Version 2 · Effective 2026-10-01 · Last updated 2026-09-12
Version 2.0 --- Effective 2026-10-01 · Last updated 2026-09-12
This policy explains how BOMSync, Inc. handles personal data. It is written to meet the transparency requirements of Articles 13 and 14 of the EU General Data Protection Regulation and the UK GDPR, and to provide the disclosures required by US state privacy laws.
BOMSync is a business-to-business platform. Most people whose data we handle are employees, contractors, or representatives of businesses that use BOMSync.
1. Two different roles
We handle personal data in two distinct capacities, and your rights differ depending on which applies.
As a controller, we decide why and how data is processed. This covers account registration, authentication, billing, support, security monitoring, and our own communications. Sections 3 to 16 of this policy describe that processing.
As a processor, we handle personal data on behalf of a customer, following their instructions. This covers personal data contained in the project files, bills of materials, submittals, supplier records, and other content our customers upload --- including data about their own staff, consultants, subcontractors, and suppliers. The customer is the controller of that data. Section 17 explains how to exercise your rights over it.
If you are unsure which applies, contact us and we will tell you.
2. Who we are and how to reach us
Controller: BOMSync, Inc., a Texas corporation 809 Paleface RR South, Spicewood, Texas 78669, United States privacy@bomsync.com
European Union and United Kingdom representatives
BOMSync is established in the United States. Where applicable law requires BOMSync to appoint a representative under GDPR Article 27 or UK GDPR Article 27, BOMSync will appoint the representative before commencing the processing that gives rise to that requirement and will publish the representative's current contact details in this Section. Until such details are published, privacy inquiries should be directed to privacy@bomsync.com.
Data Protection Officer: We have assessed our processing under Article 37 and have determined that we are not required to appoint a Data Protection Officer. Privacy matters are handled by our privacy team at the address above. If that assessment changes, we will update this policy.
3. Personal data we collect as a controller
Category Examples Source
Identity and Name, work email, job You, or the customer
account title, company, account administrator who
role, language and invited you
locale settings,
profile photo where
provided
Authentication Password hashes, You, or your identity
multi-factor enrolment, provider
single sign-on
identifiers, session
tokens, login history
Billing and tax Billing contact, You or your
billing address, organization
purchase history, tax
identification number,
business status
evidence, exemption
certificates, primary
business location of
each licensed seat
Payment Payment method type, Our payment processor
last four digits,
expiry, authorization
results. We do not
store full card
numbers.
Support Messages, tickets, You
attachments, and call
or screen-share notes
Technical and usage IP address, device and Automatically, as you
browser use the Service
characteristics,
operating system, pages
and features used,
timestamps, referring
URL, error and
diagnostic logs
Security Authentication events, Automatically
access and
authorization logs,
anomaly detection
signals, audit trail
entries
Communications Sender, recipient, Automatically
metadata timestamps, delivery
and bounce status for
transactional email and
messages sent through
Azure Communication
Services
Marketing and Contact details, You events communication preferences, event registrations, webinar attendance
We do not intentionally collect special category data under Article 9, and we ask that you do not submit it.
4. Where we get your data when you did not give it to us
This section satisfies Article 14 of the GDPR.
If your employer or a customer administrator created your BOMSync account, we received your name, work email, job title, and role from that organization rather than from you. We use it to create and operate your account under the categories described in Section 5. You have the same rights over it as if you had provided it yourself.
We may also receive:
- From your identity provider, where your organization uses single sign-on: your identifier, email, and group membership.
- From our payment processor: verification and authorization results relating to your organization's payment method.
- From publicly available business sources, for marketing to business contacts: name, job title, employer, and business contact details.
5. Why we process it, and our legal basis
Purpose Legal basis (GDPR / UK GDPR)
Creating and operating your Article 6(1)(b) --- performance of account; providing the Service a contract, or steps before entering one
Authentication, session Article 6(1)(b); Article 6(1)(f) management, access control --- legitimate interest in securing accounts
Billing, invoicing, collections, Article 6(1)(b); Article 6(1)(c) and tax determination --- legal obligation for tax records
Verifying business status and tax Article 6(1)(c) --- legal identification obligation under applicable VAT and sales tax rules
Transactional messages: password Article 6(1)(b); Article 6(1)(f) resets, invitations, security --- legitimate interest in alerts, service notices operating the Service
Customer support Article 6(1)(b)
Security monitoring, abuse and Article 6(1)(f) --- legitimate fraud prevention, audit logging interest in protecting the Service and our customers
Maintaining and improving the Article 6(1)(f) --- legitimate Service, using aggregated or interest in improving a service pseudonymised data where possible our customers rely on
Marketing to business contacts Article 6(1)(f) --- legitimate interest in promoting a business service, subject to the right to object; consent where required by local law
Complying with legal, tax, Article 6(1)(c)
accounting, export control, and
sanctions obligations
Establishing, exercising, or Article 6(1)(f) defending legal claims
Where we rely on legitimate interests, we have carried out a balancing assessment. You may request a summary of it by emailing privacy@bomsync.com.
Providing your data. Identity, account, and billing data is necessary to enter into and perform our contract with your organization. Without it we cannot provide the Service. Everything else is optional.
6. Artificial intelligence and automated processing
Parts of the Service use machine learning, large language models, and optimization solvers to generate quantities, bills of materials, classifications, cost estimates, schedules, and similar outputs from the content our customers upload.
BOMSync does not use personal data, Customer Data, or generated output to train, fine-tune, or improve a general-purpose or foundation model. For BOMSync-managed AI services, BOMSync selects providers subject to the contractual and data-protection terms described in our DPA and Subprocessor List. For supported Customer BYOK configurations, the customer supplies its own provider credential and the customer's agreement with that provider governs provider-side retention, residency, training, and related processing. BOMSync stores supported BYOK credentials in Azure Key Vault and uses them only to perform customer-initiated or customer-configured AI requests. Current BOMSync-managed AI subprocessors are listed at /legal/subprocessors.
No automated decisions with legal or similarly significant effects. We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22. Outputs generated by the Service are decision support for our customers, who are responsible for reviewing them before acting. Automated screening in security and fraud prevention may flag activity for review, but a person decides any resulting action on an account.
Where a customer uses AI features on content containing personal data, that customer is the controller of that processing, and Section 17 applies.
7. Cookies and similar technologies
Type Purpose Consent
Strictly necessary Authentication, session Not required
management, load
balancing, security,
remembering your cookie
choices
Functional Interface preferences, Consent where required
language, layout
settings
Analytics Understanding feature Consent in the EEA and usage to improve the UK Service
Payment and fraud Set by our payment Consent where not processor to detect strictly necessary fraudulent transactions
Where consent is required, we ask for it through a cookie banner before setting non-essential cookies, and you can change your choice at any time through the cookie settings link in the site footer. Declining non-essential cookies does not affect your ability to use the Service.
Full details are in our Cookie Policy.
8. Marketing
We may send information about BOMSync products and features to business contacts. Every marketing message includes an unsubscribe link, and you can opt out at any time by using it or by emailing privacy@bomsync.com. Opting out of marketing does not stop transactional messages about your account, which are necessary to provide the Service.
We do not sell your personal data, and we do not share it with third parties for their own marketing.
9. Who we share it with
We share personal data with service providers who process it on our behalf under written contracts meeting Article 28 requirements. Our current sub-processors, and the safeguards applying to each, are published at /legal/subprocessors. Principal categories:
- Cloud infrastructure and communications --- hosting, storage, databases, logging, and delivery of transactional email and messages
- Artificial intelligence services --- generation of outputs from customer content, under no-training commitments
- Payment processing and tax determination --- subscription billing, payment authorization, tax calculation, and tax identification validation
- Support and monitoring tooling --- ticketing, error tracking, and performance monitoring
We may also disclose personal data:
- to professional advisers --- lawyers, accountants, auditors, and insurers --- bound by confidentiality;
- in connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality and to this policy continuing to apply; and
- where required by law or legal process, as described in Section 11.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
10. Where your data is held, and international transfers
We host the Service on Microsoft Azure. Default regions:
Data Region
Identity, authentication, and account records France Central (European Union) Primary application databases France Central (European Union) Document and object storage France Central (European Union) and East US Transactional email and message delivery (ACS) United States
A current list of production regions is published at /legal/regions. We may add regions as the Service grows; our commitments on relocating customer data out of the EEA are set out in Section 9.5 of the Terms of Service.
Our personnel and some of our service providers are located in the United States and elsewhere. Where personal data is transferred out of the EEA or the UK, we rely on:
- EU Standard Contractual Clauses adopted by the European Commission, together with supplementary technical and organizational measures where required;
- the UK International Data Transfer Addendum or the UK Addendum to the EU SCCs; and
- adequacy decisions, where one applies to the destination.
Copies of the relevant transfer mechanisms are available on request, and the applicable clauses form part of our Data Processing Addendum.
11. Government and law enforcement requests
If we receive a binding request from a government, law enforcement, or regulatory authority for personal data, we will redirect the authority to our customer where possible, notify the affected customer unless legally prohibited, challenge requests that are overbroad or unlawful, and disclose only the minimum necessary. We publish aggregate statistics on such requests at least annually. The full commitment is set out in Section 9.7 of the Terms of Service.
We have not received any order requiring us to give a government direct or unrestricted access to customer data, and we have not built any back door or undisclosed access mechanism into the Service.
12. How long we keep it
Data Retention
Account and profile data For the life of the account, then 12 months after closure
Authentication records and 24 months login history
Customer content (processor Per the Terms of role) Service §9.6 and Data Export & Departure Policy --- read-only export access for 30 days after termination, then deletion from production within 30 days and from backups within 90 days
Billing, invoicing, and payment 10 years, to meet US and French records accounting and tax record-keeping requirements
Tax identification validation [10] years, for VAT and sales tax records and business status audit purposes evidence
Support tickets and 36 months after closure correspondence
Security and audit logs 24 months, or longer where needed to investigate a specific incident
Communications metadata 24 months
(delivery, bounce, complaint
status)
Marketing contact data Until you opt out, then a minimal suppression record kept indefinitely so we do not contact you again
Backups Overwritten on a rolling cycle of no more than 90 days
Where we need to keep data longer to establish, exercise, or defend a legal claim, or to comply with a legal obligation, we keep only what is necessary for that purpose and isolate it from routine use.
13. Security
We maintain administrative, physical, and technical safeguards designed in alignment with recognized industry frameworks, including ISO/IEC 27001 and the SOC 2 Trust Services Criteria. These include encryption in transit and at rest, role-based access control, multi-factor authentication for administrative access, network segmentation, logging and monitoring, vulnerability management, and background-checked personnel operating under confidentiality obligations.
We do not currently hold an ISO/IEC 27001 certification or a completed SOC 2 attestation. Our current measures are described in our Security Overview.
If BOMSync becomes aware of a Personal Data Breach affecting personal data processed on behalf of a customer, BOMSync will notify the affected customer without undue delay and, in any event, within 72 hours after becoming aware of the breach. BOMSync will notify supervisory authorities and individuals where BOMSync is independently required to do so by applicable law.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
14. Your rights under the GDPR and UK GDPR
If the GDPR or UK GDPR applies to you, you have the right to:
- access the personal data we hold about you, and receive a copy;
- rectify inaccurate or incomplete data;
- erase your data in certain circumstances;
- restrict processing in certain circumstances;
- portability --- receive data you provided in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
- object to processing based on legitimate interests, including profiling --- and to object to direct marketing at any time, with no justification needed and no exceptions;
- withdraw consent at any time where we rely on consent, without affecting processing carried out before withdrawal; and
- not be subject to a decision based solely on automated processing producing legal or similarly significant effects. As stated in Section 6, we do not make such decisions.
To exercise any of these, email privacy@bomsync.com or contact the relevant representative in Section 2. We respond within one month, extendable by two further months for complex requests, in which case we will tell you within the first month. We may need to verify your identity. Exercising your rights is free unless a request is manifestly unfounded or excessive.
Complaints. You may lodge a complaint with a supervisory authority, in particular in the country where you live, work, or where the issue arose. In the UK this is the Information Commissioner's Office (ico.org.uk). In France it is the Commission Nationale de l'Informatique et des Libertés (cnil.fr). A list of EEA authorities is published by the European Data Protection Board. We would appreciate the chance to address your concern first, but you are not required to contact us before complaining.
15. Your rights under US state privacy laws
If you are a resident of California, Texas, Colorado, Connecticut, Virginia, or another state with a comprehensive privacy law, you may have the right to:
- know and access the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of recipients;
- correct inaccurate personal information;
- delete personal information, subject to legal exceptions;
- obtain a portable copy of your personal information;
- opt out of sale, sharing for cross-context behavioural advertising, and targeted advertising --- we do not engage in any of these;
- opt out of profiling producing legal or similarly significant effects --- we do not engage in this; and
- be free from discrimination for exercising these rights.
To exercise them, email privacy@bomsync.com. We will verify your identity before responding, and will respond within the period your state's law requires. You may use an authorized agent where your state's law permits; we may ask for proof of authorization.
California. We have not sold or shared personal information in the preceding twelve months. The categories we collect, the purposes, and the retention periods are in Sections 3, 5, and 12. We do not use or disclose sensitive personal information for purposes requiring a right to limit. If we decline a request, we will explain why, and you may appeal by replying to our response.
Texas. If we decline a request, you may appeal by emailing privacy@bomsync.com with "Privacy Appeal" in the subject line. We will respond within 60 days. If the appeal is denied, you may contact the Texas Attorney General at texasattorneygeneral.gov.
Most US state privacy laws contain exemptions for data processed in a business-to-business context or under other federal laws. Where an exemption applies, we will tell you.
16. Automated decision-making
We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. See Section 6.
17. Personal data inside our customers' content
When our customers upload project files, models, bills of materials, submittals, correspondence, and supplier records, that content often contains personal data about their employees, consultants, subcontractors, and supplier contacts.
For that data, our customer is the controller and we are the processor. We process it only on their documented instructions, under the Data Processing Addendum.
If you want to exercise rights over that data, contact the organization that uploaded it --- usually your employer, your client, or the project's lead contractor. They control it, decide how long it is kept, and decide who can see it. If you contact us instead and we can identify the relevant customer, we will forward your request and tell you we have done so. We cannot act on it ourselves without their instruction.
If you do not know which organization holds your data, email privacy@bomsync.com with what you do know and we will help you identify them where we reasonably can.
18. Age
The Service is offered only to businesses and is not directed to, or intended for use by, anyone under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have, contact privacy@bomsync.com and we will delete it.
19. Changes to this policy
We may update this policy. For material changes we will give at least 30 days' notice in-product or by email to account administrators before the change takes effect. The "Effective" date at the top shows the current version. Superseded versions are archived at /legal/archive.
20. Contact
Privacy: privacy@bomsync.com Security: security@bomsync.com Legal: legal@bomsync.com
BOMSync, Inc. 809 Paleface RR South Spicewood, Texas 78669 United States
EU representative: See Section 2; details will be published when appointment is required and completed. UK representative: See Section 2; details will be published when appointment is required and completed.