete the data collected from it, and may end the Service for that property without liability.

6.6 Sensitive uses. Do not present Outputs to others as professional legal, medical, financial or tax advice without your own review and disclaimers.

7. Acceptable use

7.1 You must not, and must not allow anyone else to:

• use the Service in breach of any law or anyone’s rights;
• upload malware, or content you have no right to share;
• reverse-engineer, decompile or try to extract the source code, models or prompts behind the Service, except where the law allows it despite this restriction;
• use the Service or its Outputs to build, train or improve a competing analytics or AI product;
• resell, sublicense or share access to the Service without our written consent;
• try to access other customers’ accounts or data, or circumvent security, rate or usage limits;
• use the Service to track a property directed at children (Section 6.5); or
• use the Service as a factor in a decision that has legal or similarly significant effects on an individual (Section 8.3).

7.2 If we find a breach, we may remove the offending content or suspend the affected account or property under Section 16.

8. Outputs are conclusions, not decisions

8.1 AI can be wrong. The Service produces Outputs using AI, including large language models. Outputs are probabilistic. They may be inaccurate, incomplete or out of date, and the same question may produce different answers.

8.2 We deliver the conclusion; you make the decision. Outputs support your judgment; they do not replace it. Review Outputs, including the supporting charts and tables, before you rely on them, publish them or act on them. Outputs are not legal, medical, financial, tax or regulatory advice.

8.3 No automated decisions about people. The Service does not make automated decisions that have legal or similarly significant effects on any individual, and you must not use it to do so. Outputs are conclusions for a person to consider. The Service is not designed to be a substantial factor in a consequential decision about a person, such as one about employment, education, healthcare, housing, insurance, credit or access to government services.

8.4 No profiles of individuals. We do not build profiles of individual Users or visitors to change how the Service behaves for them.

9. Your data and how we use it

9.1 Three kinds of data. We keep three kinds of data apart:

Inputs means what you or your Users type, upload or connect to the Service. Outputs means what the Service writes back: answers, explanations, charts, tables and generated queries. Visitor Data means what the tracking tag collects about your website visitors. Our sales and customer-success teams see Account Data only: which features your account uses and how much, never what was asked or answered. We do not sell or share Customer Content.

9.2 Our promises. These promises apply to every customer, on every plan, in every country.

No training. BumbleB will not use Customer Content to train, retrain or fine-tune any AI model, and will not allow any sub-processor to do so. The only exception is a Submitted Conversation, which a user chooses to send us.

Usage Data. BumbleB records how the Service runs — which tools were called, in what order, and whether they worked — without names, account identifiers or the values in your data. We use Usage Data only to operate, secure, measure and improve the Service.

No human reading. BumbleB staff do not read Customer Content to improve the Service. Staff read it only to provide support you ask for, to investigate security or abuse, or when you send us a conversation.

9.3 How we learn from Usage Data. Improving the Service includes training our own service components, such as the part that decides which tool to call. Usage Data is the only data derived from Customer Content that we use to train anything. We never sell or share Usage Data. Automated processes may re-check conversations within their 90-day retention period; they record labels only, and no person reads the conversations. Individual users in India are asked first, for both Usage Data and re-checks.

9.4 Submitted Conversations. A Submitted Conversation is a conversation a user chooses to send us, using “Report a bug”. Before it is sent, the user is shown how we will use it. When a user sends one, our team may read it and use it to improve the Service, including to train our models. We mask Visitor Data in it before anyone reads it. A user can withdraw a Submitted Conversation at any time, and we then delete it and remove it from future improvement work; a model already trained using it is not retrained. Admin control: a company admin can turn off Submitted Conversations for the whole workspace. They are off by default on Enterprise plans.

9.5 Support access. When you ask for help, our support staff may read the relevant Customer Content in place, against a logged support ticket. We do not copy what they read into Usage Data, evaluation sets or training data.

9.6 How long we keep data.

We keep data longer only when the law requires it, for example during a legal dispute. Section 16.5 explains what happens to Customer Content when your agreement ends. Usage Data is not deleted with your account, because it identifies no one.

9.7 Where to find the detail. The DPA sets out our processing terms in full. The Privacy Policy covers Account Data and individual rights. The How we use your data page explains all of this in plain language.

10. Sub-processors

10.1 Who we use. Sub-processor means a third party we engage to process Customer Content on your behalf to deliver the Service. They include our cloud host, our AI model providers and the tracking-tag delivery network. Our sub-processor list names each one, what it does, where it processes data and, for AI model providers, how long they keep prompts and whether zero retention is on.

10.2 Same rules, passed down. Each Sub-processor is bound by written data-protection terms consistent with the protections in the DPA, including no training on Customer Content (Section 9.2), confidentiality, security, and prompt breach notice that lets us meet our own 24-hour commitment in Section 12.4. We remain responsible for their performance.

10.3 New Sub-processors. We give at least 30 days’ notice before adding or replacing a Sub-processor. You can subscribe to the list to receive notice by email. You may object on reasonable data-protection grounds. If we cannot resolve your objection, you may end the affected Service and receive a refund of prepaid fees for the unused period. If a Sub-processor suffers a security incident, becomes insolvent or stops its service, we may replace it with less notice where needed to keep the Service running or your data secure. We will then give notice as soon as practicable and in any case within 5 business days, and your rights to object and to a refund still apply.

11. Confidentiality

11.1 What is confidential. Confidential Information is non-public information one party discloses to the other that is marked confidential or that a reasonable person would treat as confidential. Your Customer Content is your Confidential Information.

11.2 How we each protect it. Each party will use the other’s Confidential Information only to perform under these Terms, protect it with at least reasonable care, and share it only with people who need to know it and are bound by similar duties.

11.3 Exceptions. These duties do not apply to information that is or becomes public through no fault of the recipient, was already known to the recipient, is independently developed, or is rightfully received from someone else. A party may disclose Confidential Information where the law requires, after giving the other party notice where the law allows.

11.4 How long. These duties last for 3 years after your agreement ends, and for trade secrets for as long as they remain trade secrets.

12. Security

12.1 Our safeguards. We maintain technical and organisational security measures, including encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent), role-based access and least privilege, logging and monitoring, secure development, vulnerability management, security testing and staff training. The DPA describes them in more detail.

12.2 Certifications. We do not currently hold SOC 2 or ISO 27001 certification. On reasonable request, once a year, we will share evidence of our security practices.

12.3 Staff access. Access to your sessions is limited to named support, on-call and security staff, tied to a ticket or incident, logged and time-limited. On request, we will tell you whether your sessions were accessed and under which ticket.

12.4 Security incidents. If we become aware of a breach affecting Customer Content, we will tell you without undue delay and within 24 hours of becoming aware. We will tell you what happened, what data is affected, the likely consequences and what we are doing about it, so you can meet your own legal deadlines.

12.5 Your part. You are responsible for securing your own systems, your Users’ credentials and the configuration of your tracking tag.

13. Warranties and disclaimers

13.1 What we promise. We will provide the Service with reasonable skill and care, in line with the documentation and these Terms. If the Service does not meet this promise, tell us and we will use reasonable efforts to fix it. If we cannot, either of us may end the affected plan, and we will refund prepaid fees for the unused period.

13.2 What each party promises. Each party confirms that it has the authority to enter into these Terms and will comply with the laws that apply to it in performing them.

13.3 Disclaimer. EXCEPT AS SET OUT IN THESE TERMS, THE SERVICE AND OUTPUTS ARE PROVIDED “AS IS”. TO THE EXTENT THE LAW ALLOWS, WE DISCLAIM ALL OTHER WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT AND ACCURACY OF OUTPUTS, AND WE DO NOT PROMISE THAT THE SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE.

14. Limitation of liability

14.1 No indirect losses. Neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or data, arising from these Terms, even if told they were possible.

14.2 Liability cap. EACH PARTY’S TOTAL LIABILITY ARISING FROM THESE TERMS IS LIMITED TO THE GREATER OF (A) THE FEES YOU PAID OR OWE US IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM AND (B) US$100.

14.3 Higher cap. For breach of Section 9 (Your data and how we use it), Section 11 (Confidentiality) or the DPA, and for our obligations under Section 15.2 (IP indemnity), the cap in Section 14.2 is doubled. An Order Form may set a different cap.

14.4 What is not limited. Sections 14.1 to 14.3 do not limit liability for gross negligence, wilful misconduct or fraud, your obligation to pay fees, or any liability that the law does not allow us to limit.

15. Indemnities

15.1 Your indemnity. You will defend us against third-party claims, and pay resulting damages and reasonable costs, arising from your Customer Content, your failure to give notices or obtain consents required under Section 6, your use of the Service in breach of these Terms, or your breach of law or third-party rights.

15.2 Our IP indemnity. We will defend you against a third-party claim that your paid use of the Service, as we provide it, infringes that third party’s intellectual property rights, and pay resulting damages and reasonable costs. This does not cover claims arising from your Customer Content, your changes to the Service, or its combination with products we did not provide. If a claim is made or likely, we may get you the right to keep using the Service, change it so it no longer infringes, or, if neither is reasonably possible, end the affected Service and refund prepaid fees for the unused period.

15.3 How claims are handled. The party seeking protection must tell the other party promptly, let it control the defence and settlement, and give reasonable help. No settlement may admit fault for, or impose obligations on, the protected party without its consent.

16. Suspension and termination

16.1 Term. Your agreement starts when you accept these Terms and continues for the subscription term in your Order Form or online checkout. Unless your Order Form says otherwise, subscriptions renew automatically for the same term unless either party gives notice before renewal.

16.2 Ending for convenience. You may close your account at any time. Fees already paid are not refunded unless these Terms or your Order Form say otherwise.

16.3 Ending for breach. Either party may end the agreement if the other materially breaches it and does not fix the breach within 30 days of written notice.

16.4 Suspension. We may suspend all or part of the Service if it is needed to deal with a security risk, if an undisputed amount is overdue under Section 4.4, or if you breach Section 7. We will give notice first where we reasonably can, limit the suspension to what is needed, and restore the Service promptly once the issue is resolved.

16.5 Your Customer Content when your agreement ends. For 30 days after your agreement ends, you may export your Customer Content. After that, we delete it from our active systems within 30 days, and from backups within 90 days. On request, we will confirm deletion in writing. Account Data is kept only for as long as the law requires. Usage Data is kept, as Section 9.6 explains.

16.6 Ending a free plan or free trial. We may end a free plan or free trial by giving you 30 days’ notice, or immediately if you breach these Terms or abuse the Service.

16.7 Survival. Sections 4 (for unpaid fees), 5, 8, 9, 11, 13, 14, 15, 16.5, 19, 21 and 23 survive the end of your agreement.

17. Force majeure

Neither party is liable for delay or failure to perform caused by events beyond its reasonable control, such as natural disasters, war, terrorism, civil unrest, government action, widespread internet or power failures, or failures of third-party hosting not caused by that party. This does not excuse payment obligations. If such an event stops the Service for more than 30 days, either party may end the affected plan, and we will refund prepaid fees for the unused period.

18. Export controls and sanctions

You confirm that neither you nor any of your Users is the target of sanctions that apply to us or to you, or located in a country or region subject to comprehensive sanctions. You will not use the Service in breach of export-control or sanctions laws.

19. Governing law and disputes

19.1 Governing law. These Terms are governed by the laws of India.

19.2 Talk first. If a dispute arises, each party will try in good faith to resolve it through senior representatives for 30 days before starting arbitration.

19.3 Arbitration. Any dispute arising from or relating to these Terms that is not resolved under Section 19.2 will be finally resolved by arbitration administered by the Mumbai Centre for International Arbitration (MCIA) under its arbitration rules in force when the arbitration starts, and under the Arbitration and Conciliation Act 1996. The seat of arbitration is Bengaluru, India. The tribunal will be a sole arbitrator appointed under those rules. The arbitration will be conducted in English.

19.4 Courts. The courts of Bengaluru, Karnataka have exclusive jurisdiction over applications for interim relief and any matter that cannot be arbitrated. Either party may seek urgent interim relief there at any time.

19.5 Your Order Form may differ. An Order Form may name a different BumbleB entity and select a different governing law and forum, as Section 1.5 explains.

19.6 Rights that cannot be waived. Nothing in these Terms takes away any right you or your Users have under mandatory consumer-protection or data-protection laws that apply to you, whatever law governs these Terms.

20. Changes to these Terms

20.1 Material changes. A change is material if it reduces your rights or expands how we use your data. We will give you at least 30 days’ notice of a material change by email and in the product before it takes effect. The notice will say what is changing and when.

20.2 Other changes. We may make changes that are not material, such as clarifications or adding terms for a new country, by publishing a new version with a change log entry. These take effect on the effective date shown in the new version, which is never earlier than the day we publish it.

20.3 If you do not agree. If you do not agree to a material change, you may end your agreement before the change takes effect, and we will refund prepaid fees for the unused period.

20.4 Order Form customers. If you have an Order Form, you stay on the version of these Terms it refers to until your next renewal, unless you accept a newer version earlier. Changes to our Sub-processors follow Section 10.3 whichever version you are on.

20.5 Versions. Each version shows its effective date and last-updated date. Previous versions are archived and linked from the top of this page.

21. General

21.1 Entire agreement. These Terms, your Order Form and the DPA are the whole agreement between us about the Service. They replace earlier discussions and proposals. Terms in your purchase order or similar document do not apply, even if we accept the order.

21.2 Assignment. Neither party may transfer these Terms without the other’s written consent, except to an affiliate or to a successor in a merger, acquisition or sale of substantially all of its relevant business or assets, with notice to the other party.

21.3 Notices. We send notices to the email address on your account. You send legal notices to legal@bumbleb.co. A notice is received when sent, unless the sender receives a delivery failure.

21.4 Independent parties. We are independent contractors. These Terms do not create a partnership, agency or employment relationship.

21.5 No waiver, severability. Not enforcing a term is not a waiver of it. If a court or tribunal finds a term unenforceable, the rest of these Terms still apply, and that term is applied as far as the law allows.

21.6 Publicity. We will not use your name or logo in our marketing without your consent.

21.7 Language. These Terms are written in English. If we provide a translation, the English version applies if they differ, unless the law requires otherwise.

21.8 No third-party beneficiaries. Only you and we have rights under these Terms. No one else may enforce them.

21.9 Electronic acceptance and counterparts. These Terms and any Order Form may be accepted or signed electronically, and an Order Form may be signed in counterparts, which together form one document.

22. Contact us

• Legal — legal@bumbleb.co
• Privacy — privacy@bumbleb.co
• Security — security@bumbleb.co
• India Grievance Officer — Chinmaya Reddy, grievance@bumbleb.co. We resolve grievances within one month, and we support nomination of another person to act for you.

BumbleB Technologies Pvt Ltd, 581, Second Floor, 1st Main Rd, Sector 6, HSR Layout, Bengaluru, Karnataka 560102, India.

23. Glossary