Privacy Notice
How Bulk handles information about website visitors, business contacts and people using the Bulk platform.
Effective
Who we are and what this notice covers
ManagementSupport LLC, trading as Bulk (“Bulk”, “we”, “us”), provides the Bulk manufacturing and laboratory operations platform. Contact us at support@trybulk.app.
This notice covers trybulk.app and www.trybulk.app, our business communications, and personal information handled in connection with Bulk workspaces and support. It explains our own processing and how that differs from processing on a customer’s instructions. It is not a substitute for your employer’s or workspace administrator’s privacy notice.
Bulk is the controller of information used to manage its website, enquiries, business relationships and its own legal obligations. For personal information a customer puts into its workspace, Bulk generally acts as processor or service provider and the customer determines why it is used. The Data Processing Agreement governs that processing. Our role for support and diagnostic information depends on why it is collected: resolving a customer’s issue on its instructions differs from managing our own business communications.
Information we handle
We obtain information directly from you, from your organisation and authorised users, from integrations your organisation enables, and from the operation of our services.
| Context | Information and source | Purpose |
|---|---|---|
| Business enquiries | Name, work email, organisation, message and correspondence you send | Respond, evaluate requirements and manage the relationship |
| Template downloads | Email, requested template, marketing choice, request time, IP address and browser; delivery and download events | Deliver the file, prevent abuse, maintain consent evidence and understand fulfilment |
| Website analytics, unless rejected | Page visits, interactions, device/browser information and session replay of the website; aggregate traffic statistics through Ahrefs Web Analytics | Understand and improve the website |
| Website delivery and security | Request and connection information such as IP address, URL, browser, time and error information | Deliver the site, investigate failures and prevent abuse |
| Bot and crawler analytics | For each request to trybulk.app and www.trybulk.app: URL, IP address, user agent, referrer, request method, response status and content type, sent from our network edge to Ahrefs | Identify and report search-engine, AI and other bot traffic |
| Accounts and workspace administration | Identity, work contact details, roles, site membership, authentication and session information | Provide access, administer workspaces and protect accounts |
| Customer workspace records | Information entered or uploaded by authorised users, including work assignments, attendance, training, customer/supplier contacts, documents, photographs, signatures and activity history | Provide the customer-selected workflows and maintain their records |
| Support and diagnostics | Messages, attachments and diagnostic information; where enabled, identifiable product session replay and assistance sessions | Investigate issues and provide support |
| Billing and contracting | Business contact, order, invoice, payment-status and transaction information | Administer the commercial relationship and meet accounting obligations |
Safety reports and other customer-authored records may contain health information or other sensitive information. Customers must determine an appropriate legal basis and safeguards for what they enter. The fact that a field or upload exists does not establish that a particular use is lawful or approved.
Website forms and communications
The early-access form opens your email application with a message addressed to Bulk. We receive the information only if you send that message. The website’s workspace-name sign-in directs your browser to that workspace. The static “look up by email” panel does not currently submit an address or perform a lookup.
A template request is submitted to our download service. Marketing is optional and is not required to obtain the file. If you opt in, we record the choice, time and version of the notice shown. We also record whether and when a requested file is downloaded and notify the team responsible for fulfilling template requests. A download notification is not permission to add you to a marketing campaign.
We may send service messages necessary for a request or relationship even when you decline marketing. To stop marketing, use the unsubscribe mechanism in a marketing message or email us. We retain limited suppression information where necessary to respect that choice.
Cookies, analytics and session replay
Website page analytics and session replay run unless you reject them. Rejecting them is how you object. You can also withdraw permission using the cookie controls. Alongside our self-hosted Umami analytics, the website uses Ahrefs Web Analytics, operated by Ahrefs Pte. Ltd., for aggregate traffic statistics. It sets no cookies or persistent identifiers, and the same rejection stops it loading. Ahrefs states that it may use aggregated, anonymised data to improve its services and in published studies. Separately, each request to trybulk.app and www.trybulk.app passes through a Cloudflare Worker that sends the request’s URL, IP address, user agent, referrer, method, response status and content type to Ahrefs, so Ahrefs can identify and report search-engine, AI and other bot traffic (Ahrefs Bot Analytics). This happens at our network edge before any browser choice can be read, so the cookie controls do not affect it. You can object to it by contacting us. See the Cookie & Similar Technologies Notice for storage, withdrawal and device-specific choices.
Website consent does not govern a customer workspace on another host. The product contains a separate, deployment-controlled OpenReplay integration. When enabled, it can record page content and interactions, diagnostic and network metadata, and account identifiers including name, work email, organisation, site and roles. Input masking and URL sanitisation reduce capture; they do not make every displayed record anonymous. Product remote-control assistance requests confirmation separately from session recording. Ask your workspace administrator about the settings and applicable notice for your deployment.
Why we process information
Where EU or UK data-protection law applies to our controller activities, we rely on the following bases, according to the actual purpose:
- Consent: optional marketing where we request consent. Consent can be withdrawn without affecting the lawfulness of earlier processing.
- Legitimate interests: responding to business representatives, fulfilling requested templates, administering business relationships, keeping systems secure, preventing abuse, establishing or defending legal claims, understanding crawler and bot traffic, and website analytics and session replay, which you can reject. We consider the effects on individuals and apply appropriate safeguards. You may object to processing based on legitimate interests.
- Contract or pre-contract steps: where you personally are a contracting party or ask us to take steps toward a contract with you. A contract with your employer does not itself make this basis applicable to all employee information.
- Legal obligation: records and disclosures required by applicable accounting, tax, regulatory or other law.
Customer workspace processing follows the customer’s documented instructions. The customer is responsible for identifying its lawful basis, including any additional condition needed for sensitive information.
Who receives information
Access is limited by purpose: authorised Bulk personnel, suppliers needed to provide the relevant service, the customer’s authorised users and administrators, and integrations the customer chooses. Providers may supply hosting, traffic delivery, email, AI processing, diagnostic storage or payment services. The Subprocessor List distinguishes services by purpose and deployment applicability; a provider relevant to billing does not necessarily receive production records.
We may disclose information when required by law, to protect rights and security where lawful, to professional advisers under appropriate duties, or in a business transaction subject to appropriate confidentiality and continued protection. We do not authorise a supplier to use customer workspace information for its own unrelated marketing.
AI and customer-connected services
Using an AI feature may send the selected documents, prompts, context and records to an external model service. The current application supports Google Vertex AI through a global endpoint and an optional OpenRouter fallback for selected failed AI requests. A global endpoint is not a promise that processing stays in the workspace’s hosting country. Customer-connected AI and integrations have their own recipients and terms. The AI & Data Handling Notice explains these boundaries.
Processing locations and international transfers
Bulk is a US contracting entity. A workspace’s primary hosting location does not, by itself, describe all processing locations. Network delivery, email, diagnostics, AI, backups and authorised access must be considered separately. The applicable order and processing schedule identify the customer’s agreed arrangements; website and business-contact information is not automatically covered by a workspace residency commitment.
Where a restricted international transfer occurs, we must use a mechanism permitted by the applicable law, such as an applicable adequacy decision or appropriate contractual safeguards with any required assessment and supplementary measures. EU standard contractual clauses and the UK Addendum are used only where applicable and completed for the relevant processing. We do not claim participation in a transfer certification programme merely by using a participating supplier. Contact us for information about the safeguards applicable to your information and how to obtain a copy, subject to necessary redactions.
How long information is retained
We assess retention by purpose, contractual requirements, legal obligations, security needs and the time needed to resolve disputes. Expiry of a link or closing an account is not the same as erasing the underlying records.
| Information | Retention approach |
|---|---|
| Website analytics choice | Stored in that browser until replaced or cleared; this does not specify analytics-server retention |
| Enquiries and business correspondence | Kept while handling the enquiry or relationship and as needed for follow-up, legal obligations and claims |
| Template request and consent evidence | Kept for fulfilment, abuse prevention and evidence of preferences; the download link normally expires after seven days, but that expiry does not delete the request |
| Marketing contacts | Used until withdrawal or another reason to stop; minimal suppression and compliance evidence may remain |
| Customer records, audit history and files | Governed by the customer’s instructions, agreed processing schedule and applicable legal requirements |
| Diagnostics, logs, AI records and backups | Separate retention and deletion arrangements apply to the relevant system; primary-record deletion does not automatically remove every copy |
There is no universal customer-configurable purge schedule across every Bulk record type. Contact us or your administrator for the applicable retention arrangement. We do not promise immediate erasure from backups or a fixed deletion deadline that has not been agreed and operationally verified.
Your choices and rights
Depending on the law and circumstances, you may request access, correction, deletion, restriction or portability, object to processing, or withdraw consent. Some rights have exceptions, including when records must be retained by law or to resolve claims. We may request proportionate information to verify identity; do not send identity documents unless requested through an appropriate channel. We respond within the period required by applicable law and explain any lawful extension or refusal.
For information controlled by your organisation, contact its administrator or privacy contact first. We can pass a request to the customer and assist it under the DPA, rather than independently deleting records it controls. To exercise rights concerning Bulk’s controller activities, contact support@trybulk.app. You may complain to the UK Information Commissioner’s Office or the competent supervisory authority in the EU, including where you live or work or where an alleged infringement occurred. Contacting us first is not a condition of that right.
Where applicable US state law grants rights, these may include access, correction, deletion, portability, an authorised-agent request, an appeal, and opting out of specified uses such as sale, targeted advertising or certain profiling. Applicability and exceptions depend on the law and our activities, not simply the governing law of our service contract. We will not unlawfully discriminate against you for exercising a right. Submit a request or appeal to the contact above, identifying the decision you want reviewed. We do not use the website analytics integration described here to run third-party targeted advertising or sell its records for money. Any broader statutory sale or sharing assessment must consider the actual arrangement, not only whether money changes hands.
Security, children and changes
We use access controls and other safeguards appropriate to the service and risk; see Security & Support. No system is guaranteed to prevent every incident. Do not send passwords or unnecessary sensitive information in an enquiry.
Bulk’s services are directed to business organisations and their authorised users, not to children as consumers. An organisation that uses employee or trainee records is responsible for any additional requirements relating to young workers.
We update this notice when our processing changes and identify the version and date. Where required, we provide additional notice or obtain consent before a new use. A notice update does not amend an existing customer’s negotiated agreement by itself.