Privacy policy

Template, pending legal review. Have this reviewed (including GDPR and other applicable laws) before launch.

This policy explains what BC Object Registry (by OnlyBCFans) collects, why, and your choices.

What we collect

Data	Why
Your email address and name	Signing in with one-time codes; identifying you in your workspace and audit log
Your workspace's registry: apps, object ranges, Business Central tenant IDs and customer names, environments	Providing the service
Audit log entries (who changed what, when)	Accountability inside your workspace
Sign-in sessions (browser, IP address) and rate-limit counters	Security
API keys, stored only as a hash	Letting your tools call the API
Billing details (handled by Stripe; we keep a customer reference, plan and renewal date)	Paid plans
Optional Business Central connection: consent status and a log of every read we make	The connection features you turn on

We don't use advertising trackers.

The privacy wall

Your registry is visible only to members of your workspace. Our global administrator can see workspace and user metadata (names, email addresses, plan, status, counts) to run the service, but cannot read your registry content. This is enforced in the database, not just hidden in the interface.

Service providers

We use: Vercel (hosting), Neon (database), Resend (email delivery), Stripe (payments), and, only if you connect it, Microsoft (the Business Central administration center API). They process data on our behalf under their own terms.

Retention

• Deleted apps are kept 30 days so admins can restore them, then removed.
• The Business Central connection's call log is kept 12 months.
• If a subscription lapses, the workspace's data is kept so you can resume or export it.
• You can ask us to delete your account and workspace.

Your rights

You can access, export (the Export page), correct and delete your data, and object to processing, subject to applicable law. Email info@onlybcfans.com to exercise these rights.

Cookies

See the Cookies page.