Privacy Policy

1. Who we are

Bump is run from the Philippines. In this policy, "Bump", "we" and "us" mean the people who operate Bump. We are the personal information controller for the personal information described here.

Data Protection Officer: write to team@bump.ph about anything in this policy.

2. What we collect

What we collect depends on how you use Bump. Campaign hosts are the people and businesses who fund campaigns. Creators are the people who make or post content for them.

• Waitlist: your email address, whether you're joining as a campaign host or a creator, the language you use on the site, and when you signed up.
• Account details: your name, email address, mobile number, date of birth, password or sign-in details, country and language.
• Profile: your display name, photo, bio, niches and the social accounts you connect to Bump.
• Connected social accounts: when you link a TikTok, Instagram or YouTube account, we receive what you authorise, such as your handle, public profile, posts you submit and their view, like and engagement numbers. We never receive your social media passwords.
• Submissions and content: post links, videos, captions, edits and other content you submit to campaigns, and records of approvals, rejections and appeals.
• Campaign information (hosts): business name, campaign briefs, budgets, source files, music or brand assets, payment history and the person managing the account.
• Payment and payout details: for hosts, billing details and transaction records (card and bank details are handled by our payment partners, see section 6); for creators, your GCash or Maya number, bank account details, payout history and balance.
• Parent or guardian details: for creators aged 16 or 17, the name, contact details and consent record of the parent or guardian who approved the account.
• Messages: what you send to our support team or to other users through Bump, and reports or complaints you file.
• Technical and security information: IP address, device and browser type, pages visited, sign-in times, and logs used to keep Bump secure and to detect fake views and fraud.
• Cookies: see section 11.

We don't ask for sensitive personal information (such as health, religion or political views) and ask you not to include it in content or messages.

3. Where it comes from

• From you, when you join the waitlist, sign up, fill in your profile, submit content, fund a campaign, withdraw or contact us.
• From social platforms you connect (TikTok, Instagram, YouTube), within the permissions you grant.
• From payment and payout partners, who confirm payments, withdrawals and refunds.
• From other users: hosts review and rate creators' submissions; any user can report another.
• From your device, automatically, when you use the website or platform.

4. Why we use it, and on what basis

The Data Privacy Act lets us process personal information only on a lawful basis. For each use, the basis is:

• To run the waitlist and invite you to the beta: your consent, given when you sign up. You can withdraw it at any time (section 9).
• To create and run your account and provide Bump's services (campaigns, submissions, view checks, payouts): because it's needed for our contract with you.
• To check views, detect bots, fake engagement and fraud, and keep Bump secure: our legitimate interest in a fair and safe marketplace, and to protect hosts' budgets and creators' earnings.
• To process payments and payouts, keep financial records and meet tax, anti-money-laundering and other legal duties: legal obligation and our contract with you.
• To answer support requests, handle complaints, appeals and copyright notices: our contract with you and our legitimate interest.
• To send service messages (security alerts, payout notices, changes to our terms): our contract with you. You can't opt out of these while you have an account.
• To send news and offers: your separate, optional consent. Saying no never affects your account (section 10).
• To improve Bump using aggregated or de-identified statistics: our legitimate interest.
• To count visits to the public website with analytics (section 11): your consent, asked for on the website and never assumed. You can withdraw it at any time with Cookie settings at the bottom of every page.

If you're in the European Union or the United Kingdom, these bases correspond to Article 6(1)(a) consent, (b) contract, (c) legal obligation and (f) legitimate interests of the GDPR and UK GDPR.

Providing information is optional, but some is needed for a feature to work. Without an email address we can't add you to the waitlist; without payout details we can't pay you.

5. Automated checks

We use software to read view counts from linked accounts and to flag signs of bots, bought views or other manipulation. A flag never decides on its own: a person reviews every flagged submission before it's rejected or an account is restricted, and you'll be told the reason. You can ask a person to review any decision about your submissions, earnings or account (see the Terms of Service, "Appeals").

6. Who we share it with

We share personal information only as described here.

• Hosts and creators, as the marketplace needs: a host sees the public profile, handle, submitted content, performance numbers and approval status of creators in their campaigns, never their payout details or contact details unless the creator shares them. Creators see the host's business name and campaign information.
• Other logged-in users: a creator's public page shows their display name, photo, bio, tags, connected account handles, follower counts and how many posts were approved. Campaign leaderboards show their name and approved views unless they turn that off in Settings. Neither shows money, email or birth date. Anyone under 18 is left off leaderboards, and their page doesn't show a city. A host's public page shows their name, logo, description and campaigns.
• Service providers who process information for us under contract and our instructions: website hosting and security (Cloudflare), email delivery (Resend, which delivers waitlist sign-ups to our inbox), website analytics (Umami Cloud, only if you agree, section 11) and, once payments open, payment and payout partners (GCash, Maya, Philippine banks and a payment provider we'll name here first). We'll add any other provider here before we use it.
• Social platforms, when you connect your account to them, under their own privacy policies.
• Government authorities, regulators and courts, when the law requires it (for example the Bureau of Internal Revenue, the NPC, or a court order), or to protect people's rights, property or safety.
• A buyer or successor, if Bump's business is sold or merged, who must keep protecting your information under this policy.

7. Information stored outside the Philippines

Some of our service providers store or process information outside the Philippines, for example in the United States, and in other countries where Cloudflare runs its network. We stay responsible for your information when it's transferred. We use providers bound by contracts that require protection comparable to the Data Privacy Act, and, for information about people in the EU or UK, appropriate safeguards such as standard contractual clauses.

8. How long we keep it

We keep personal information only as long as we need it for the purposes above, then delete or anonymise it.

• Waitlist sign-ups: until you join the beta, until Bump opens to everyone, or until you ask us to remove you, whichever comes first.
• Account and profile information: while your account is open, and for 1 year after you close it, to handle disputes, appeals and fraud checks.
• Submissions and view records: for the life of the campaign, then only as long as needed to check payouts and settle disputes.
• Payment, payout and tax records: for as long as tax and accounting laws require (the National Internal Revenue Code and BIR rules set these periods).
• Security logs: 12 months.
• Support messages and complaints: only as long as needed to follow them up after they're closed.

We keep information longer only where the law requires it or to establish, exercise or defend a legal claim.

9. Your rights

Under the Data Privacy Act you have the right to:

• be informed about how your personal information is processed;
• access it and get a copy;
• object to processing, including direct marketing, and withdraw consent at any time (this doesn't affect processing done before);
• have it corrected if it's wrong or incomplete;
• have it erased or blocked when it's no longer needed, was collected unlawfully, or you withdraw consent and no other basis applies;
• data portability: receive it in a commonly used electronic format;
• be indemnified for damages caused by inaccurate, incomplete, unlawfully obtained or unauthorised use of your information;
• file a complaint with the National Privacy Commission (privacy.gov.ph).

People in the EU or UK also have the GDPR's rights, including restriction of processing and a complaint to their local data protection authority. California residents may have rights under the California Consumer Privacy Act where it applies to us.

To use any of these rights, email team@bump.ph from the email linked to your account (or the one you used for the waitlist), or use your account settings where available. We may ask you to confirm your identity. We'll answer within 15 working days and tell you if we need longer. Using your rights is free, unless a request is clearly unfounded or excessive.

10. Emails and marketing

Joining the waitlist means we'll email you about Bump's beta and your invite. We send news and offers only if you separately agree, and that box is never ticked for you. Every marketing email has an unsubscribe link, and you can also write to team@bump.ph. Unsubscribing doesn't stop service messages about your account, payouts or security.

11. Cookies

The website sets three cookies, all first-party and strictly necessary: "lng" remembers your language (one year) and "currency" remembers your currency (one year), both only when you choose a setting, and "bump_consent" remembers your answer about analytics (180 days, then we ask again). None of them track you.

Analytics: with your consent, the website counts visits so we can see how people find Bump and which parts of the page they reach. It records the page, the site that sent you, your browser, device type, screen size and language, your country (worked out from your IP address), and actions such as reaching the marketplace section or clicking a waitlist link. The statistics are kept by Umami Cloud (Umami Software, Inc., which may store them outside the Philippines, section 7). Umami sets no cookies and doesn't store your IP address: it tells visits apart with a code that changes every month, so we can't identify you from the statistics. We use them only in totals, for example in a daily summary emailed to the Bump team.

The analytics question appears once, when you first reach the marketplace section of the home page. "Reject" is as easy as "Accept", nothing optional is switched on for you, and until you agree no statistics are sent. You can change or withdraw your choice at any time with Cookie settings at the bottom of every page; withdrawing stops the statistics from then on. The site has no advertising or marketing cookies.

When accounts open, Bump will also use cookies needed to keep you signed in and secure. These are strictly necessary and can't be turned off. If we ever add other optional cookies, we'll ask for your consent first and update this section before they go live.

12. Security and breaches

We use organisational, physical and technical measures appropriate to the risk, as the Data Privacy Act requires, and limit access to the people who need it for their work. No system is perfectly secure. Keep your password private and turn on any extra sign-in protection we offer.

If a personal data breach is likely to put you at real risk, we'll notify the National Privacy Commission and you within 72 hours of learning of it, as NPC rules require, and tell you what happened and what you can do.

13. Young people

Bump isn't for anyone under 16. Creators aged 16 or 17 may use Bump only with the consent of a parent or legal guardian, who agrees to the Terms of Service on their behalf and whose details we keep (section 2). Campaign hosts must be at least 18.

If we learn that someone under 16, or a 16 or 17-year-old without a parent's or guardian's consent, has given us personal information, we'll close the account and delete the information unless the law requires us to keep it. A parent or guardian can contact team@bump.ph at any time to review or delete their child's information.

14. Changes to this policy

We'll update the date and version at the top whenever this policy changes. If a change materially affects how we use your information, we'll tell you by email or in Bump before it takes effect, and ask for your consent again where the law requires it.

15. Contact and complaints

Questions, requests or complaints about privacy: team@bump.ph. If you're not satisfied with our answer, you can complain to the National Privacy Commission (privacy.gov.ph).