Privacy Policy
Effective 1 August 2026
This policy explains what data BAM collects, why we collect it, who else processes it, and what rights you have. BAM is provided by Celtic Knots, which is the data controller for the purposes of this policy.
We never sell your data, and we do not use your business records for advertising or to train models.
1. What we collect
Account data
Your email address and authentication identity. If you sign in with Google or Facebook, we receive your email address and basic profile identifier from that provider — we never receive your password for it. We also store the organisation, business and access-account records that structure your BAM account.
Business records you enter
Whatever you record in BAM: customers, suppliers, products, services, warehouses, transactions, invoices, expenses, ledgers and related notes. This may include personal data about your own customers and suppliers. You control this content; we process it to provide the service to you.
Technical and security data
IP address, device and browser type, and timestamps of requests. We use this to keep accounts secure, prevent abuse and diagnose faults.
Diagnostic telemetry
When something goes wrong, BAM sends an error report so we can fix it. This telemetry uses a strict allowlist: anything not explicitly permitted is discarded before it leaves your device or our servers. It is designed so that it cannot carry:
- names, email addresses, phone numbers, addresses, notes, descriptions or search text;
- passwords, tokens, API keys, cookies or authorisation headers;
- card or payment-method details;
- transaction amounts, balances, stock quantities, customer or supplier names, or report contents.
Session replay is disabled, and we do not enable our telemetry provider's default personal-data collection.
Payment data
We do not collect or store your card details. Payments are processed by Paddle as Merchant of Record — see section 3.
2. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Providing BAM and storing your records | Performance of our contract with you |
| Authentication and account security | Performance of contract; legitimate interests |
| Billing, subscriptions and refunds | Performance of contract; legal obligation |
| Fixing faults and improving reliability | Legitimate interests in a working service |
| Preventing fraud and abuse | Legitimate interests; legal obligation |
| Support correspondence | Performance of contract; legitimate interests |
3. Who else processes your data
We use a small number of infrastructure providers ("sub-processors"). Each processes data only to provide their service to us.
| Provider | What it does |
|---|---|
| Supabase | Database, authentication and server functions |
| PowerSync | Synchronising data between your device and our database |
| Cloudflare | Hosting, content delivery and network security |
| Paddle | Merchant of Record — payments, tax, invoicing and refunds |
| Sentry | Error and performance diagnostics (scrubbed, as described above) |
| Google / Meta | Only if you choose to sign in with Google or Facebook |
Paddle.com is the Merchant of Record for all our orders. Paddle collects and processes your billing and payment information under its own privacy policy, and shares with us only what we need to service your subscription — such as your plan, billing status and country. We never see your full card number.
4. Where your data is processed
Our providers operate globally, so your data may be processed in countries other than your own, including the United States, the European Union and the Asia-Pacific region. Where data is transferred internationally, we rely on our providers' contractual safeguards, such as Standard Contractual Clauses.
5. Data on your device
BAM keeps a local copy of your business data on your device so you can work offline. That copy lives in your device's application storage. If you sign out, BAM clears the local copy. If you lose the device, sign out remotely by changing your password, and secure the device itself — we cannot remotely wipe local data.
6. How long we keep it
- Business records — for as long as your account is open, and afterwards only where we must keep them for legal or accounting reasons.
- Account data — for the life of the account, then deleted or anonymised.
- Diagnostic telemetry — retained for a limited period by our telemetry provider, then discarded.
- Raw payment and webhook payloads — purged automatically 30 days after they reach a settled state.
- Billing and tax records — retained by Paddle for the period their legal obligations require.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your personal data, to withdraw consent, and to receive your data in a portable format. To exercise any of these, email support@bamerp.com from your account address. We will respond within the time your local law requires, and within one month where no shorter period applies.
If you record personal data about your own customers or suppliers in BAM, you are the controller of that data and we process it on your behalf. Requests from those individuals should be directed to you, and we will support you in answering them.
You also have the right to complain to your local data protection authority.
8. Security
Data is encrypted in transit using TLS and encrypted at rest by our infrastructure providers. Access to production systems is restricted, credentials are held outside our source code, and permissions inside BAM are enforced at the database level rather than only in the app. No system is perfectly secure, but we treat access to your books as something to be tightly controlled.
9. Cookies
BAM uses only what it needs to function: storage for your login session and your local data copy. We do not use advertising or cross-site tracking cookies on this website or in the app.
10. Children
BAM is business software and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.
11. Changes to this policy
We will update this policy as the product and our obligations change. Where a change materially affects your rights, we will give reasonable notice. The effective date at the top always reflects the current version.
12. Contact
Celtic Knots — support@bamerp.com