Privacy policy

bfcm.ai is a ShopVision project. It tracks the offers retail brands advertise publicly around Black Friday and Cyber Monday, and shows what each discount really is against the brand’s own usual prices.

The company responsible for this site — the data controller, in UK and EU data protection law — is ShopVision Technologies Inc., of Unit 210 – 233 West 1st Street, North Vancouver, BC V7M 1B3, Canada. ShopVision’s main product and website are covered by our separate privacy policy; this page covers bfcm.ai only.

Most of what this site does needs nothing from you at all. You can browse every offer, brand and category without giving us a single piece of personal information. The sections below are mostly about the one place where you can choose to give us some: the form that asks for a demo.

Four things, and nothing else.

1. What you type into the demo form. The form asks for your work email address and your company or brand name. You can also tick the partner products you would like covered on the call. When you pick a time, your browser tells us which time zone you are in, so the invitation lands at the right hour. We use this to answer you, to arrange the call, and to keep a record of the request in our CRM.

Our lawful basis is our legitimate interest in responding to a business enquiry and running our sales process, and — once you ask for a call — taking steps at your request before entering a contract. The partner products you tick are a topic for the call, not a hand-off: they tell us what to prepare, they are recorded with your request in our CRM, and they are not shared with those partners.

2. A one-way fingerprint, to stop automated abuse. A public form that writes to a CRM is worth attacking, so each submission is scored by Google reCAPTCHA, the form carries a hidden field that only automated software fills in, and we cap how often the same visitor may submit. For the cap we take the IP address your request arrives with and replace it with a one-way hash — a scrambled string of characters that we use instead of the address itself. The hash is the only form we keep, and we keep it in the server’s memory, never in a database or a file. Our lawful basis is our legitimate interest in keeping the form working and free of automated abuse.

3. Ordinary server logs. Like every website, ours records each request it serves. Our hosting provider keeps those logs, which include the IP address of the request, the time, the page asked for and your browser’s user-agent string. Our lawful basis is our legitimate interest in operating, debugging and securing the site.

4. Analytics about how the site is used. We measure which pages are read and which links are followed, so we know what is worth building. What is sent and what is deliberately not sent is in cookies and analytics below. Our lawful basis is your consent in the European Economic Area, the United Kingdom and Switzerland, and our legitimate interest in understanding how the site is used everywhere else.

And what we do not collect. There are no accounts and no passwords on this site, so there is nothing to sign in to. We take no payment, so we never see card details. We do not ask for your name — when a call is booked, your email address is what appears as the name on the invitation. We do not ask for, and have no field for, any of the special categories of data that the law protects most strictly. And the offers themselves are public promotional information about brands and their prices: they say nothing about any visitor to this site.

• To reply to a demo request and arrange the call you asked for.
• To prepare for that call — including which partner products, if any, you asked us to cover.
• To keep a record of the request and the call in our CRM, so our team knows where a conversation stands.
• To follow up by email about ShopVision after your request. Every such email has an unsubscribe link, and unsubscribing does not affect a call you have booked.
• To keep the form usable: scoring submissions, catching automated ones and enforcing the rate limit.
• To understand which parts of the site are used, and to fix what is broken.
• To keep the service secure, and to meet a legal obligation or establish or defend a legal claim.

We do not make decisions about you by automated means that produce legal effects or anything similarly significant.

We do not sell your personal information. We share it in one way only: with the service providers that run parts of this site for us.

The partners you tick. The demo form lets you tick Voucherify and Bloomreach, two companies whose products we can cover on the call. A tick is a topic, not a hand-off: it tells our own team what to prepare, it is recorded with your request in our CRM, and nothing is sent to that partner — not your email address, not your company, not the fact that you asked. Ticking one is never required to book a call.

Our service providers. Each of these is allowed to use your information only to provide its service to us:

• Attio — our CRM. A demo request creates or updates a company record (your company name and the web domain of your email address), a person record (your email address), and a note recording the request: an internal reference for it, your email address, your company name, and the partner products you ticked.
• SavvyCal — our scheduling provider. When you book a time, it receives your email address (used as the display name on the booking, because we never asked for your name), your company name, the time you chose, your time zone, and a signed reference that ties the booking back to your request. It sends the calendar invitation.
• Google — in three separate places. reCAPTCHA scores the demo form, and to do that Google receives your IP address and signals about how you interacted with the page. Google Tag Manager and Google Analytics measure how the site is used. And brand logos are fetched from Google’s favicon service, which means that on a page showing brand marks your browser requests an image from Google.
• Vercel — our hosting provider. It serves every page and holds the server logs described above.

This site is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

Links to retailers are links, not transfers. When you follow an offer to a retailer’s own website, you leave this site and that retailer’s privacy policy applies instead of ours. We do not send them anything about you, and we have no say in what they collect once you arrive.

We may also disclose information where the law requires it, or where it is necessary to establish, exercise or defend legal claims. If the business is ever sold or reorganised, records of this kind may pass to the acquirer along with the rest of it.

This site sets one cookie of its own, and its only job is to remember the choice you make about the ones below. It is called consent_choice, it holds a single word — “granted” or “denied” — it can be read only by this site, and it lasts six months. Nothing else of ours is stored in your browser: no local storage, no session storage, and nothing that identifies you. Our typefaces are served from our own domain rather than a font provider, so simply reading a page sends nothing to a third party on our behalf, apart from the brand logos described above.

You are asked before anything is measured. A bar at the bottom of the page offers Accept and Reject. Nothing is chosen for you, neither button is made easier to find or to press than the other, and the bar does not block the page while you decide. Whichever you press applies to all four of the categories below at once, is sent to Google’s tags immediately, and is what the cookie above records.

What happens before you choose depends on where you are. We use Google Consent Mode, which tells Google’s tags what they are allowed to do. In the European Economic Area, the United Kingdom and Switzerland, all four categories — analytics storage, advertising storage, advertising user data and ad personalisation — start as denied, so nothing is stored on your device and no identifier is set for you unless you accept. Everywhere else they start as granted, and rejecting turns them off. The tags wait briefly on each page for your stored choice before acting on either default.

What sets cookies is Google. If you accept, Google Tag Manager loads Google Analytics, which sets its own cookies in your browser to recognise a return visit and count it once; if you reject, those cookies are not set. Separately from the choice above, reCAPTCHA sets cookies on Google’s own domain when you use the demo form, which is part of keeping that form free of automated abuse.

The measurements we send are: a page view for the first page of a visit and for each page you move to after it; a click on any link that leaves the site; the number of results a search found, and which brand it matched when it matched exactly one; a deal card being opened; the share button being pressed; and three points in the demo form — the request submitted, a time booked, and choosing to be emailed instead.

Two rules in our code limit what those measurements may carry, and they are worth stating plainly. Every address we send is cut back to the site and the page, so anything after the ? in a URL — which is where a search you typed and the signed link from the demo form both live — is dropped before the measurement is sent. A search sends how many results it found, and the matched brand as our own index spells it, never what you typed. No measurement carries your email address or your name; the code that sends them has no field one could be put in.

Advertising tags. Our tag manager is able to load Google Ads tags, which measure whether an advertisement led to a demo request and can build advertising audiences. They are switched off. We will update this policy before switching them on, and if we do, they will run only within the consent choice described above.

Do Not Track. Our site does not respond differently to Do Not Track browser signals; your choices are made through the cookie bar.

Your choices. You can change your mind at any time: Cookie settings in the footer of every page brings the bar back, and what you choose then replaces what you chose before. You can also block or delete cookies in your browser’s settings, and you can opt out of Google Analytics on every site you visit with Google’s browser add-on. Nothing on this site stops working whichever you do.

• Demo requests and the CRM records they create — for as long as the conversation is active, and for up to 24 months after our last contact with you, after which we delete or anonymise them unless you have become a customer.
• The rate-limit fingerprint — in the server’s memory only, for no longer than the window it belongs to, which is at most one hour. It is gone whenever the server process restarts, and it is never written down.
• The signed link between the two steps of the demo form — thirty minutes from the moment you submit it, after which it stops working and you would start again.
• Server logs — kept by our hosting provider for a limited period under its own retention policy, and then deleted.
• Analytics — 14 months, after which Google deletes the underlying records.

Everything is served over an encrypted connection. The keys for our CRM, our scheduling provider and reCAPTCHA exist only on our servers; none of them is ever sent to your browser, and the form posts only to this site’s own address.

The hand-off between the two steps of the demo form is signed and expires, so the email address a booking is made under is always the one that was submitted, and nobody can alter it in transit or book in your name. The webhook our scheduling provider calls is acted on only when it carries a valid signature.

When something goes wrong, our error logs record the internal reference for the request and what failed — not what you typed. Anything echoed back to us by another service has email-shaped text stripped out of it before it is written to a log.

No system is perfectly secure, and we cannot promise that one is. What we can say is where the lines are drawn, which is what this section is for.

If you are in the UK or the European Economic Area, you have the right to ask us for a copy of the personal information we hold about you; to have it corrected if it is wrong; to have it deleted; to restrict how we use it; to object to our using it where we rely on legitimate interests, and to object to direct marketing at any time; to receive it in a portable form; and, where we rely on consent, to withdraw that consent. Exercising any of them costs nothing and we will not treat you differently for asking.

If you are in Canada, you have the right to access and correct the personal information we hold about you, and to withdraw your consent to our using it, subject to legal and contractual limits.

If you live in California or another US state with a consumer privacy law, you can ask what personal information we have collected about you and where it went, ask us to correct or delete it, and ask us not to sell or share it — and we will not discriminate against you for asking. We do not sell personal information, and we do not share it for cross-context behavioural advertising. Ticking a partner on the demo form discloses nothing to that partner: it is a note on your own request, as who we share it with describes above.

How to ask. Write to support@shopvision.ai and tell us what you would like. We will answer within one month (30 days in Canada, 45 days in California), and we will tell you if we need longer. We may need to ask something that confirms the request is really yours.

We have not appointed a data protection officer, and we are not currently required to. We have not appointed a representative in the EU or the UK; if that changes, their details will appear here.

If you are not satisfied with how we answer, you can complain to a data protection authority: in the UK, the Information Commissioner’s Office; in the EEA, the authority for the country you live in; in Canada, the Office of the Privacy Commissioner of Canada, or in Québec, the Commission d’accès à l’information.

We are based in Canada, and some of the providers named above are based in, or process information on servers in, the United States or the European Union. So what you send us may be handled outside the country you are in.

The European Commission and the UK recognise Canada as providing adequate protection for commercial data. For providers in the United States, we rely on the EU–US Data Privacy Framework and its UK extension where the provider is certified, and on the UK and EU standard contractual clauses in our agreement with the provider where it is not, so that the protection travels with the information.

This site is made for people shopping the season’s offers and for the brands that run them. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, write to us at the address in contact and we will delete it.

We will update this page when what we do changes. The effective date at the top always tells you which version you are reading. If a change materially affects information you have already given us, we will take reasonable steps to tell you rather than relying on you to come back and check.

For anything in this policy, including any of the rights above, write to support@shopvision.ai.

ShopVision Technologies Inc., Unit 210 – 233 West 1st Street, North Vancouver, BC V7M 1B3, Canada.