Privacy and data
The privacy notice and cookie information below are in force. The terms of service, upload terms and data use terms will be published before the service opens.
Terms of service
[To be published]
Upload terms
[To be published]
Data use and cyber security terms
[To be published]
Privacy notice
Who we are. BMSTools.io decides how your personal data is used. Contact us at enquiries@bms.tools.
What we collect. When you register interest: your name, work email, company, and optionally your role, phone number, how many sites you handle, and a message, plus which button or page brought you to the form. When you create an account: your work email, your company's email domain, when you accepted the terms and which version, and when you sign in. When you upload a file: the file, its name, size and fingerprint, your confirmation that you may share it, when you gave it, and the result. When you buy credits: your email, the pack, the amount, the number of credits and the time, kept by us. Stripe handles the card payment and we never see the card details. If you accept analytics cookies: the pages and buttons you use, how long you stay, your approximate location, and your device and browser type. In the tool, also sign-in, account creation, tab changes, uploads and decode results, with an account reference rather than your email address. We do not send your email address, what you type, file names or file contents to Google Analytics. If you email us: whatever you send.
Why we use it, and our legal basis.
- To reply to you, run your account, decode your files, keep a record of what was used and charged, and prevent misuse. Our contract with your company, and our legitimate interest in running the service.
- To send you product updates, only if you ticked the box. Your consent. You can withdraw it at any time.
- To understand how the site is used. Your consent, through the cookie notice.
Who receives it. Google Cloud in London (Cloud Run, Firestore and Cloud Storage), which runs the tool, holds accounts and stores uploaded files. Gmail, which sends sign-in codes and enquiry messages. Stripe, which takes payments. Google Analytics, if you accept analytics cookies. They process data for us. Stripe may process payment data outside the UK, under its own safeguards. We don't sell your data.
How long we keep it. Uploaded files and reports: 12 months after upload, or sooner if you delete them. Sign-in codes: 24 hours. Credits stay on the account until a file decodes. The account can be deleted only when no credits remain. If you delete your account, your email is removed from the account, the credit ledger and the payment record, and replaced with a reference that does not show the address. We keep a salted one-way fingerprint of the address so that mailbox cannot be given another free allowance. Ledger amounts and payment amounts are kept for the accounts. Analytics data: 14 months, the period set in Google Analytics.
Your rights. You can ask to see, correct or delete your data, to restrict or object to its use, and to withdraw consent. Email enquiries@bms.tools. You can also complain to the Information Commissioner's Office at ico.org.uk.
Cookies
We ask before setting any cookie that isn't essential. When you first visit, a notice asks whether you accept analytics cookies. Nothing is set until you choose. Rejecting is as easy as accepting, and the site works the same either way.
| Name | Set by | What it does | Lasts | Needs your consent? |
|---|---|---|---|---|
__session | BMSTools.io | Keeps you signed in to the strategy review tool. Only set when you sign in. The name is required by Firebase Hosting. | 30 days | No. The tool can't work without it. |
bms_consent | BMSTools.io. Held in your browser's storage and never sent to us. | Remembers your choice on the cookie notice. | 13 months | No. It only stores your choice. |
_ga | Google Analytics | Tells one visitor from another so visits can be counted. | 13 months | Yes |
_ga_ followed by our measurement ID | Google Analytics | Keeps track of a visit and the pages seen during it. | 13 months | Yes |
What we use analytics for
If you accept, Google Analytics tells us which pages are viewed, which buttons and links are clicked, which parts of a page are scrolled into view, how long a page stays open, how people arrived, roughly where they are (country and region) and what device and browser they use. In the tool it also records sign-in, whether an account was created, tab changes, uploads and whether a file decoded. Those are tied to an account reference, not your email address. We use this only to improve the site and the tool.
We don't use advertising, social media or marketing cookies. We've switched off Google's advertising features and its sharing of this data with other Google services. We don't send what you type into the sign-up form to Google. Google processes analytics data for us, and may process it outside the UK.
Changing your mind
You can change your choice at any time. If you withdraw consent, we stop analytics and delete the Google cookies we set.
You can also block or delete cookies in your browser settings. Find out how at aboutcookies.org.