BullStop Privacy Policy

1. Introduction

BullStop Limited ("BullStop", "we", "us" or "our") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, share and protect personal data when you use the BullStop mobile application, website and related services (collectively, the "Services").

BullStop provides content moderation tools that enable users to connect supported third-party social-media accounts and use automated technology to identify and manage potentially abusive, offensive, harmful or otherwise unwanted content.

This Privacy Policy also explains your privacy rights and how applicable data-protection laws protect you.

2. Who We Are

For the purposes of UK data-protection law, BullStop Limited may act as a data controller for certain personal data and as a data processor for other personal data processed through the BullStop service.

For questions about this Privacy Policy or the way we process personal data, please contact:

Email: data@bullstop.io
Website: bullstop.io

3. Our Role as Controller and Processor

The role BullStop performs depends on the circumstances in which personal data is processed.

3.1 When We Act as a Controller

We generally act as a data controller when determining how and why personal data is processed for purposes such as:

• creating and administering BullStop accounts;
• authenticating users;
• operating and securing the BullStop platform;
• communicating with users;
• providing customer support;
• detecting fraud, abuse and security threats;
• maintaining operational and security logs;
• complying with legal obligations; and
• improving the reliability, security and performance of our Services.

3.2 When We Act as a Processor

Where a user connects a third-party social-media account and instructs BullStop to analyse or moderate content available through that account, the user or organisation controlling that account may be the controller of that information and BullStop may process the information on their behalf.

Where required, separate data-processing terms may apply to such processing.

4. Personal Data We Collect

The personal data we collect depends on how you use BullStop, the features you enable and which third-party services you connect.

4.1 Account and Identity Information

When you register for or use BullStop, we may process information such as:

• your name;
• email address;
• BullStop account identifier;
• authentication identifiers;
• account status;
• login and authentication information; and
• information required to maintain and secure your account.

BullStop uses Amazon Web Services (AWS) Cognito to provide identity and access-management functionality.

BullStop does not need to store your AWS Cognito password within the BullStop application backend.

4.2 Connected Social-Media Accounts

BullStop may allow you to connect accounts from supported third-party social-media platforms.

Depending on the platform, permissions you grant and features you choose to use, BullStop may receive or process information such as:

• your social-media account identifier;
• username or profile name;
• publicly available profile information;
• posts, comments, replies or other content;
• identifiers associated with people interacting with your content;
• information required to perform authorised moderation actions;
• access or authorisation tokens; and
• other information made available through the relevant platform's authorised API.

BullStop seeks access only to information reasonably necessary to provide the features you request and subject to permissions made available by the relevant platform.

4.3 Social-Media Passwords

BullStop does not request or receive your password for a connected social-media platform.

Authentication and authorisation are performed by the relevant social-media platform.

The platform then provides BullStop with the authorisation necessary to access permitted information or perform permitted actions on your behalf.

4.4 Technical and Usage Information

When you use BullStop, we may process technical information necessary to operate and secure the Services, such as:

• IP address;
• device and operating-system information;
• application version;
• authentication and security events;
• error and diagnostic information;
• application activity;
• date and time information; and
• operational and security logs.

We use this information where necessary to provide, maintain, troubleshoot and secure the Services.

5. Content Processed by BullStop

When you connect a supported social-media account, BullStop may process content associated with that account to provide content-moderation functionality.

This may include:

• posts;
• comments;
• replies;
• messages, where supported and authorised;
• usernames or account identifiers associated with content;
• metadata associated with content; and
• moderation actions taken in relation to that content.

The exact information available to BullStop depends on the relevant third-party platform, its API, the permissions granted by you and the BullStop features you enable.

BullStop does not claim ownership of content obtained from your connected accounts.

6. Automated Content Moderation

BullStop uses automated technologies, which may include machine-learning and artificial-intelligence techniques, to analyse content and identify potentially abusive, offensive, harmful or otherwise unwanted material.

This analysis may generate information such as:

• content classifications;
• moderation categories;
• risk or confidence indicators;
• moderation recommendations; and
• records of moderation actions.

Depending on your settings and the capabilities permitted by the connected platform, BullStop may use the results of this analysis to:

• identify or flag potentially inappropriate content;
• present content for review;
• hide or remove content;
• block or restrict accounts; or
• perform other moderation actions authorised by you and supported by the relevant platform.

Automated content-classification systems are not perfect. They may occasionally incorrectly classify content or fail to identify content that a user considers inappropriate.

Where BullStop provides configurable moderation settings, users are responsible for selecting settings appropriate for their intended use of the service.

7. How We Use Personal Data

We may process personal data to:

• create and manage BullStop accounts;
• authenticate users;
• connect authorised third-party accounts;
• provide BullStop's content-moderation functionality;
• analyse content for moderation purposes;
• perform moderation actions requested or configured by users;
• display moderation statistics and activity;
• maintain records of moderation activity;
• operate, maintain and improve the Services;
• diagnose and resolve technical problems;
• provide customer support;
• prevent fraud, misuse and unauthorised access;
• protect the security and integrity of BullStop;
• comply with legal and regulatory obligations; and
• establish, exercise or defend legal claims.

We will not use personal data for purposes incompatible with those described in this Privacy Policy unless permitted or required by law.

8. Legal Bases for Processing

Where UK GDPR or EU GDPR applies, we process personal data only where we have an appropriate lawful basis.

8.1 Performance of a Contract

We process information where necessary to provide BullStop and its features to you, including:

• creating and managing your account;
• authenticating you;
• connecting authorised third-party accounts;
• analysing content;
• providing moderation functionality; and
• carrying out actions you request or configure.

8.2 Legitimate Interests

We may process information where necessary for our legitimate interests or those of another person, provided those interests are not overridden by your rights and interests.

These interests may include:

• securing BullStop;
• preventing fraud and abuse;
• troubleshooting;
• maintaining service reliability;
• understanding service performance; and
• protecting our legal rights.

8.3 Legal Obligations

We may process information where necessary to comply with applicable laws, regulatory requirements or lawful requests.

8.4 Consent

Where applicable law requires consent for a particular type of processing, we will ask for consent before carrying out that processing.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

9. Third-Party Service Providers

We use selected cloud service providers to operate BullStop.

Our principal cloud service providers that may process personal data are:

9.1 Amazon Web Services - AWS Cognito

We use Amazon Web Services (AWS), including Amazon Cognito for identity and access-management services.

AWS Cognito may process information necessary to:

• create and manage user identities;
• authenticate users;
• maintain authentication sessions; and
• protect access to BullStop.

AWS processes information in accordance with its applicable contractual and data-protection obligations.

You can review the AWS Privacy Notice .

9.2 Microsoft Azure

We use Microsoft Azure to host and operate BullStop's backend infrastructure.

Depending on the BullStop services being used, Azure may process information required to:

• operate BullStop backend services;
• process authorised content;
• perform content-moderation operations;
• communicate with supported third-party platforms;
• store application information;
• maintain operational and security logs; and
• secure and monitor the service.

Microsoft processes this information in accordance with its applicable contractual and data-protection obligations.

You can review the Microsoft Privacy Statement .

We require service providers processing personal data on our behalf to protect that information and process it in accordance with applicable contractual obligations and data-protection law.

10. Third-Party Social-Media Platforms

BullStop interacts with supported third-party social-media platforms through APIs and authorisation mechanisms provided by those platforms.

Your use of those platforms remains subject to their respective privacy policies, terms of service and developer/platform rules.

When you authorise BullStop to access a platform, the platform determines which permissions are available and may display the permissions or access being requested.

BullStop uses access provided through a connected platform only for purposes related to providing the BullStop Services and in accordance with applicable platform requirements.

Third-party social-media platforms operate independently from BullStop, and we are not responsible for their independent privacy practices.

11. Disconnecting a Social-Media Account

You may revoke BullStop's access to a connected social-media account using functionality provided by BullStop or the relevant third-party platform, where available.

Revoking or disconnecting an account prevents BullStop from making new requests using the revoked authorisation once that revocation becomes effective.

Disconnecting a platform does not necessarily result in the immediate deletion of information previously processed by BullStop.

You may separately request deletion of your personal data as described below.

12. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including providing the Services and satisfying legal, security, accounting or regulatory requirements.

Different categories of information may have different retention periods.

In determining an appropriate retention period, we consider:

• the amount and nature of the information;
• the sensitivity of the information;
• the purpose for which it is processed;
• whether the information remains necessary to provide the Services;
• security and fraud-prevention requirements;
• applicable contractual requirements; and
• applicable legal obligations.

Where personal data is no longer required, we will delete, anonymise or otherwise securely dispose of it in accordance with our retention procedures, subject to information retained temporarily in backups or where continued retention is required by law.

13. Account and Data Deletion

You may request deletion of your BullStop account and associated personal data by contacting:

data@bullstop.io

Where account-deletion functionality is available directly within the BullStop application, you may also use that functionality.

Following a valid deletion request, we will delete or anonymise personal data that we are no longer required or permitted to retain.

Some information may need to be retained for a limited period where necessary for:

• legal obligations;
• fraud and security prevention;
• resolving disputes;
• enforcing agreements;
• maintaining required transaction or business records; or
• establishing, exercising or defending legal claims.

Residual copies may also remain temporarily within secure backup systems until those backups are overwritten or deleted in accordance with our backup-retention processes.

Deleting your BullStop account does not automatically delete information held independently by a connected third-party platform.

14. International Data Transfers

BullStop's service providers may process personal data in countries outside the United Kingdom or European Economic Area.

Where personal data is transferred internationally, we take steps designed to ensure appropriate protections are in place as required by applicable data-protection law.

Depending on the destination and service provider, safeguards may include:

• applicable UK or EU adequacy regulations or decisions;
• the UK Extension to the EU-US Data Privacy Framework, where applicable;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved EU Standard Contractual Clauses;
• EU Standard Contractual Clauses; or
• another legally recognised transfer mechanism.

The mechanism used depends on the processing activity, service provider and destination concerned.

15. Security

We use appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access;
• accidental loss;
• unlawful processing;
• alteration;
• unauthorised disclosure; and
• destruction.

These measures may include, where appropriate:

• encryption of data in transit;
• encryption of stored information;
• identity and access controls;
• authentication controls;
• restricted administrative access;
• security logging and monitoring;
• network and infrastructure security controls; and
• regular review of access permissions.

No internet-based system can be guaranteed to be completely secure. We therefore cannot guarantee absolute security, but we work to maintain safeguards appropriate to the nature of the information we process.

16. Your Data-Protection Rights

Depending on your location and applicable law, you may have rights concerning your personal data.

Under UK and EU data-protection law, these may include the right to:

• Access - request a copy of personal data we hold about you.
• Rectification - request correction of inaccurate or incomplete information.
• Erasure - request deletion of personal data in certain circumstances.
• Restriction - request restriction of processing in certain circumstances.
• Object - object to certain processing based on legitimate interests.
• Data portability - receive certain personal data in a structured, commonly used and machine-readable format.
• Withdraw consent - withdraw consent where processing relies upon consent.
• Rights relating to automated decision-making - exercise applicable rights in relation to certain qualifying solely automated decisions.

To exercise your rights, contact data@bullstop.io.

We may need to verify your identity before fulfilling a request.

There is normally no fee for exercising your data-protection rights. However, applicable law may permit us to charge a reasonable fee or refuse a request where it is manifestly unfounded or excessive.

17. Personal Data Relating to Other People

BullStop may process content created by individuals who do not themselves have a BullStop account.

For example, a person may post a comment on a social-media account operated by a BullStop user. That content may subsequently be analysed by BullStop as part of the account owner's moderation activities.

Depending on the circumstances, the owner or operator of the connected social-media account may be responsible for determining the purposes for which this information is processed, with BullStop processing it on their behalf.

If you believe your personal data has been processed through BullStop in this way and wish to exercise a data-protection right, you may contact us at data@bullstop.io.

Where BullStop is acting solely as a processor, we may refer or assist with the request as appropriate in conjunction with the relevant controller.

18. Children

BullStop is not designed as a service directed specifically at children.

We do not knowingly seek to collect personal data directly from children for the purpose of creating BullStop accounts where they are not legally permitted to use the service.

Content processed through a connected social-media account may nevertheless have been created by a child or young person. Where such content is processed, BullStop processes it only as necessary to provide the moderation functionality requested by the relevant account holder and subject to applicable law.

If you believe a child has created a BullStop account or provided personal information to us contrary to these requirements, please contact data@bullstop.io.

19. Marketing Communications

We may send service-related communications necessary to operate your BullStop account, including security, authentication, operational and important service notices.

Where we send marketing communications, we will do so only where permitted by applicable law.

Where required, we will obtain consent before sending electronic marketing communications.

You may unsubscribe from marketing communications at any time using the unsubscribe mechanism provided in the communication or by contacting us.

Opting out of marketing communications does not prevent us from sending essential service or security communications.

20. Cookies and Website Technologies

Our website may use cookies or similar technologies necessary for its operation.

Where we use non-essential cookies or similar technologies, including analytics or advertising technologies where applicable, we will provide appropriate information and obtain consent where required by law.

You may manage applicable cookie preferences through the controls provided on our website.

21. Links and Third-Party Services

BullStop may contain links to third-party websites, applications or services.

Those services operate under their own privacy policies and terms.

We encourage you to review the privacy information provided by a third party before providing personal data to it.

BullStop is not responsible for the independent privacy practices of third parties.

22. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect:

• changes to BullStop;
• new features or integrations;
• changes to our service providers;
• changes in applicable law or regulatory guidance; or
• changes to the way we process personal data.

When we make material changes, we will take reasonable steps to bring them to users' attention where required.

The date at the top of this Privacy Policy identifies when it was most recently updated.

We encourage users to review this Privacy Policy periodically.

23. Complaints

If you have concerns about how we process your personal data, please contact us first at:

data@bullstop.io

We will investigate your concerns and respond as appropriate.

If you are located in the United Kingdom, you also have the right to make a complaint to the Information Commissioner's Office (ICO).

Website: ico.org.uk

If EU data-protection law applies to you, you may also have the right to complain to the competent supervisory authority in the country in which you live or work.

24. Contact Us