bamboo is operated by Bridgehead Communications Ltd ("bamboo", "we", "us"). This policy explains what we collect, why, and what a care provider controls when they use bamboo.
What we collect
- Account details: your name, email address, and the provider profile you create (name, postcode, care type, CQC data we look up on your behalf).
- Content you create in bamboo: campaigns, landing page copy, press releases, newsletters, review replies, and media contact lists.
- Enquiry data captured through your hosted landing pages (name, contact details, message). This belongs to you, not us.
- Connected-account data: if you connect Google Ads, Meta Ads, Google Business Profile, a Facebook Page, an Instagram professional account, a LinkedIn Company Page, Gmail, or Outlook, we store an access token so bamboo can act on your behalf, and the minimum account identifier needed (e.g. your ad account ID, Page ID or connected mailbox address).
Gmail and Outlook access
If you connect Gmail or Outlook, bamboo requests permission only to send email as you, specifically the gmail.send or Microsoft Graph Mail.Send scope. bamboo cannot read your inbox, your contacts, or any other email through this connection. Every send using this connection happens only when you click send on a specific press release or newsletter inside bamboo; nothing is sent automatically or without your review. You can revoke this access at any time from bamboo's Connections page, or directly from your Google or Microsoft account security settings.
Google user data
If you connect a Google account, bamboo asks Google only for the access each feature needs:
- Gmail (
gmail.sendand your email address): to send a press release or newsletter from your own address when you press send. bamboo cannot read, search or delete your email. - Google Business Profile (
business.manage): to list the locations you manage, read the reviews on the one you choose, post the replies you approve and publish the posts you schedule. - Google Ads (
adwords): to list the ad accounts you can reach, create the campaigns you approve in the one you choose, and read their daily results, such as impressions, clicks and spend.
We store the access token Google issues, the ID and name of the account or location you choose, and the records bamboo creates there: posts, review replies, campaigns and their results. Reviews from your Business Profile are stored so you can read and answer them in bamboo. When bamboo sorts a review or drafts a reply to it, the review text is sent to Anthropic's API for that purpose only, and Anthropic does not use API inputs to train its models.
bamboo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the features above. We do not sell it, use it for advertising, or let anyone read it except with your permission, for security or where the law requires. We do not use it to develop, improve or train generalised AI or machine learning models.
Disconnecting a Google account on bamboo's Connections page deletes the stored access token straight away. You can also remove bamboo at any time from your Google Account under Third-party apps and services.
Facebook, Instagram and LinkedIn access
If you connect a Facebook Page, bamboo asks Meta for permission to list the Pages you manage, read basic details of the Page you choose and of the Instagram professional account linked to it, and publish posts and photos to them. If you connect Meta Ads, bamboo asks for permission to create and manage campaigns in the ad account you choose and to read their results. If you connect LinkedIn, bamboo asks for permission to see which Company Pages you administer and to publish posts to the one you choose.
From these connections we store the Page or ad account ID and name, the Page and Instagram profile picture and username, the access token the platform issues, and, for each post bamboo publishes, the post ID, its link and whether it went out. For Meta Ads we also store the IDs of campaigns bamboo created and their daily results, such as impressions, clicks and spend. bamboo does not read your personal Facebook profile, your friends or followers, your messages or the comments on your posts.
bamboo publishes only posts you have written or approved and then scheduled or sent yourself, and changes ads only when you ask it to. We use this data solely to provide those features to you. We do not sell it, use it for advertising or profiling, or share it with anyone other than the infrastructure vendors listed below.
Disconnecting Facebook, Instagram, Meta Ads or LinkedIn on bamboo's Connections page deletes the stored access token and Page details straight away. You can also remove bamboo from Facebook under Settings & privacy, then Business integrations. To have the rest of your data deleted, including post history, follow our data deletion instructions.
How we use it
- To operate the product: generate campaigns, host your landing pages, track enquiries, and run your local Presence Score.
- To send email you ask us to send: press releases, newsletters, and enquiry notifications.
- To improve accuracy: e.g. matching your profile to the correct CQC registration.
- We do not sell your data, and we do not use your connected Gmail/Outlook data for advertising.
Who we share it with
We use a small number of infrastructure vendors to run bamboo: Vercel (hosting), Neon (database), Resend (transactional email when you haven't connected your own mailbox), Anthropic (AI drafting of campaign copy and press releases), Ahrefs (SEO metrics, only if you've provided a website address), and Vercel Web Analytics and PostHog (counting visits and how the site is used, without cookies). We do not share your data with anyone else except where required by law.
Advertising cookies
On bamboo's own public pages (not on the landing pages we host for providers, and not inside the app), we ask before setting advertising cookies from Google, Meta and LinkedIn. If you accept, they tell us which of our ads brought you to the site and whether you then looked up your rank, asked for your report or asked for a demo, and they let those platforms show you our ads later. If you reject them, none of these tags load. We keep your answer in a cookie called bamboo_consent for 180 days, and you can change it at any time from “Cookie settings” at the foot of every page.
Screen recording on sign-in
On the sign-in and onboarding pages only, PostHog records how a visitor moves through the page (clicks, scrolling and timing) so we can see where people get stuck. These recordings mask every form field and every piece of text on screen, so they do not contain your email address, name or any provider details, and they stop as soon as you move to another page. Recordings are kept for 30 days.
Your rights
You can access, correct, export, or delete your data at any time. Email wwalter@bridgeheadcommunications.com and we will action the request within 30 days. Disconnecting any connected account (Gmail, Outlook, Facebook, Instagram, LinkedIn, Google or Meta Ads) immediately deletes bamboo's stored access token.
Contact
Bridgehead Communications Ltd, Temple Chambers, 3-7 Temple Avenue, London, EC4Y 0HP, United Kingdom. wwalter@bridgeheadcommunications.com