Privacy Policy

Effective 1 August 2026

This policy explains what data BAM collects, why we collect it, who else processes it, and what rights you have. BAM is provided by Celtic Knots, which is the data controller for the purposes of this policy.

We never sell your data, and we do not use your business records for advertising or to train models.

1. What we collect

Account data

Your email address and authentication identity. If you sign in with Google or Facebook, we receive your email address and basic profile identifier from that provider — we never receive your password for it. We also store the organisation, business and access-account records that structure your BAM account.

Business records you enter

Whatever you record in BAM: customers, suppliers, products, services, warehouses, transactions, invoices, expenses, ledgers and related notes. This may include personal data about your own customers and suppliers. You control this content; we process it to provide the service to you.

Technical and security data

IP address, device and browser type, and timestamps of requests. We use this to keep accounts secure, prevent abuse and diagnose faults.

Diagnostic telemetry

When something goes wrong, BAM sends an error report so we can fix it. This telemetry uses a strict allowlist: anything not explicitly permitted is discarded before it leaves your device or our servers. It is designed so that it cannot carry:

Session replay is disabled, and we do not enable our telemetry provider's default personal-data collection.

Payment data

We do not collect or store your card details. Payments are processed by Paddle as Merchant of Record — see section 3.

2. Why we use it, and our legal basis

PurposeLegal basis
Providing BAM and storing your recordsPerformance of our contract with you
Authentication and account securityPerformance of contract; legitimate interests
Billing, subscriptions and refundsPerformance of contract; legal obligation
Fixing faults and improving reliabilityLegitimate interests in a working service
Preventing fraud and abuseLegitimate interests; legal obligation
Support correspondencePerformance of contract; legitimate interests

3. Who else processes your data

We use a small number of infrastructure providers ("sub-processors"). Each processes data only to provide their service to us.

ProviderWhat it does
SupabaseDatabase, authentication and server functions
PowerSyncSynchronising data between your device and our database
CloudflareHosting, content delivery and network security
PaddleMerchant of Record — payments, tax, invoicing and refunds
SentryError and performance diagnostics (scrubbed, as described above)
Google / MetaOnly if you choose to sign in with Google or Facebook

Paddle.com is the Merchant of Record for all our orders. Paddle collects and processes your billing and payment information under its own privacy policy, and shares with us only what we need to service your subscription — such as your plan, billing status and country. We never see your full card number.

4. Where your data is processed

Our providers operate globally, so your data may be processed in countries other than your own, including the United States, the European Union and the Asia-Pacific region. Where data is transferred internationally, we rely on our providers' contractual safeguards, such as Standard Contractual Clauses.

5. Data on your device

BAM keeps a local copy of your business data on your device so you can work offline. That copy lives in your device's application storage. If you sign out, BAM clears the local copy. If you lose the device, sign out remotely by changing your password, and secure the device itself — we cannot remotely wipe local data.

6. How long we keep it

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your personal data, to withdraw consent, and to receive your data in a portable format. To exercise any of these, email support@bamerp.com from your account address. We will respond within the time your local law requires, and within one month where no shorter period applies.

If you record personal data about your own customers or suppliers in BAM, you are the controller of that data and we process it on your behalf. Requests from those individuals should be directed to you, and we will support you in answering them.

You also have the right to complain to your local data protection authority.

8. Security

Data is encrypted in transit using TLS and encrypted at rest by our infrastructure providers. Access to production systems is restricted, credentials are held outside our source code, and permissions inside BAM are enforced at the database level rather than only in the app. No system is perfectly secure, but we treat access to your books as something to be tightly controlled.

9. Cookies

BAM uses only what it needs to function: storage for your login session and your local data copy. We do not use advertising or cross-site tracking cookies on this website or in the app.

10. Children

BAM is business software and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

11. Changes to this policy

We will update this policy as the product and our obligations change. Where a change materially affects your rights, we will give reasonable notice. The effective date at the top always reflects the current version.

12. Contact

Celtic Knots — support@bamerp.com