BWA Solutions Inc. ("BWA Horizon", "we", "us") is committed to protecting your privacy. This policy explains how we collect, use, and safeguard your personal information when you use our website and services.
1. Information We Collect From Website Visitors
Lead Capture Forms
When you submit a lead form or book a demo, we collect: your name, email address, company name, and optionally your phone number and business type. We also record a one-way hash of your IP address (not your actual IP) for rate-limiting and abuse prevention.
Consent Records
We record your consent choices in an append-only log. Each submission creates a new consent record that includes: which consent options you selected, the exact text shown to you, the timestamp, and your language preference. These records are never modified or deleted.
Analytics
We use Vercel Analytics for anonymous, aggregate page-level metrics (page views, performance data). When configured, we also use PostHog for product and marketing analytics (page views and clicks). PostHog processes those analytics events in the United States. We do not send tenant ids, cart identifiers, email addresses, or connector tokens to PostHog. Event-level lead analytics (form submissions, demo bookings) are stored in our own database.
Bot Protection (Cloudflare Turnstile)
Our public lead-capture and demo-booking forms are protected by Cloudflare Turnstile running in invisible mode, which confirms a submission comes from a person rather than an automated script without asking you to solve a visible challenge. Because the check is invisible, Turnstile may process technical signals from your browser and device — including your IP address and interaction characteristics — on our behalf to tell humans and bots apart. This processing is governed by the Cloudflare Turnstile Privacy Addendum (which incorporates Cloudflare's data-processing terms) together with Cloudflare's privacy policy, and the data is used only for bot mitigation on our forms — never for advertising or cross-site tracking.
2. Information We Hold For Our Customers
BWA Horizon is a business platform used by restaurants and food businesses. Once your business becomes a customer, we hold and process operational data on your behalf. In that role we act as a service provider to your business: your business decides what is collected and why, and we process it on your instructions to run the platform.
Account and contact information
We hold the account records for the people your business authorizes to use BWA Horizon — name, email address, and where provided a phone number — together with your business's own contact and address details. Passwords are stored only as a one-way hash and are never readable by us.
Operational records you create or upload
Your procurement, inventory, pricing, and sales records, including sales-history files you upload. These are business records. Where they contain personal information — for example a staff or customer name in a free-text field — it is handled on the same terms as the rest of your data.
Supplier and delivery contacts
To place orders and arrange delivery on your instruction, we hold contact details for your suppliers and, where a delivery is dispatched, the pickup and drop-off addresses and the contact name and phone number for that delivery. This information reaches us from your business, not from the individual, and we use it only to carry out the order or delivery you requested.
Messages exchanged on your behalf
Where your business messages a supplier through the platform, we send and receive those messages on your behalf and retain the message content as the record of the order. Attachments a supplier sends us, including invoice images, are processed to extract the order and price information.
Retailer accounts you connect
If you authorize us to act as your agent with a grocery retailer, we keep the signed authorization as evidence of that authority, and — only if you install our browser extension and connect it — an encrypted copy of your own retailer session so prices stay current between your visits. We never hold your retailer password and never complete a checkout for you. What the extension does is described in full in its own policy, linked in section 9.
How your data is kept separate
Each customer's records are stored under that customer's account. A small number of authorized BWA Horizon staff can access production systems for legitimate operational reasons — investigating a fault you reported, responding to a security incident, or complying with a legal obligation. We do not read customer data for advertising, for product analytics, or to train models.
3. How We Use Your Information
We use your information to: respond to your demo or pricing request, send a single transactional confirmation email, and, if you opted in, send product updates and marketing communications. We do not sell or share your information with third parties for marketing purposes.
4. SMS Notifications to Our Team
When you submit a lead form, our founding team receives an SMS notification with your name, business type, and SKU range so we can respond quickly. Your email address and phone number are not included in the SMS. These notifications are sent through Twilio.
5. Data Retention
We keep prospect and lead information for as long as we have an active relationship with you, or as required by law (including CASL). Consent and marketing-suppression records are kept as legal evidence so we can honour an unsubscribe. If your business is a customer, operational records are retained for the window your account is configured with — 365 days by default. Some records we are required to keep, including consent records and signed retailer-authorization evidence, are not deleted on that schedule. Connector session credentials follow the shorter lifetimes described in the Connector Privacy Policy. Automatic deletion of tenant operational records is not yet the production default; contact our privacy officer if you want a record removed sooner.
6. Where Your Data Is Stored
Your primary application data is stored in Canada, in Supabase's Canada Central (ca-central-1) region. Some services we use to operate the platform process data in the United States, including backend hosting (Railway), frontend hosting (Vercel), error diagnostics (Sentry), and product analytics (PostHog). Analytics events may be processed in the United States. Additional providers used for messaging, email, and delivery may also process data outside Canada. This means your personal information may be processed outside Canada and may be subject to the laws of the jurisdiction where it is processed. We remain accountable for personal information transferred to our service providers and use contractual means to require a comparable level of protection. Please contact us if you have questions about data residency.
We use a limited set of service providers to run the platform, in the categories of hosting and data storage, error diagnostics, product analytics, messaging and email, delivery dispatch, document processing, and retail price collection. Our current list of service providers is available on request from our privacy officer.
7. Cookies
We use essential cookies required for the website to function (locale preference, session management). When product analytics is enabled, we also set a first-party analytics identifier (PostHog, reverse-proxied on our domain) so page views and marketing clicks can be counted. We do not use third-party tracking cookies. Vercel Analytics uses anonymous, cookieless measurement.
8. Your Rights
You have the right to access the personal information we hold about you, to request correction of information that is inaccurate, to request deletion of your information (except records we are required to keep, such as consent records and retailer-authorization evidence), and to withdraw marketing consent at any time using the unsubscribe link in our emails. If you are in Québec, you may also request that a hyperlink to information about you be de-indexed where the law permits. To exercise any of these rights, contact our privacy officer (section 11). We respond within the timelines set by applicable law.
9. Our Other Privacy Policies
Two parts of BWA Horizon have their own, more specific policies. Where one of those policies describes a specific feature, it governs that feature; this policy governs everything else.
10. Security Incidents
If a confidentiality incident involving your personal information occurs and it presents a risk of serious injury, we will notify you and the applicable regulator as required by law, and we keep a register of such incidents.
11. Contact Us
For privacy questions, to exercise your privacy rights, or to make a privacy complaint, contact our privacy officer:
Ben Sullivan, Co-Founder
We respond to privacy requests within the timelines set by applicable law.