Privacy Policy

Introduction

BOMwise ("we", "our", "us") operates the website bomwise.io and provides a SaaS platform for BOM (Bill of Materials) cost optimization for electronics engineers. This Privacy Policy explains how we collect, use, and protect your personal data when you use our services.

We know that BOM data can contain sensitive intellectual property. This policy is written to be transparent about exactly what happens to your data at every step — no legalese, no ambiguity.

By using BOMwise, you agree to the collection and use of information in accordance with this policy.

Data Controller

The data controller responsible for your personal data is:

Data We Collect

3.1 Account Data

When you register, we collect:

• Full name
• Email address
• Password (encrypted, never stored in plain text)
• Subscription plan

3.2 Payment Data

Payment processing is handled by Stripe, Inc. We do not store your credit card details. Stripe collects and processes:

• Credit card information
• Billing address
• Transaction history

3.3 BOM & Analysis Data

When you use BOMwise, we collect:

• BOM data you upload or paste (component lists, quantities, prices)
• Analysis results generated by our AI engine (alternatives, scoring, rationale)
• Project metadata (name, production volume, certification type, date)
• IP address and browser information

3.4 Communication Data

If you contact us, we collect:

• Email address
• Content of your messages

How Your BOM Data Is Processed

This section explains exactly what happens to your BOM data at each step of the analysis process.

4.1 File Upload — Local Processing Only

If you upload a BOM file (.csv, .tsv, .txt), it is read entirely in your browser using JavaScript FileReader. The file is never uploaded to BOMwise servers. Only the parsed text content is used for analysis.

4.2 Input Sanitization

Before your BOM data is sent for analysis, it is automatically sanitized in your browser. This process removes potentially problematic characters (encoding artifacts, control characters, BOM markers) while preserving all meaningful component data. This sanitization happens locally — the raw file content never leaves your browser.

4.3 AI Analysis

The sanitized BOM text is sent to Anthropic's Claude API for analysis. This is the only moment your BOM data leaves your browser. Anthropic processes the data under their zero data retention terms for API usage:

• Anthropic does not use API inputs for training their models
• Anthropic retains API logs for abuse detection for a maximum of 30 days, after which they are automatically deleted
• BOMwise uses the API version of Claude (not the consumer Claude.ai product), which has stricter privacy terms

Full details: Anthropic Privacy Policy

4.4 Results Storage

The analysis results (original components, proposed alternatives, confidence scores, rationale) are saved in the BOMwise database and associated with your account. This data is accessible only by you.

How We Use Your Data

We use your data to:

• Provide and maintain the BOMwise service
• Process payments and manage your subscription
• Generate BOM cost optimization analyses using AI (Anthropic Claude API)
• Send transactional emails (account confirmation, billing receipts)
• Improve our service and fix bugs
• Comply with legal obligations

Third-Party Services

BOMwise uses the following third-party services that may process your data:

What BOMwise Does NOT Do

For complete transparency, here is what we explicitly do not do with your data:

• We do not upload your files to any server — file parsing happens entirely in your browser
• We do not share your BOM data with other users
• We do not use your BOM data for AI model training — neither ours nor any third party's
• We do not sell your data to third parties
• We do not display advertising based on your data
• We do not access your BOM data except when you view it in your own dashboard
• We do not use your analysis results to benchmark or compare against other users

Data Retention

We retain your data for as long as your account is active. If you delete your account:

• Account data is deleted within 30 days
• All BOM data and analysis results are deleted within 30 days
• Payment records are retained for 7 years as required by law
• Anthropic's API abuse detection logs expire automatically after 30 days and are not under BOMwise's control

Your Rights (GDPR)

If you are located in the European Union, you have the following rights:

• Right of access — Request a copy of your personal data
• Right to rectification — Correct inaccurate data
• Right to erasure — Request deletion of your data ("right to be forgotten")
• Right to portability — Receive your data in a structured format
• Right to object — Object to processing of your data
• Right to restrict processing — Request limitation of how we use your data

Cookies

BOMwise uses cookies to:

• Keep you logged in (session cookies)
• Remember your preferences

We do not use advertising or tracking cookies from third parties. You can disable cookies in your browser settings, but this may affect the functionality of the service.

Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• HTTPS/TLS encryption for all data in transit
• Encrypted password storage
• Client-side file processing (your files never reach our servers)
• Input sanitization to prevent injection attacks and data corruption
• Access controls limiting who can access your data

International Transfers

Your data may be processed in the United States (Anthropic, Bubble.io, Stripe). These transfers are covered by appropriate safeguards including Standard Contractual Clauses.

Sensitive IP & Current Limitations

We understand that for many electronics engineers, BOM data is sensitive intellectual property. We want to be honest about what our current architecture can and cannot guarantee.

BOMwise currently processes BOM data via Anthropic's cloud API. This means your sanitized BOM text travels over the internet to Anthropic's servers, even though it is handled under zero-retention terms. All communications use HTTPS/TLS encryption.

• Anonymize proprietary part numbers before analysis — replace custom or pre-release part numbers with generic descriptions while keeping standard component identifiers
• Wait for our self-hosted version (see Section 14) if your data handling policy prohibits cloud API usage
• Check with your legal team whether cloud API usage under zero-retention terms is compatible with your company's IP protection policies

We would rather tell you these limitations upfront than pretend they don't exist.

Roadmap: Self-Hosted Deployment

BOMwise has a self-hosted / on-premise version on its product roadmap. This will allow organizations to run BOM analysis on their own infrastructure without any data leaving their corporate network.

This version is currently in planning — no confirmed release dates are available. We will not announce a date until we are confident we can deliver.

If your organization is interested in the self-hosted version, please register your interest:

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email. The date at the top of this page indicates when it was last updated.

Contact

For any privacy-related questions, data deletion requests, or security concerns: