Privacy policy

Only what the service needs to run. There is no account, no sign-up and no profile.

• Your bill of materials. Parsed in memory, released as soon as the analysis is returned. It is written to disk only if you explicitly turn on analysis history, and it is then encrypted at rest.
• Technical identifiers. Your IP address, used as your anonymous identifier (there is no account) and to enforce rate limits, plus your browser's user agent, recorded with a purchase consent.
• Contact details you give us. Email address, company and role, when you join the waitlist, ask to be notified, or buy a report.
• Purchase records. Stripe payment session, timestamped consent with the version of the terms accepted, declared legal name, and the download counter.
• We collect no special-category data, and we ask you not to upload classified, export-controlled or contractually confidential bills of materials.

• Performance of the contract (art. 6.1.b GDPR): running the analysis you request, generating and delivering the report you paid for, and answering your support requests.
• Legal obligation (art. 6.1.c): keeping accounting records and VAT evidence, and keeping proof of your pre-payment consent, which the Consumer Code requires us to be able to produce.
• Legitimate interest (art. 6.1.f): protecting the service against abuse and automated scraping through rate limits, and defending ourselves in a payment dispute. Our interest here is to keep a free tool available without it being drained.
• Your consent (art. 6.1.a): storing your analysis history, and sending you the launch notification you asked for. You can withdraw it at any time, with no effect on what came before.
• No decision producing legal effects is taken automatically about you, and your data is never used to train any model.

• A bill of materials you did not save: not kept. It exists only for the duration of the analysis.
• Saved analysis history: until you delete it. There is no automatic expiry, and one click purges it.
• Purchase records, consent, invoices: 10 years from the end of the financial year, as required for accounting records (art. L123-22 of the French Commercial Code). This is also what protects you: it is the proof of what you agreed to.
• Waitlist and contact details: 3 years from our last contact with you, in line with the French data protection authority's guidance on business prospecting.
• Technical logs: a few days, kept by our host for operating and security purposes.

BOMShield sets no cookie. There is no audience measurement, no advertising tag and no third-party script that follows you. Nothing here requires a consent banner, because nothing here tracks you.

• The app uses your browser's local storage for conveniences only: your interface language, the email you already typed so you do not retype it, your storage choice, and the analysis waiting to be turned into a report after payment.
• These entries stay in your browser. They are never sent to us, and clearing your browsing data removes them.
• Fonts are loaded from Google Fonts, which receives the technical request needed to serve them.

You have the rights of access, rectification, erasure, restriction, objection and portability over your data.

• Erasure is immediate and self-service. The Purge button in the app, which calls /api/purge, permanently deletes your saved analyses and the contact details attached to you. We do not gatekeep it.
• For anything else, write to selisabeth@genesis-retrotech.fr. We answer within one month, and usually within five business days.
• Purchase records covered by our accounting obligation cannot be erased before their legal retention period ends. That limit is the law's, not ours.
• You may lodge a complaint with the French data protection authority, the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at cnil.fr.