https://bcutilities.dev/privacy
Privacy Policy
Last updated August 23, 2026.

Overview
This Privacy Policy explains how Edom Media Inc. collects, uses, discloses, retains, and protects personal information when operating the Business Central Utilities website, optional account services, cloud synchronization, support services, and browser extension. You may use the extension without an account.

Privacy Officer
The Privacy Officer for Business Central Utilities is the Privacy Officer of Edom Media Inc. Privacy questions, requests, and complaints may be sent to privacy@edommedia.com or mailed to Edom Media Inc., 370 Av. Saint Charles, Vaudreuil-Dorion, Québec J7V 2M4, Canada.

Information stored in your browser
The extension stores its settings locally in extension storage so its controls continue to work when you are signed out or offline.
If you connect an account, the extension also stores a revocable session token, a limited profile summary, synchronization timestamps, and reminder preferences locally. The session token is not stored in browser-managed synchronized storage.
During email-code sign-in or sign-up, the website temporarily stores the submitted email and, for sign-up, first name, last name, and legal acknowledgements in session storage so the form survives tab changes. This draft expires after a few minutes and is cleared after the flow finishes. Verification codes and Turnstile tokens are not stored in this draft.
Account and authentication information
When you create or use an account, we process your first name, last name, email address, email-verification status, account identifiers, account timestamps, and website sessions. We also record the versions and time of the Terms of Service and Privacy Policy acknowledged during sign-up. Sign-in and verification codes expire quickly and are stored only in protected hashed form rather than as raw codes. We process short-lived verification and rate-limit records to prevent abuse.

Cloud settings and connected browsers
When you connect the extension to your account, we receive and store supported Business Central Utilities control settings, their last update time, and limited connection information such as browser type, device label, extension version, connection time, last synchronization activity, and revocation status. We use this information only to synchronize settings and let you review or disconnect browsers.

Business Central data
The extension reads and adjusts parts of the Business Central page in your browser only as needed to provide its visible controls. We do not intentionally transmit your Business Central records, page contents, tenant data, browsing history, or Microsoft credentials to our servers for account or cloud synchronization. The extension is not intended to write, edit, or delete Business Central business records.

Website, contact, and support information
If you contact us or submit a support request, we receive the information you choose to provide, which may include your name, email address, company, role or job title, message, browser, extension version, issue category, severity, issue details, screenshots, or uploaded files. Please do not send passwords, access tokens, confidential customer records, financial information, or other sensitive Business Central data.

Website analytics, cookies, and security information
The website uses essential authentication cookies to keep you signed in. Cloudflare Turnstile processes a verification token and related browser or network information to help prevent automated abuse. Cloudflare Web Analytics provides privacy-focused website traffic and performance measurements without advertising cookies. Our hosting and backend providers may also process limited request information such as IP address, request headers, timestamps, and operational, error, or security events when delivering and protecting the service. We do not use advertising cookies or Cloudflare Logpush.

How we use information
Provide passwordless account access and maintain authenticated sessions.
Store and synchronize supported extension settings across connected browsers.
Display connected browsers and allow you to revoke their access.
Record agreement to the Terms of Service and acknowledgement of this Privacy Policy.
Respond to contact and support requests, troubleshoot issues, and improve reliability.
Measure website traffic and performance, prevent fraud and abuse, protect the service, and comply with legal obligations.
Consent and necessity
We collect only information reasonably needed for the purposes described when it is provided by you, generated through your use of the service, required to perform account or synchronization services you request, or necessary for security and legal compliance. Where consent is required, you may withdraw it subject to legal or contractual restrictions and reasonable notice. Withdrawal may prevent us from continuing an account-dependent feature but does not affect processing already completed lawfully.

Service providers and disclosure
We use Convex for backend hosting, authentication data, account data, connected-browser records, and cloud settings; Resend for verification, contact, and support email delivery; Cloudflare for website delivery, Web Analytics, and Turnstile abuse protection; and Microsoft-hosted email for receiving and managing contact and support messages. These providers process information to provide their services to us. We may also disclose information when legally required, to protect users or the service, or as part of a merger, acquisition, financing, reorganization, or sale of assets. We do not sell personal information or share it with advertising or data-broker services.

Limited use of extension data
Information received through browser-extension permissions is used only to provide or improve Business Central Utilities, maintain security, and provide support you request. It is not used for personalized advertising, credit decisions, or unrelated profiling. We do not permit human access to extension data except with your permission for support, when needed for security or abuse prevention, when legally required, or when data has been aggregated and de-identified for internal operations.

Retention and account deletion
Local extension information remains in your browser until you clear it or uninstall the extension. One-time authentication and extension-connection codes expire after five minutes. Extension sessions expire after no more than 180 days and may expire after 30 days without activity; you may revoke them sooner.
Account profile, cloud settings, connected-browser records, and active extension sessions remain until you delete the account or otherwise remove them. Account deletion removes the authentication account and its active profile and synchronization data.
After account deletion, we retain a minimal acceptance receipt for three years. It contains a keyed pseudonymous email identifier, the accepted legal-document versions, the acceptance time, the account-deletion time, and the scheduled deletion time. It does not retain your name or raw email address and is deleted by a monthly cleanup process after the retention period.
Resend retains email-delivery records for 30 days under our current configuration. Convex backups and Log Streams are disabled; limited platform operational logs may remain according to Convex's service operation. Cloudflare Web Analytics and limited request or security information remain according to our current Cloudflare Free-plan settings, and Logpush is disabled.
Contact and support messages are currently retained in Microsoft-hosted mailboxes until manually deleted because an automatic mailbox deletion schedule has not yet been configured. Attachments are retained with those messages. We delete messages when they are no longer reasonably needed for support, service history, security, or legal obligations.
If a confidentiality incident occurs, we may retain the legally required incident register and related evidence for the period required by applicable law.
Your choices and privacy rights
You may use the extension without an account, edit your profile, disconnect individual browsers, sign out, or delete your account from the account page. You can remove local extension information by clearing extension storage or uninstalling the extension. Depending on applicable law, you may request access to or correction of personal information, withdraw consent where applicable, ask questions about collection and use, request deletion where legally available, or request computerized personal information in a structured and commonly used technological format. We may need to verify your identity before completing a request and will normally respond to a written access or correction request within 30 days as required by Québec law.

International processing
Our service providers may process information outside Québec or Canada. Before entrusting personal information to service providers outside Québec, we assess the relevant privacy factors and use contractual, technical, and organizational safeguards appropriate to the information and service. Information may be subject to the laws of the places where it is processed.

Security
We use reasonable technical and organizational safeguards appropriate to the information we process, including encrypted network connections, short-lived one-time codes, keyed or hashed authentication records, restricted backend functions, and revocable extension sessions. No transmission or storage method is completely secure, so absolute security cannot be guaranteed.

Children
Business Central Utilities is designed for users of Microsoft Dynamics 365 Business Central and is not directed to children. We do not knowingly collect personal information from children.

Changes to this policy
We may update this Privacy Policy as the website, extension, providers, or applicable requirements change. We will update the revision date and provide additional notice or request a new acknowledgement when required for a material change.

Questions and complaints
Contact the Privacy Officer at privacy@edommedia.com with a privacy question, request, or complaint. Please explain the issue and provide enough information for us to respond. If you are dissatisfied with our response, you may contact the Commission d'accès à l'information du Québec or another privacy regulator with jurisdiction over the matter.