Website privacy notice

Your story stays yours.

Last updated: October 5, 2026.

Who is responsible

Mateusz Swiatek is the website operator and data controller, based at Salomonstr. 7, 02826 Görlitz, Germany. Contact hello@bumpfolk.com about your personal information. Operator details are also available in the Impressum.

What this notice covers

This notice covers the website and optional early-access email registration. See the separate Bumpfolk app privacy policy for the mobile app. This website does not ask for pregnancy details, children’s names, medical records or other health information.

Early-access registration

If you choose to sign up, we collect your email address and explicit consent to receive Bumpfolk updates, early-access invitations and occasional requests for feedback. Processing of these optional emails relies on consent under Article 6(1)(a) GDPR. Visiting this website or contacting us does not subscribe you to a mailing list.

Email confirmation and withdrawal

We use Brevo (Sendinblue SAS, France) to send confirmation emails, manage list membership and record delivery, confirmation and withdrawal events. Submitting the form is not a confirmed subscription; the email confirmation link must be clicked. We do not require consent to tracking email opens or clicks as a condition of signing up.

Consent can be withdrawn through the newsletter unsubscribe form in the confirmation email, the unsubscribe link in future marketing emails, or by contacting hello@bumpfolk.com. Withdrawal stops marketing emails without affecting earlier lawful processing. Minimal suppression information may be retained for as long as needed to respect the withdrawal.

We store your email address, exact consent wording, its version and request time in a Cloudflare database. A request record is not proof of confirmation. We also periodically observe list and suppression status in Brevo; the observation time is not the exact time of your confirmation or withdrawal. Brevo’s privacy policy explains its processing and international transfer safeguards.

Contacting us by email

If you email hello@bumpfolk.com, we receive your email address, message and any information you include. Please do not send medical records or sensitive pregnancy information. We use correspondence to answer your enquiry, based on our legitimate interest in responding under Article 6(1)(f) GDPR, or Article 6(1)(b) where necessary for steps you request before a contract. Messages are forwarded through Cloudflare Email Routing to the operator’s Google Gmail mailbox.

Using the contact form

The contact form asks for your email address and message; your name is optional. It sends your enquiry through Cloudflare’s email service to the operator’s Gmail mailbox. The website does not store your message in a database or add you to a mailing list. The same legal bases apply as for email enquiries. Cloudflare processes request information to limit repeated submissions and prevent abuse. The form does not accept attachments.

Visiting the website

We use Cloudflare Turnstile on the contact and signup forms to distinguish legitimate submissions from automated abuse. Cloudflare processes technical signals such as IP address, browser and device information for this security check. Our server validates a short-lived, single-use verification token before processing your submission. This processing is based on our legitimate interest in protecting the forms under Article 6(1)(f) GDPR. See Cloudflare’s Turnstile Privacy Addendum for details.

Cloudflare, our hosting and security provider, processes technical information needed to deliver and protect the website, such as IP addresses and request information. We use this processing to operate the website and prevent abuse, based on our legitimate interests under Article 6(1)(f) GDPR.

Service providers and international processing

Cloudflare provides hosting, security and email delivery. Google Gmail receives contact correspondence. These providers may process information outside the EEA, including in the United States. Cloudflare’s Data Processing Addendum describes its processing obligations and international transfer mechanisms, including standard contractual clauses where applicable. Google describes its processing and transfer safeguards in its privacy policy. We do not sell your personal information.

Cookies and tracking

We do not use advertising trackers, audience analytics or optional tracking cookies on this website. Cloudflare may use strictly necessary security technologies to protect the service, including when a security challenge is required. We will update this notice and obtain any required consent before introducing optional tracking technologies.

How long information is kept

We keep your email subscription while your consent remains active and the updates are offered. Our retention period for unconfirmed and failed registration requests is 30 days from submission. Automated hourly reviews remove eligible expired request records from our Cloudflare database after checking Brevo. Records associated with an existing contact, earlier protected observations, or uncertain status require manual review so that confirmation evidence and withdrawal protections are not accidentally removed. This process does not delete Brevo contacts or its delivery and security records; those records require separate review and are subject to the provider’s retention practices. After withdrawal or the end of the mailing list, contact data is removed when no longer needed, except minimal suppression records and consent evidence needed to meet a legal obligation or establish, exercise or defend a legal claim. Other deletion requests are handled by the operator.

We keep contact correspondence while handling your enquiry and for as long as it is needed for related follow-up. Once the matter is resolved and the information is no longer needed, we delete it unless an applicable legal obligation or the establishment, exercise or defence of a legal claim requires retention. The contact form does not keep a message database or application-level request logs. Cloudflare’s technical and security records are subject to its service retention practices, described in its privacy policy.

Your rights

Contact hello@bumpfolk.com to request access, correction or deletion. Where applicable, you may also request restriction or portability, or object to processing based on legitimate interests. If processing relies on consent, you can withdraw it without affecting earlier lawful processing. You may complain to the supervisory authority where you live or work, or where an alleged infringement occurred. For an operator based in Görlitz, the regional authority is the Saxon Data Protection and Transparency Commissioner.

Changes

We will update this notice when our data practices change and show the latest revision date above.