Privacy Policy

For visitors, sign-ups and account holders, we are the responsible party (controller). For the business data you put into your own Ultimate BMS instance, you are the responsible party and we are your operator (processor); see the Data Processing Addendum.

Information Officer: [IO NAME]. Contact: admin@ultimate-bms.com. You may also complain to the Information Regulator of South Africa (inforegulator.org.za), or your local data protection authority.

• Account data (name, email, phone, company, address, VAT and registration numbers, password hash or Google identity). To create and run your account and instance. Basis: performing our contract with you.
• Billing data is handled by Paddle, our merchant of record. We never see your card details; we receive payment status and invoice details. Basis: contract and legal obligation.
• Early-access and contact requests (what you type into our contact form). To reply to you. Basis: your request and our legitimate interest.
• Email we exchange with you, kept in our support inbox. Basis: legitimate interest in supporting you.
• Support requests a user sends from inside the software: their name and email, what they type, technical details (browser, device, screen, the page they were on, recent error messages, addresses of failed requests without their contents) and, unless they untick it, a screenshot of their screen. Screenshots are not taken on Payroll or Budget pages. The AI that helps draft the request never sees the screenshot. To answer and resolve the request. Basis: performing our contract with you.
• Website analytics, only if you accept analytics cookies: pages viewed, where you came from, clicks, browser, device type, timezone, language and a random visitor ID. We do not store your IP address. Basis: your consent.
• Security and audit logs (sign-ins, admin actions, IP addresses of sign-in attempts). To protect the service. Basis: legitimate interest and legal obligation.
• Operational telemetry from your instance, described below.

We do not sell personal information and do not use it for automated decisions about you.

We collect aggregate operational telemetry from your instance: CPU, memory, disk, error rates, response times and coarse counts. On startup, every 12 hours and whenever your users change, your instance sends aggregate counts: users, logins in the last 7 days, AI assistant questions, clients, leads, quotations, invoices and storage size, plus server load and page-load timings. We use these to detect unhealthy instances before you do, enforce your plan's user limit, size your server and show you your usage. We never collect work-order contents, customer names, sensor readings, names, emails, URLs or IP addresses from your instance.

We use a small number of cookies. Essential cookies keep you signed in and are always on. Analytics cookies are off until you accept them. The full list and how to change your choice is in our Cookie Policy.

Only service providers acting for us, listed on the sub-processors page (including Amazon Web Services for hosting and email, Paddle for payments and OpenRouter for AI features), and authorities where the law requires. Where AI features are used, the text sent to the AI provider is not used to train its models.

Our infrastructure is in eu-west-1 (Ireland). Backups are encrypted and stored in S3, in a bucket of their own for each customer. We are a South African company, so data moves between South Africa and Ireland, and AI requests may be processed in other regions by our AI provider. Where POPIA section 72 or the GDPR applies we rely on binding agreements and Standard Contractual Clauses.

• Support requests and screenshots: [RETENTION PERIOD TO CONFIRM].
• Raw telemetry: 7 days. Hourly rollups: 90 days. Daily rollups: 13 months.
• Backups of an active account: the latest few, at most 12 days old.
• After cancellation or non-payment: your latest backup is kept for 3 months in cold storage, then permanently deleted, and your admin is emailed once it is gone. You can delete it sooner from the portal.
• Visitor analytics: [RETENTION PERIOD TO CONFIRM]. Account and billing records: as tax and company law require.

We protect personal information with encryption in transit and at rest, access controls and logging, as POPIA section 19 requires. If a security compromise affects your personal information we will tell you, and the Information Regulator where the law requires, without undue delay.

You may ask us to confirm what we hold about you, give you a copy, correct it, delete it, restrict or object to its use, withdraw consent at any time (for example via Cookie settings in the page footer), and, in the EU and UK, receive it in a portable format. Email admin@ultimate-bms.com; we respond within 30 days. If you are a user inside a customer's instance, contact that customer first, as it decides how your data is used there. Structured data export is self-serve in the portal while your subscription is active.

Our service is for businesses and is not aimed at anyone under 18.

We will update this page when our practices change and show the date above. For material changes we will notify account holders by email.