Privacy Policy

Introduction

Welcome to Bulk Studio. We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, share, and protect your data when you use our manufacturing operations platform and related services.

At Bulk Studio, we believe that transparency and user control are fundamental to building trust. This policy outlines your rights under the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other applicable data protection laws worldwide.

Information We Collect

We collect various types of information to provide and improve our services. The data we collect falls into several categories:

Account Information

When you create an account with Bulk Studio, we collect:

• Contact Information: Your name, email address, phone number, and company name
• Account Credentials: Username, password (encrypted), and security preferences
• Profile Information: Job title, department, and role within your organization
• Company Information: Business name, industry type, company size, and billing address

Payment Information

When you subscribe to our services, payment information is collected and processed by our payment processor, Stripe. We do not store complete credit card numbers on our servers. We retain only:

• The last four digits of your payment card for identification purposes
• Card type and expiration date
• Billing address and transaction history
• Payment method preferences

Manufacturing and Operational Data

As a manufacturing operations platform, we process data that you input into our system. This includes:

• Production Metrics: Output quantities, cycle times, efficiency data, and performance indicators
• Quality Data: Inspection results, defect rates, quality control measurements, and compliance records
• Employee Information: Worker IDs, shift assignments, attendance records, and performance data
• Safety Records: Incident reports, near-miss documentation, and safety compliance data
• Equipment Data: Machine status, maintenance logs, and asset information
• Work Instructions: Procedures, specifications, and documentation you upload to the platform

You own all of this data. We process it solely to provide our services to you and will never use it for any other purpose without your explicit consent.

Usage Data and Analytics

We automatically collect information about how you use our platform:

• Platform Activity: Features used, pages viewed, time spent, and user interactions
• Technical Data: IP address, browser type and version, device type, operating system
• Log Data: Access times, error logs, and system performance data
• Cookies and Tracking: As detailed in our Cookie Policy

Communications

When you communicate with us, we collect the content of those communications, including:

• Customer support inquiries and responses
• Feedback, survey responses, and feature requests
• Email correspondence and chat messages

How We Use Your Information

We use the information we collect for specific, legitimate business purposes:

To Provide Our Services

• Create and manage your account
• Process your manufacturing and operational data
• Enable collaboration between team members
• Generate analytics, reports, and insights from your data
• Provide customer support and respond to your inquiries

To Improve and Develop Our Platform

• Analyze usage patterns to enhance user experience
• Identify and fix technical issues
• Develop new features and functionality
• Conduct research and testing to improve our services

To Communicate With You

• Send service-related notifications and updates
• Respond to your questions and requests
• Send marketing communications (with your consent)
• Provide technical support and onboarding assistance

For Security and Compliance

• Protect against fraud, abuse, and security threats
• Enforce our terms of service and policies
• Comply with legal obligations and regulations
• Respond to legal requests and prevent harm

For Business Operations

• Process payments and manage billing
• Maintain accurate business records
• Analyze business performance and metrics
• Conduct audits and quality assurance

Data Ownership

All manufacturing data, operational information, and business content you input into our platform remains your property. We are simply the custodian of this data, processing it on your behalf to deliver our services.

This means:

• You have complete control over your data and can export it at any time
• We will never sell your data to third parties
• We will not use your data for purposes other than providing our services without your explicit consent
• You can request deletion of your data at any time, and we will comply within 30 days
• Upon termination of your account, your data will be deleted according to our retention policy

Third-Party Services

We work with trusted third-party service providers to help us deliver and improve our services. These providers have access to your information only to perform specific tasks on our behalf and are obligated to protect your data.

Infrastructure and Hosting

Google Cloud Platform: We use Google Cloud to host our application and store your data. Google Cloud provides enterprise-grade security, reliability, and compliance certifications including ISO 27001, SOC 2/3, and GDPR. Your data is stored in secure data centers with encryption at rest and in transit.

Payment Processing

Stripe: All payment transactions are processed through Stripe, a PCI-DSS compliant payment processor. Stripe handles credit card information securely, and we never have access to your complete card details. For more information, see Stripe's Privacy Policy.

Email Delivery

Postmark: We use Postmark to send transactional emails, including account notifications, password resets, and service updates. Postmark processes your email address and the content of service-related communications. Learn more at Postmark's Privacy Policy.

Analytics and Marketing

We use analytics and marketing tools to understand how our platform is used and to improve our services:

• Google Analytics: Collects usage data and website analytics
• Facebook Pixel: Tracks conversions and enables targeted advertising on Facebook
• X (Twitter) Pixel: Measures ad performance and builds audiences for X advertising

For detailed information about these tracking technologies, please see our Cookie Policy.

Data Retention and Deletion

We retain your information only for as long as necessary to provide our services and fulfill the purposes outlined in this Privacy Policy.

Active Accounts

While your account is active, we retain all data necessary to provide our services, including your account information, operational data, and usage history.

Account Deletion

When you request deletion of your account or specific data:

• We will begin the deletion process immediately
• Most data will be permanently deleted within 30 days
• Some data may be retained for up to 90 days to complete ongoing processes or fulfill legal obligations
• Backups containing your data may persist for up to 90 days before being overwritten

Legal and Compliance Retention

We may retain certain information for longer periods when required by law or necessary for legitimate business purposes, such as:

• Transaction records for accounting and tax purposes (typically 7 years)
• Data subject to legal holds or regulatory investigations
• Information needed to resolve disputes or enforce agreements

Data Anonymization

After deletion, some aggregate, anonymized data may be retained for analytical purposes. This data cannot be used to identify you or your organization.

Your Rights Under GDPR and CCPA

We are committed to providing you with comprehensive control over your personal information. Depending on your location, you have various rights under data protection laws.

Right to Access

You have the right to request a copy of all personal data we hold about you. We will provide this information in a structured, commonly used, and machine-readable format within 30 days of your request.

Right to Correction

If any of your personal information is inaccurate or incomplete, you have the right to request that we correct or complete it. You can update most information directly through your account settings, or contact us for assistance.

Right to Deletion

You have the right to request deletion of your personal data, also known as the "right to be forgotten." We will honor deletion requests within 30 days unless we have a legitimate reason to retain certain information.

Right to Data Portability

You have the right to receive your data in a portable format and transmit it to another service provider. We provide data export functionality directly within the platform, allowing you to download all your data in standard formats (CSV, JSON, or PDF).

Right to Object

You have the right to object to our processing of your personal data in certain circumstances, including:

• Marketing communications (you can opt out at any time)
• Automated decision-making or profiling
• Processing based on legitimate interests

Right to Restrict Processing

You can request that we limit the processing of your personal data in certain situations, such as when you contest the accuracy of the data or object to processing.

Right to Withdraw Consent

Where we process your data based on your consent, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing before the withdrawal.

How to Exercise Your Rights

To exercise any of these rights, please contact us at contact@bulk.studio or through your account settings. We will respond to your request within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

Data Security

We take the security of your data seriously and implement industry-standard measures to protect your information from unauthorized access, disclosure, alteration, and destruction.

Technical Security Measures

• Encryption: All data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption
• Authentication: Multi-factor authentication (MFA) is available and encouraged for all accounts
• Access Controls: Role-based access control (RBAC) limits data access to authorized personnel only
• Infrastructure Security: Our hosting on Google Cloud provides DDoS protection, firewalls, and intrusion detection
• Regular Testing: We conduct regular security audits, penetration testing, and vulnerability assessments

Organizational Security Measures

• Employee Training: All team members receive security and privacy training
• Limited Access: Employee access to customer data is restricted on a need-to-know basis
• Confidentiality Agreements: All employees and contractors sign confidentiality agreements
• Incident Response: We maintain a comprehensive incident response plan for potential data breaches

Data Breach Notification

In the unlikely event of a data breach that affects your personal information, we will notify you and relevant authorities within 72 hours of becoming aware of the breach, as required by GDPR and other applicable laws.

International Data Transfers

Bulk Studio operates globally, and your data may be transferred to and processed in countries other than your own. We ensure that all international data transfers comply with applicable data protection laws.

GDPR Compliance

For transfers of personal data from the European Economic Area (EEA) to countries outside the EEA, we rely on:

• Standard Contractual Clauses (SCCs): We use EU-approved SCCs with our service providers
• Adequacy Decisions: We transfer data to countries deemed adequate by the European Commission
• Additional Safeguards: We implement supplementary measures to ensure data protection

Data Localization

While our infrastructure is distributed globally for performance and redundancy, we can accommodate specific data residency requirements. Contact us to discuss options for keeping your data in specific geographic regions.

Children's Privacy

Bulk Studio is a business-to-business platform intended for use by manufacturing organizations and their employees. Our services are not directed to individuals under the age of 16, and we do not knowingly collect personal information from children.

If we become aware that we have collected personal information from a child under 16 without proper parental consent, we will take immediate steps to delete that information. If you believe we have collected information from a child, please contact us immediately at contact@bulk.studio.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by:

• Posting the updated policy on this page with a new "Last Updated" date
• Sending an email notification to your registered email address
• Displaying a prominent notice within the platform

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of our services after changes are posted constitutes acceptance of the updated policy.

For significant changes that materially affect your rights, we may require your explicit consent before the changes take effect.

Contact Us