Privacy Policy

Last updated: 13 July 2026

1. Who we are

BOMwatch is operated by Tim Stevens Ltd (England and Wales), the data controller for the personal data described here. Contact: hello@getbomwatch.com.

2. What we collect and why

• Account data — when you sign in with Xero we receive your name, email address, and Xero organisation name and identifier. We use these to operate your account and contact you about the service.
• Xero connection tokens — encrypted-in-transit credentials that let BOMwatch read your inventory items and sales invoices, and (if you enable automatic sync) create stock-deduction invoices. Stored securely; used solely to provide the service.
• Your settings — thresholds, your Bill of Materials sheet URL, and feature preferences.
• Stock and invoice data — read from your Xero on demand to display your dashboard and calculate Build-to-Stock limits. We process this data live; we do not build a copy of your accounting records.
• Billing — payments are processed by Stripe; we never see or store your card details. We store your Stripe customer and subscription identifiers and plan status.
• AI summaries — if you use the AI summary feature, your current stock levels (item names, codes and quantities) are sent to Anthropic's API to generate the text. No personal data is included.

3. Cookies

We use a single essential session cookie to keep you signed in. No advertising or cross-site tracking cookies.

4. Who we share data with

Service providers who help us run BOMwatch: Render (hosting and database), Stripe (payments), Xero (your accounting platform, at your instruction), Anthropic (AI summaries, stock data only), and Google (only if you host your BOM as a published Google Sheet, which you control). We do not sell personal data.

5. Retention

Account data is kept while your account is active. If you close your account (or disconnect BOMwatch in Xero and ask us to delete), we delete your account record, settings and stored tokens within 30 days. Billing records are retained as required by tax law.

6. Your rights

Under UK GDPR you may request access to, correction of, or deletion of your personal data, and you may object to or restrict processing. Email hello@getbomwatch.com and we'll respond within one month. You may also complain to the ICO (ico.org.uk).

7. Security

All traffic is encrypted (HTTPS). Xero access uses OAuth 2.0; tokens are stored server-side and never exposed to your browser. Access to production systems is limited to authorised personnel.

8. Changes

We'll post any changes here and notify you of material changes by email or in the product.