Identity
openid · email
Shows which Gmail address is connected and makes sure the same account is reused.
What we collect
This applies to business owners and staff who use the platform, and to customers whose details a business adds to it.
- Account details: name, email address and phone number of owners, staff and customers, and a business's name, address, ABN and branding.
- Business records a business creates: customers, site inspections, quotations, invoices, jobs, team and attendance records, and messages sent through the platform.
- Payment details are handled by our payment provider, Stripe. We do not store card numbers.
- Google user data, only if a business owner chooses to connect a Gmail account. This is described in the next section.
- Technical information such as device, browser and log data, used to keep the service secure and working.
Your Gmail account
A business owner can connect their own Gmail account. Each feature asks for the smallest permission it needs, and the owner approves every one on Google’s consent screen.
Send email
gmail.send
Sends quotations, invoices and emails you write, from your own Gmail address.
Read and manage mail
gmail.modify · only if you turn on the Mailbox
Shows your Inbox, Starred, Sent, Archive and Trash here; lets you open, reply, forward, star, archive and delete; and links conversations to your customers, quotes and invoices. It cannot permanently delete mail.
What we store
- The connected address and name.
- Encrypted access credentials.
- A record of each email sent from the platform: recipients, subject, body and any attached document.
- With the Mailbox on: for each message, its Gmail identifiers, sender, recipients, subject, a short preview, date, labels, and whether it has attachments.
What we don’t store
- The full body of received email. It is read from Gmail when you open a message.
- Attachments of received email. They are downloaded from Gmail only when you open them.
- Your Gmail password. We never see it; Google signs you in.
- Spam and draft messages.
Google API Services User Data Policy — Limited Use
BMS Pro Trade’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we:
- use Google user data only to provide and improve the user-facing email features described above;
- do not sell Google user data or transfer it to data brokers or advertising platforms, and do not use it for advertising, including personalised or retargeted ads;
- do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models;
- do not allow people to read a user's Gmail data unless the user has asked us to for a specific message, it is needed for security or to comply with the law, or the data is aggregated and anonymised for internal operations;
- do not transfer Google user data to others except to provide the features above, to comply with the law, or as part of a merger or sale with notice to users.
How we use information
- To provide the platform: bookings, quotations, invoices, jobs, notifications and email.
- To keep accounts secure, prevent misuse and troubleshoot problems.
- To send service messages such as account, booking and invoice emails and SMS.
- To meet legal and accounting obligations.
We do not sell personal information.
How we protect it
- Data is encrypted in transit (HTTPS).
- Gmail credentials are encrypted at rest with AES-256-GCM, with the key held separately from the database, and are never sent to the browser.
- Mail data and credentials sit in collections that no browser or app can read directly. They are reachable only through our server, which checks the signed-in owner and business on every request.
- Only business owners can connect a mailbox or use it in the platform.
- Email is displayed in a locked-down frame that cannot run scripts, and images from the web are blocked until the owner allows them.
To report a vulnerability, see our security page.
Keeping and deleting
Business records are kept while the account is active and for as long as the business needs them for its legal and accounting obligations.
Disconnecting Gmail
Choosing Emails → Disconnect stops all access straight away, revokes our access at Google, deletes the stored credentials and deletes the message details imported from the mailbox. The record of emails already sent from the platform stays with the business’s records; ask us if you want it deleted.
You can also remove BMS Pro Trade at any time at myaccount.google.com/permissions, after which our access stops working.
Your rights
You can ask to access, correct or delete the personal information we hold about you, or ask a question or make a complaint about how we handle it, by contacting us below. If you are in Australia, we handle personal information in line with the Australian Privacy Principles. Customers of a business can also contact that business directly.
Changes to this policy
We may update this policy as the platform changes. The date at the top shows the latest version, and we will tell account holders about significant changes.
Contact us
Questions or requests about privacy: support@bmsprotrade.com.