Privacy Policy — BOCP ERP connector for AI assistants

1. Who we are

The connector is operated by the provider of BOCP ERP: SC REAL LIFE SRL, CIF: 23310817.

• Service: BOCP ERP — https://www.bocp.ro
• Contact for privacy questions: office@reallife.solutions
• Support: office@reallife.solutions

2. What this connector does

It gives an AI assistant chosen by you access to data from your own BOCP ERP account, within the permissions an administrator of your account sets in BOCP:

• Business figures — company-level totals already calculated in your account: daily indicators (for example daily invoiced value, receipts, orders, margin), which can be summed over a period and compared with earlier periods, and point-in-time figures (for example current stock value or total receivables), which state a balance on a given date.
• Automation pilots — what the BOCP automations (“pilots”, for example order import, invoicing, shipping labels, product catalog) did in a period, their open problems and their work queues.
• Product catalog — the product records of your catalog, as described in section 3, including catalog-quality checks and a filter for products not sold or consumed in recent months.

The connector cannot directly create, change or delete anything in your ERP. With an optional paid licence and the access type “Read and write”, the assistant can propose changes to product records (names, short descriptions, producers, additional codes, images, categories, characteristics). A proposal changes nothing: it is applied only after a person in your company approves it in BOCP, and every proposal is kept as history (who proposed it, what, when, and who decided).

3. What data the AI assistant can receive

Only the following leaves BOCP, and only for what is active on the connector:

• Metadata — the identifier, unit and description of each enabled figure, and the list of tools and permissions of the connector.
• Aggregated daily values and point-in-time totals — daily totals, period sums, percentage changes and data-coverage counts; single company-level balances, with their value at earlier dates where it can be reconstructed. No document, line, partner or individual amount is transmitted, and a total cannot be broken back down into the records behind it.
• Pilot reports — counts of actions and problems per period, the size of work queues and, if enabled, which automations are switched on. For each problem still open: its date and kind, the type and number of the affected document as shown in BOCP (for example an invoice series and number, an order number, a shop address or a product code), and links to the document and to the list of problems of the same kind. The links open only for a user signed in to your BOCP account. Problem descriptions, the document’s content, the client, and who resolved a problem are never sent.
• Product catalog — for each product: codes (product code, barcode, additional codes, which may include the codes under which suppliers name the product on their invoices, without the supplier’s name), accounting and compatibility codes, name, short description, group, producer, characteristics, category identifiers, image links and whether it is sellable and published; the list of categories, characteristics and producers; counts of products with catalog problems (missing name, code, images, description, category, producer or characteristics, codes shared by several products); and which products were not sold or consumed in the last N months and which of them have stock. No prices, costs, stock quantities, sales values or supplier names are sent.
• Proposal results — if proposals are enabled, the identifiers and status of the proposals the assistant created.
• Connector context — the name of the connector, its rate limit, which figures and tools it may use, and the endpoint addresses.
• Your company name, as the title of the connection.
• Your own name and e-mail address, only if the AI application asks for the identity of the person connecting (standard for connectors published in app directories) and only for the administrator who approves the connection. This is shown on the approval screen before you confirm. Nothing is sent about other users of the account.

What is never sent

The following are excluded by design, and no setting, grant or request can expose them through this connector:

• Customer, supplier, contact or employee records; names, addresses, e-mail addresses, phone numbers.
• The content of documents (invoices, orders, receipts, contracts): their lines, partner, values or text. The only reference to an individual document is the document number in pilot reports, described above.
• Prices, costs and stock quantities per product, through the catalog tools.
• Passwords, API keys, access tokens, encryption keys or bank/authority credentials.
• Payment card data.
• National identification numbers and copies of identity documents.
• Health data or any other special category of personal data under Article 9 GDPR.
• Per-employee or per-user performance figures.
• Any data belonging to another BOCP account.

Note on sole traders. Where a business trades under a personal name (for example a Romanian PFA or întreprindere individuală), the company name transmitted as the connection title may itself constitute personal data. It is disclosed only because you chose to connect the account.

Note on free text. Product short descriptions are sent as written in your catalog. If someone has typed personal data into a product description, it will be sent with it; product descriptions are not the place for such data.

4. Legal roles

BOCP acts as a processor on behalf of your company, which is the controller of the data in its ERP account. We process it only on your documented instructions.

Your recorded permission settings are that instruction. When an administrator enables the connection and sets what may be read or proposed, BOCP stores that decision. Business figures are disclosed only after an administrator ticks them. Pilot tools (for example the product catalog) are active by default because they contain no personal data and no financial figures; an administrator can turn each of them off at any time, and choosing “no access” for pilots on the approval screen turns them off. The approval screen lists the tools that are active by default.

The AI provider is your processor, not our sub-processor. You connect your own account with the AI provider (for example Anthropic) and agree to that provider’s terms directly. What the AI provider does with the data it receives, including whether it is transferred outside the EEA, is governed by your relationship with them — please review their privacy terms. We recommend a business or API account with the AI provider and an appropriate data processing agreement.

5. What we store, and for how long

To operate and secure the connection, BOCP stores the following inside your own account or in its central service database:

The IP address recorded in the access log is that of the AI provider’s servers, not of an individual end user.

We do not collect the content of your conversations with the AI assistant, and the connector never requests an assistant’s chat history, memory or files.

6. Sharing with third parties

We do not sell your data and we do not share it for advertising.

Data is transmitted only to the AI provider you connected, and only as described in section 3. We disclose nothing else to third parties except where required by law.

7. Your control and your rights

• You choose the scope. An administrator ticks each business figure individually; figures added to BOCP later stay off until ticked. Pilot tools are active by default and can be turned off one by one. Proposal tools work only with the paid licence and the access type “Read and write”; choosing that access type turns them on, and the administrator turns off the ones not wanted.
• Every change is approved by a person. Nothing proposed by the assistant is applied without approval in BOCP.
• You can withdraw access at any time — deactivate or delete the connector in BOCP, or remove the connection in the AI product. Deactivating a connector immediately revokes its tokens.
• You can see what was accessed. Every request, including refused ones, is visible in the access log inside BOCP (Integrări → Conectori AI → Agenți AI → the connector → Jurnal accesări).
• As a data subject under GDPR you have rights of access, rectification, erasure, restriction, objection and portability. Because BOCP acts as a processor for your company, please direct such requests to the company operating the ERP account; we assist controllers in responding to them.

8. Security

• The connection uses HTTPS only.
• Authorisation uses OAuth 2.1 with PKCE; approval requires a recent, deliberate login by an administrator of the account, and cannot be granted from a BOCP support session.
• Tokens are short-lived, rotate on use, and are stored only as hashes.
• Each account’s data is held in a separate database, and a token issued for one account cannot be used to read another.
• Every request is checked against the connector’s permissions at the moment of the call; requests are rate limited per connector and every request is logged.
• Texts and image links proposed by the assistant are cleaned before storage, and images are downloaded only from public addresses, only after approval.

9. Children

BOCP ERP is business software and is not directed at children.

10. Changes to this policy

If we change what the connector discloses, we will update this policy and the in-product data declaration shown when permissions are granted, before the change takes effect.

Last updated: 14 October 2026 — added pilot reports with document numbers, the product catalog tools, catalog-quality and unsold-product filters, change proposals approved by a person, and pilot tools active by default.

11. Contact

Questions about this policy or about data handled through the connector: office@reallife.solutions

BOCP ERP — www.bocp.ro