Privacy Policy

The two roles we play

For your own account data, like your email and sign-in sessions, bcns is the controller: we decide why that data is collected and how it's used.

For the data you connect from Shopify, Meta Ads, monday.com, QuickBooks Online, Google Drive, or a meeting-notes folder, bcns is a processor. You are the controller of that data, and you decide what gets connected and why.

What we collect

Contact form: your name, business, email and message, sent through Web3Forms.

Accounts: the email addresses of the account owner and any team members you invite, plus sign-in sessions.

Shopify, if you connect it: order totals, statuses, line items and refunds going back 13 months; products, variants and prices; inventory counts; Shopify Payments payouts; and, on each order, the customer's ID, email and display name only, with no phone number or address.

Meta Ads, if you connect it: your ad account's timezone and currency; campaign and ad details, including ad creative; daily performance numbers like spend, impressions, clicks and reach; and copies of your ad creative images, which we store.

monday.com, if you connect it: the one board you point us at, its name, columns, groups, and every item's name, dates, group and column values. Whatever your team keeps in those columns, including names or emails, comes with it.

QuickBooks Online, if you connect it: through Intuit's com.intuit.quickbooks.accounting permission, we read (and never write) your Purchase and Bill records going back 24 months: the full record as QuickBooks returns it, including date, amounts and currency, the payee (a vendor, customer or employee name), memo, line descriptions and accounts, document number, and any address QuickBooks attaches to a bill or check.

Google Drive and meeting notes, if you connect them: for a meeting-notes folder, the full text of the notes, which can include the names of people in the meeting and what they said. For a Drive folder, file names, types, sizes, dates, links, and thumbnail images we copy and store. We don't touch the underlying file contents in Drive.

Billing: if you pay by card, Stripe handles your card details. We keep only your Stripe customer and subscription IDs and when you last paid.

Access tokens: for each source you connect, we store a token that lets our sync service read that source on your behalf. See "Security" below for how we protect it.

How we use it

We use your connected data to sync it, store it, and show it back to you in your dashboard, and to make it available to the AI tools you choose to connect.

We never sell your data, use it to run ads, build profiles of people in it, or use it to train an AI model.

AI tools and MCP

When you connect an AI assistant like Claude or ChatGPT to the MCP server, your data goes to the AI provider you picked, because you asked it to, under your own agreement with that provider.

bcns does not send your data to any AI provider on its own, and we never train models on your data.

Who we share it with

We share data with the vendors below only to run the service. We disclose data when the law requires it, and in a business transfer only with the protections this policy already promises.

• Supabase: hosts our database, sign-in system and file storage for connected-source data, tokens and accounts
• Google Cloud: runs the background job that syncs each connected source into our database
• DigitalOcean: hosts the Connect hub, the MCP server, client apps, and nightly backups of client apps' databases
• Resend: delivers internal operational email, like alerts when a deletion request comes in
• Web3Forms: delivers the marketing site's contact form
• Cloudflare: provides DNS and TLS for some client apps
• Vercel: hosts this marketing site
• Stripe: processes subscription payments; card details go to Stripe, never to bcns

Google user data

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

We use that data only to provide the features you see in the product. We don't sell it to advertisers or data brokers, don't use it for credit or employment decisions, and don't use it to train or improve an AI model beyond your own personalized use. No one reads it by hand except with your agreement, for security, for legal compliance, or as anonymous internal operations.

How long we keep it

While your account is active, we keep your connected data current and available.

Thirty days after your account ends, we delete the copy of your connected-source data that we hold. We don't keep an archive or backup export of it after that.

During those 30 days, you can ask us for an export of your data.

Backup copies our database provider keeps as part of normal operations roll off on its normal backup rotation, currently 7 days, after we delete your data.

Requesting deletion

To delete your account or your data, email nseluga@bcn-services.com.

If you're a customer of one of our clients and want your Shopify order data removed, Shopify sends us that request directly. We handle a shop's full data removal ("shop/redact") by hand, inside Shopify's 48-hour window, and a customer-level removal request by hand as well.

If you interacted with a Meta ad and want your data removed, email nseluga@bcn-services.com and we'll confirm by email once it's done.

These requests are handled by a person, not automatically; we'll confirm with you once each one is complete.

Your account owner can also disconnect QuickBooks Online, Meta Ads, monday.com, Google Drive or meeting notes in the hub. We then delete the token and data we stored for that source and cancel our access with Intuit or Meta, and with Google once Drive and meeting notes are both disconnected. If they were connected with different Google accounts, also remove bcns in both accounts' Google settings.

monday.com gives us no way to cancel access, so remove bcns in monday.com as well.

Security

Data is encrypted in transit and at rest by our database provider; access tokens are stored in a table only our sync service can read.

Your data is also isolated from every other client's by row-level database rules, and only bcns's operator has broader access.

Your rights

You can ask to see, correct, delete, or export your data at any time. Email nseluga@bcn-services.com.

If your own customers want to exercise rights over data you hold about them, they should contact you, not us; we hold that data on your behalf.

bcns is not intended for consumers or for use outside the United States.

Where your data is stored

Your data is stored in the United States.

Cookies and Do Not Track

We use a sign-in cookie so you stay logged in, and short-lived cookies during the moment you connect a new source. That's all: no analytics, advertising or tracking cookies.

Because we don't track you across sites, a Do Not Track signal from your browser doesn't change anything here; there's nothing to turn off.

Children

bcns is a business tool. It isn't directed at, and we don't knowingly collect data from, anyone under 13.

Changes to this policy

If we make a material change to this policy, we'll update the date at the top of this page and, where the change matters to you, tell you directly.

Contact us

Questions about this policy: nseluga@bcn-services.com.