Privacy Policy
Last updated: 19 October 2026
At Bubblepay, we respect your privacy and are committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store, disclose, and protect personal information when you visit our website, use our payment solutions, access our applications, or interact with services powered by Bubblepay.
Our approach is informed by applicable privacy and data protection laws, including the Australian Privacy Act 1988 and Australian Privacy Principles (APPs), the European Union General Data Protection Regulation (GDPR), and applicable United States federal and state privacy laws.
1. Who We Are
Bubblepay is a laundromat payment and management platform operated by SMRT Systems, Inc., a North Carolina corporation with its principal place of business at:
1017 Main Campus Dr STE 1600
Raleigh, NC 27606
United States
In this policy, “Bubblepay”, “SMRT”, “we”, “us”, or “our” refers to SMRT Systems, Inc., and any other legally responsible Bubblepay entity identified in a relevant jurisdiction-specific notice.
Our services include payment kiosks, connected laundry machines, customer-facing mobile and web applications, operator portals, loyalty and marketing features, and related business management services.
This policy applies to visitors, customers, laundromat owners, employees, authorised operators, and other individuals interacting with these services.
Our role in handling personal information
Bubblepay supports two primary groups:
Laundromat operators: Businesses that use Bubblepay to accept payments, operate machines, manage customers, and run their stores.
Customers: Individuals who use Bubblepay-powered services at participating laundromats.
Participating laundromat operators generally determine how customer information is used for their business operations, loyalty programs, and marketing activities. Bubblepay processes much of this information on their behalf and according to their instructions.
For activities where Bubblepay independently determines the purposes and means of processing, such as managing its own website, business relationships, and platform security, Bubblepay acts as the responsible business or data controller, as applicable under relevant law.
Depending on the circumstances and jurisdiction, other legal arrangements may apply.
2. Information We Collect
We collect personal information that is reasonably necessary to provide, maintain, secure, and improve our services.
Personal and account information
This may include:
Full name, email address, and phone number.
Account credentials and authentication information.
Business name, business address, and contact details.
Customer account identifiers and communication preferences.
Information provided through enquiries, feedback, or customer support requests.
Payment and transaction information
When you use a Bubblepay-powered payment service, we may process:
Transaction amounts, dates, times, and status.
Machine or laundry services purchased.
Payment method, card brand, and last four digits where provided.
Payment references and processor transaction identifiers.
Refunds, payment adjustments, and payout records.
Stored-value balances, account credits, and loyalty rewards.
Purchase and transaction history associated with a participating laundromat.
Payment card numbers are collected and processed by Stripe, our payment processing provider, and are not stored on Bubblepay servers. Bubblepay retains limited payment references and information necessary to operate the service.
Customer and loyalty information
Depending on the services enabled by a participating laundromat, we may process:
Customer profiles and account identifiers.
Loyalty membership and rewards activity.
Visit frequency and transaction history.
Customer preferences and marketing communication choices.
Promotional offers and campaign interactions.
Device and technical information
We may collect:
IP address, browser type, and operating system.
Device identifiers and application versions.
Website and application activity.
Kiosk and laundry machine identifiers.
Machine status, usage events, and technical telemetry.
Diagnostic logs, error reports, and performance information.
Pickup and delivery information
Where participating laundromats offer pickup and delivery services through Bubblepay, information may include delivery addresses, order details, delivery instructions, and relevant location or route information.
Location information is processed to the extent necessary to deliver enabled services and according to applicable permissions and legal requirements.
Accounting and business information
Where operators connect accounting applications, we may process accounting configuration, tax rates, chart-of-account information, daily revenue summaries, refunds, and payout information as further described below.
3. How We Collect Information
We collect information:
Directly from you when you register, complete a transaction, submit a form, or contact us.
From participating laundromat operators using our services.
Through payment kiosks, mobile applications, connected laundry machines, and related systems.
From payment processors and other authorised service providers.
Through connected accounting software authorised by an operator.
Automatically through technical logs, cookies, and similar technologies, where applicable.
Some personal information is necessary to provide the service you request. If you choose not to provide it, certain features may not be available.
Where lawful and practical, some services may be used without establishing an identifiable customer account.
4. How We Use Personal Information
We use personal information for the following purposes:
Payment processing and financial records
To initiate and process payments, manage refunds, reconcile transactions, maintain financial records, and support related enquiries.
Account and service management
To create accounts, authenticate users, maintain stored balances, activate machines, and deliver requested laundry services.
Business operations
To provide authorised laundromat operators with transaction reporting, machine usage information, financial summaries, and business management tools.
Marketing and loyalty programs
To administer rewards, customer memberships, promotions, and marketing communications on behalf of participating laundromats, as permitted by law.
Service communications
To send receipts, machine notifications, payment confirmations, account notices, and other operational messages.
Accounting integrations
To connect and synchronise information with accounting software when an operator authorises the integration.
Security and fraud prevention
To detect suspicious transactions, prevent unauthorised activity, investigate security incidents, and protect our systems.
Support and product improvement
To troubleshoot problems, monitor performance, respond to enquiries, and improve the reliability and functionality of our services.
Legal obligations
To comply with applicable laws, regulatory requirements, lawful requests, and tax or accounting obligations.
We do not use personal information for unrelated purposes without an appropriate legal basis or authorisation.
5. Payment Processing and Financial Data
Bubblepay supports electronic payments through Stripe and related payment integrations.
When you make a payment, relevant card information is collected and processed by Stripe in connection with the transaction.
Bubblepay does not store complete payment card numbers on its servers. We receive and retain limited transaction information, such as payment status, amount, card brand, last four digits, and Stripe transaction references, as needed for reporting, refunds, reconciliation, and support.
Where available, saved payment methods may use secure payment references or tokens rather than exposing complete card credentials to the Bubblepay platform.
Stripe independently handles certain payment information in accordance with its own privacy and security practices.
For more information, visit:
Bubblepay may also retain financial records to meet applicable legal, tax, audit, and dispute-resolution obligations.
6. Accounting Integrations
Bubblepay allows participating laundromat operators to connect compatible accounting applications, including Intuit QuickBooks Online and Xero.
Accounting connections are established only when an authorised operator grants permission through the accounting provider’s authorisation process, using OAuth.
When connected, Bubblepay may:
Read the operator’s chart of accounts, tax rates, and class or tracking lists to support accounting configuration.
Create accounting records selected by the operator, including daily takings summaries, sales receipts, refunds, and payout deposits.
Retain identifiers of records already synchronised to preserve accounting consistency and audit trails.
Accounting authorisation tokens are protected using AES-256-GCM encryption at rest with a dedicated key, as described in Bubblepay’s existing platform policy.
We do not sell, rent, or use accounting integration data for advertising or to train artificial-intelligence models.
Operators may disconnect an accounting integration through Bubblepay or the accounting provider. Following disconnection, stored authorisation tokens are revoked and cleared, subject to technical and legal requirements.
Previously posted accounting records may remain within the operator’s accounting application and are subject to that provider’s terms, retention practices, and the operator’s own account settings.
7. Marketing, Loyalty, and Communications
Bubblepay provides tools that participating laundromats can use to communicate with customers and operate loyalty programs.
These may include:
Transactional SMS, email, and application notifications.
Loyalty rewards and account balance notifications.
Promotional campaigns and discount offers.
Automated campaigns based on customer activity.
Customer groups based on visit history, spending, and loyalty activity.
The participating laundromat generally determines the recipients, content, and purpose of its marketing campaigns.
Where required by law, marketing communications are sent only with appropriate consent or another valid legal basis.
Customers may opt out of promotional communications through the unsubscribe or opt-out method included in a message, relevant account settings where available, or by contacting the participating business.
We distinguish promotional communications from necessary transactional messages, such as receipts, payment confirmations, and important service updates.
Marketing activity is subject to applicable requirements, including Australia’s Spam Act 2003, US CAN-SPAM and applicable telephone and text marketing rules, and relevant European privacy and electronic communications legislation.
8. How We Share Personal Information
We do not sell personal information.
We share information only as necessary for legitimate business purposes, the delivery of requested services, authorised integrations, or legal obligations.
Recipients may include:
Participating laundromat operators
Operators may access transaction history, customer records, loyalty activity, and other information relating to services provided at their locations.
Payment service providers
Stripe and other applicable payment service providers process payment-related information to authorise and settle transactions.
Technology and infrastructure providers
Providers such as Amazon Web Services (AWS) support hosting, storage, platform operations, and infrastructure security.
Communication providers
Email, SMS, and other messaging providers deliver authorised transactional and marketing communications.
Accounting providers
Intuit QuickBooks Online, Xero, or other supported services receive information when an operator authorises an integration.
Professional advisers and authorities
We may disclose information to auditors, legal advisers, regulators, law enforcement, or other authorised recipients where required or permitted by law.
Corporate transactions
Information may be disclosed in connection with a proposed or completed merger, acquisition, financing, reorganisation, or sale, subject to applicable legal protections.
Where providers process personal information on our behalf, we use appropriate agreements and safeguards as required by applicable law.
9. Legal Bases for Processing — European Economic Area
Where the GDPR applies and Bubblepay acts as a data controller, we rely on one or more of the following legal bases:
Purpose
Legal basis
Processing payments, managing accounts, and providing requested services
Performance of a contract
Maintaining tax, accounting, and legally required financial records
Compliance with a legal obligation
Fraud prevention, information security, technical diagnostics, and service improvement
Legitimate interests, subject to applicable balancing requirements
Sending optional marketing communications and using non-essential tracking technologies
Consent where required; otherwise another applicable lawful basis
Responding to enquiries and managing business relationships
Contractual necessity or legitimate interests, depending on the circumstances
Protecting legal rights and resolving disputes
Legitimate interests or legal obligations, as applicable
Where processing is based on legitimate interests, those interests include maintaining a secure and reliable platform, preventing fraud, supporting our business relationships, and improving service performance.
Where consent is required, you may withdraw it at any time. Withdrawal does not affect processing already lawfully carried out.
Where Bubblepay processes personal data solely on behalf of a laundromat operator, the operator is generally responsible for establishing and communicating the appropriate legal basis for its processing activities.
10. Data Security
We use technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss, and misuse.
Our existing platform security practices include:
TLS encryption for data transmitted to and from the platform.
Encryption of sensitive secrets and accounting authorisation tokens at rest.
Restricted production-system access for authorised personnel.
Access controls and authentication mechanisms.
Technical monitoring, diagnostics, and system maintenance.
We assess security incidents and respond in accordance with applicable law.
Where required, we will notify affected individuals, participating operators, and relevant authorities of eligible personal data breaches.
No electronic system is completely secure, and absolute security cannot be guaranteed.
11. International Data Storage and Transfers
Bubblepay supports laundromat operators in multiple countries, including Australia and the United States.
Personal information may be processed or stored in the United States or in other locations where Bubblepay or its authorised service providers operate.
Where Australian personal information is disclosed to recipients overseas, we take reasonable steps required under the Australian Privacy Principles, including APP 8, to protect the information.
Where the GDPR applies to a transfer of personal data outside the European Economic Area, we use a valid transfer mechanism as required by law. Depending on the circumstances, this may include an applicable adequacy decision, approved Standard Contractual Clauses, or another lawful transfer mechanism, together with any required supplementary protections.
Individuals may request information about applicable international transfer safeguards by contacting us.
[Publication verification: confirm the countries of overseas recipients and the actual transfer mechanisms in use. Identify an EU or EEA establishment, representative, or data protection contact where legally required.]
12. Cookies and Similar Technologies
Our website and applications may use cookies, device identifiers, and similar technologies.
These technologies may support:
Essential website functions and security.
Session and account management.
Website performance and error diagnostics.
Analytics and visitor experience improvements.
Advertising and campaign measurement, if enabled.
Where required under applicable law, we obtain consent before using non-essential cookies or similar technologies.
You may manage cookies through browser settings and any cookie preference tools that we provide.
Withdrawing cookie consent will not affect the legality of processing carried out before withdrawal.
The specific cookies, providers, purposes, and retention periods used on the website should be described in the applicable cookie notice or preference centre.
13. How Long We Retain Information
We retain personal information for as long as necessary to provide our services, meet our legal obligations, maintain security, and resolve disputes.
Retention depends on the category of information and the purposes for which it is processed.
Information
Retention approach
Customer and loyalty accounts
While the account or relevant business relationship remains active, subject to legal and operational requirements
Payment and transaction records
For applicable tax, accounting, financial, audit, and dispute-resolution requirements
Operator accounts
For the duration of the business relationship and any necessary post-termination period
Accounting integration tokens
While the connection remains authorised; revoked and cleared following disconnection
Technical and security logs
For operational, diagnostic, security, and compliance needs
Marketing preferences
While necessary to administer communications and honour opt-out requests
When information is no longer necessary, we take reasonable steps to delete, destroy, or de-identify it, unless retention remains legally required or permitted.
Requests to delete information may be limited where records must be preserved for legal, financial, security, or other lawful reasons.
14. Your Rights and Choices
Depending on your location and applicable law, you may have rights to:
Request access to personal information held about you.
Request correction of inaccurate or incomplete information.
Request deletion of personal information, subject to lawful exceptions.
Withdraw consent where processing is based on consent.
Object to certain processing, including direct marketing.
Request restrictions on certain processing.
Request portable copies of eligible personal information.
Exercise other privacy rights available in your jurisdiction.
You may contact Bubblepay or, where appropriate, the participating laundromat to exercise these rights.
We may verify your identity before responding.
We will not unlawfully discriminate against individuals for exercising applicable privacy rights.
15. Privacy Rights for Australian Residents
Where the Australian Privacy Act 1988 and Australian Privacy Principles apply, individuals may request access to personal information held about them and request correction of information that is inaccurate, outdated, incomplete, irrelevant, or misleading.
Individuals may also make a complaint about how their personal information has been handled.
To make a request or complaint, contact:
Please provide sufficient information for us to identify the matter and investigate your concerns.
We will assess and respond to requests in accordance with applicable Australian privacy law. We aim to respond to privacy complaints within 30 days.
If you are dissatisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC):
Additional rules may apply to direct marketing, overseas disclosures, and eligible data breaches.
16. Privacy Rights for United States Residents
Privacy rights in the United States depend on the state in which you reside, the nature of the information, and whether the relevant law applies to Bubblepay or the participating operator.
Where an applicable state privacy law provides these rights, you may request:
Confirmation of whether your personal information is being processed.
Access to personal information.
Correction of inaccurate personal information.
Deletion of qualifying personal information.
A portable copy of eligible information.
Opt-out of certain targeted advertising, sale or sharing of personal information, or qualifying profiling.
Appeal of a denied privacy rights request, where required by applicable law.
California residents
For purposes of the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), where applicable, the categories of personal information collected may include:
Identifiers, including name, email, phone number, and account information.
Commercial information, including transaction and purchase records.
Internet and electronic network activity information.
Geolocation information where an applicable feature collects it.
Professional or employment-related information for authorised business users.
Inferences derived from customer activity for enabled marketing and loyalty features.
Sensitive personal information, to the extent that any collected information falls within the statutory definition.
These categories may be collected from individuals, participating operators, connected devices, and authorised service providers.
We use this information for the service, operational, security, financial, and marketing purposes described in this policy.
We may disclose applicable categories to service providers, payment processors, participating operators, and other recipients identified in Section 8 for the purposes described there.
Bubblepay does not sell or share personal information as those terms are defined under the CCPA/CPRA and, as stated in our existing policy, has not done so during the preceding 12 months.
Where required by California law, eligible residents may exercise their rights to know, access, correct, delete, and limit certain uses of sensitive personal information, as applicable.
Where relevant rights exist, residents may also request information about automated decision-making or profiling, consistent with applicable law and effective dates.
Requests may be submitted to:
Where legally required, we will provide an appropriate appeal or review mechanism, designated rights-request methods, and applicable opt-out controls.
We will honour legally recognised opt-out preference signals where required.
17. Privacy Rights for European Union and EEA Residents
Where the GDPR applies, individuals may have the following rights:
Right of access
To request confirmation of processing and access to personal data.
Right to rectification
To request correction of inaccurate or incomplete personal data.
Right to erasure
To request deletion of personal data in circumstances covered by the GDPR.
Right to restriction
To request restrictions on certain processing activities.
Right to data portability
To receive eligible personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
Right to object
To object to processing based on legitimate interests in applicable circumstances, and to object to direct marketing.
Right to withdraw consent
To withdraw consent at any time where processing relies on consent.
Rights relating to automated decision-making
To exercise applicable protections against decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.
Requests may be submitted to:
Where Bubblepay acts as a controller, we will generally respond to valid GDPR requests within one month, subject to permitted extensions and exceptions.
You also have the right to lodge a complaint with the competent data protection supervisory authority in your EU or EEA Member State.
Where Bubblepay is required to designate an EU representative or data protection officer, the relevant contact details will be provided in this policy or a supplementary notice.
18. Automated Processing and Profiling
Certain Bubblepay features may use customer transaction history, loyalty activity, spending patterns, and visit frequency to support automated customer grouping, loyalty calculations, and marketing campaign selection.
For example, a participating laundromat may use these tools to identify customers eligible for rewards or promotional communications.
Such processing is subject to applicable privacy law and the permissions and settings configured by the participating operator.
Where applicable law requires information about automated decisions that have legal or similarly significant effects, we will disclose the relevant processing, the categories of information involved, and any required rights or safeguards.
[Publication verification: confirm whether any fraud, payment, account access, or other automated decisions have legally significant or similarly significant effects. If so, provide the required decision-specific disclosures.]
19. Children’s Privacy
The Bubblepay platform is not directed at children under 13, and we do not knowingly collect personal information from them in violation of applicable law.
Where higher age thresholds or additional protections apply in a particular jurisdiction, we comply with the applicable requirements.
If you believe a child has provided personal information inappropriately, please contact us so we can review the matter and take appropriate action.
20. Data Breaches and Incident Notifications
We maintain procedures for responding to suspected and confirmed information security incidents.
Where a personal data breach triggers legal notification obligations, we will notify relevant operators, authorities, and affected individuals in accordance with applicable requirements.
These may include Australia’s Notifiable Data Breaches scheme, the GDPR’s breach notification requirements, and relevant US state laws.
Notifications will be provided within applicable legal timeframes and will include required information about the incident and relevant protective steps.
21. Third-Party Websites and Services
Our website and applications may link to third-party websites, applications, or services, including payment and accounting platforms.
Their handling of personal information is governed by their respective privacy notices and legal obligations.
We encourage users to review those notices before sharing information with third parties.
22. Changes to This Privacy Policy
We may update this Privacy Policy as our products, services, technologies, or legal obligations change.
When changes are made, we will update the date at the top of this policy.
Where required by law or appropriate given the nature of a change, we will provide additional notice or request renewed consent.
The current version will remain available through our website.
23. Contact and Privacy Enquiries
For privacy enquiries, access requests, corrections, deletion requests, or complaints, please contact:
SMRT Systems, Inc. — Bubblepay
1017 Main Campus Dr STE 1600
Raleigh, NC 27606
United States
Email: support@bubblepayportal.com
Website: https://www.bubblepay.com.au
EU representative (if legally required): [Name, address, and contact information]
Data protection officer (if legally required): [Contact information]
We will review privacy-related enquiries and respond within the timeframes required by applicable law.