Privacy Policy

Effective date: 1 July 2026 Â· Last updated: 5 July 2026

This policy explains what data BMS SUITE collects, why, and your rights regarding it. By registering an account you confirm you have read and accepted these terms.

1. Who We Are

BMS SUITE ("we", "our", "the Service") is an Enterprise Resource Planning platform operated by the BMS team. We provide inventory, sales, finance, payroll, and related business management software as a subscription service (SaaS). For enquiries contact: privacy@bmssuite.online.

2. Data We Collect

Account data: name, email address, username, and hashed password provided during registration.
Organisation data: company name, preferred currency, and configuration settings.
Business data: inventory records, sales and purchase transactions, financial entries, payroll records, and any other data you enter into the system.
Payment data: name, email, phone number, and order reference used during checkout. We do not store card numbers or mobile money PINs â€” payments are processed by third-party gateways.
Usage data: IP addresses, browser type, and access logs collected automatically for security and abuse prevention.

3. How We Use Your Data

To create and manage your account and organisation workspace.
To provide, maintain, and improve the BMS SUITE service.
To send transactional emails (email verification, password resets, license key delivery).
To process subscription payments and generate license keys.
To detect and prevent fraud, abuse, and security threats.
To comply with applicable laws and regulations.

4. Data Sharing

We do not sell your data. We share data only with:

Payment gateways (e.g. AzamPay) â€” only the data required to process a payment.
Email providers â€” to deliver system-generated emails.
Cloud infrastructure (Neon PostgreSQL, hosting providers) â€” solely for data storage and service operation.
Law enforcement â€” only when required by law or a valid court order.

5. Data Retention

Account and business data is retained for as long as your account is active. When you delete your account, your data is retained for a 60-day recovery window during which you can restore it in full, then permanently erased — except where we are required by law to retain certain records longer (e.g. financial records). See our Data Retention Policy for details.

6. Security

All data is transmitted over HTTPS. Passwords are hashed using industry-standard algorithms and are never stored in plain text. License keys are hashed with PBKDF2-HMAC-SHA256 and a unique salt â€” we cannot recover the raw key once issued. Access tokens are short-lived JWTs stored as httpOnly cookies.

7. Your Rights

Access: You may request a copy of the personal data we hold about you.
Correction: You may update your account information at any time.
Deletion: You may request deletion of your account and associated data.
Portability: You may request your business data in a machine-readable format.
Objection: You may object to processing in certain circumstances.

To exercise any right, email privacy@bmssuite.online.

8. Cookies

We use httpOnly cookies solely to maintain your login session (JWT access and refresh tokens). We do not use tracking or advertising cookies.

9. Children

BMS SUITE is a business tool intended for users aged 18 and over. We do not knowingly collect data from minors.

10. Changes to This Policy

We may update this policy. We will notify registered users by email if changes are material. Continued use of the service after the effective date constitutes acceptance.

11. Contact

For any privacy-related questions or to exercise your rights: privacy@bmssuite.online