Privacy Policy

1. Who We Are

BMVP AI Ltd ("we", "us", "our") is the data controller for all services described in this policy. Company No. 17126191. Registered in England and Wales.

2. Products Covered

This policy applies to all BMVP AI Ltd services:

• bmvp.io — Free browser arcade (50+ games).
• cantle.bmvp.ai — AI-powered miniature horse herd management (subscription SaaS)
• qr.bmvp.ai — QR Studio, browser-based QR code generator (credit-based, Supabase Auth)
• Hourloom — Android day-planning & wellbeing app. Stores data locally on your device. See the dedicated Hourloom Privacy Policy.
• bmvp.dev — Developer portal and API documentation (planned)
• bmvp.app — Product showcase (planned)
• bmvp.ai — This corporate website

3. Data We Collect

bmvp.io — The Arcade

• Game scores & settings — stored in your browser's localStorage only. Never sent to our servers.
• Age gate response — stored in localStorage to avoid repeating on return visits. Not transmitted.
• Cookie consent choice — stored in localStorage. Not transmitted.
• Server access logs — hosting providers briefly log IP address, browser type, and request timestamps for security. Not used for advertising.

qr.bmvp.ai — QR Studio

• Account data — email address and password (hashed) stored via Supabase Auth, used solely to manage your credit balance and session.
• Credit balance — stored in your browser's localStorage as well as server-side to support redemption.
• Marketing preference — optional opt-in at registration, stored with your account.
• QR code content — the text/URL you generate is processed entirely client-side (in your browser). It is never transmitted to our servers.

cantle.bmvp.ai — Cantle

• Account data — email address, hashed password, chosen username, and username change history.
• Herd data — horse names, health records, breeding records, lineage, vet records, and notes you enter. This data belongs to you.
• Payment data — payment processing is handled by a PCI-compliant third-party processor. We do not store full card numbers.
• Usage & error logs — anonymised feature usage and error data for service improvement.

bmvp.ai (this site)

• Contact forms — name and email stored only to respond to your enquiry.
• Server access logs — brief IP/browser logs for security, deleted within 90 days.

4. Advertising & Cookies

We do not currently serve third-party advertising on any of our products, and we do not set advertising or tracking cookies.

If we introduce advertising in the future, we will update this policy first, and any advertising cookies will only be set after you give explicit consent via a consent banner. Declining will still let you use the product, with any ads shown on a non-personalised basis.

Cantle and QR Studio do not display advertising.

5. GDPR — EU/EEA Rights

Under the General Data Protection Regulation, EU/EEA residents have the right to: access their data, rectify inaccurate data, erasure ("right to be forgotten"), restriction of processing, data portability, object to processing, and withdraw consent at any time without affecting prior processing.

You may also lodge a complaint with the Information Commissioner's Office (ICO) or your local supervisory authority.

Legal basis: Account/subscription data — contract performance (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)). Any future advertising cookies would rely on explicit consent (Art. 6(1)(a)).

To exercise any right, email legal@bmvp.ai. We respond within 30 days.

6. CCPA — California Rights

California residents have the right to: know what data is collected; delete personal information; correct inaccurate data; opt out of sale or sharing; and non-discrimination for exercising these rights.

We do not sell or share personal information. We do not currently serve third-party advertising.

To submit a CCPA request, email legal@bmvp.ai with "CCPA Request" in the subject. We respond within 45 days.

7. Children's Privacy (COPPA)

Our services are not directed at children under 13. bmvp.io displays an age gate on every first visit. Users who indicate they are under 13 are blocked — no cookies are set, no data collected.

Cantle and QR Studio are professional/productivity tools intended for adults. If you are under 18, you must have parental or guardian consent to use them.

If you believe a child under 13 has provided us with personal data, contact legal@bmvp.ai immediately.

8. Data Retention

• bmvp.io / QR Studio localStorage data — stored on your device only. Cleared when you clear browser data.
• QR Studio & Cantle account data — retained for the life of your account. On deletion, personal data removed within 30 days (financial records retained 7 years as required by law).
• Contact emails — retained until you request deletion or we resolve your enquiry.
• Server access logs — up to 90 days, then automatically deleted.

9. Security

We use encrypted data transmission (TLS/HTTPS), hashed passwords, restricted database access, and regular security reviews. To report a security concern, email legal@bmvp.ai.

10. Third-Party Services

We use the following third-party data processors. Under GDPR, these are sub-processors operating under our instruction:

• Supabase — authentication and database backend for Cantle and QR Studio. Data stored in the EU. Supabase Privacy Policy
• Hosting providers — brief server access log processing. Covered by GDPR-compliant data processing agreements.
• LemonSqueezy — payment processing for Cantle subscriptions and QR Studio credits. PCI-DSS compliant. LemonSqueezy Privacy Policy

We do not share your personal data with advertisers, data brokers, or third parties for commercial purposes.

11. Hourloom App

Hourloom is our Android day-planning and wellbeing app. It works differently from our websites: your data is stored locally on your device, not on our servers. We do not collect, sell, or track it. Optional features (AI planning, encrypted backup) connect only to services you choose, and backups are encrypted on your device with a passphrase only you hold.

12. Policy Changes

We may update this policy. Material changes will be notified by updating the date above. Continued use constitutes acceptance.

13. Contact