Loading…
Last updated: May 12, 2026 · Effective: May 12, 2026
This Privacy Policy ("Policy") explains how Choclement LLC, a Delaware limited-liability company doing business as BHmetrics("BHmetrics", "Choclement", "we", "us", "our"), collects, uses, discloses, retains, transfers, and protects information in connection with the BHmetrics web application, APIs, workers, dashboards, Copilot, marketing site, documentation, and related services (collectively, the "Service"), available at bhmetrics.com and related subdomains.
BHmetrics is a business-to-business product designed for businesses and is not intended for personal, family, or household use. We treat individuals using the Service as business representatives, rather than in their personal capacity. Most personal data that we process in connection with the Service belongs to our customers' end consumers, where our customer is the controller / business and we are the processor / service provider. This Policy describes both (i) data we process about you, the operator (we are the controller for that data), and (ii) data we process on behalf of our customers about their end consumers (we are the processor and our customer is the controller). Where we act as a processor, our processing is also governed by our Data Processing Addendum ("DPA"). This Policy is read together with our Terms of Service, our Acceptable Use Policy, our Cookie Policy, and our Subprocessor List.
Questions, requests, or privacy concerns? Email [email protected].
The remainder of this Policy is the controlling document.
This Policy addresses three categories of personal data and the corresponding data subjects:
When you connect a platform, we receive data from it on your authorization. For end-consumer event data this is Customer Data and we are your processor.
Within the preceding twelve (12) months we have collected the following CCPA / CPRA categories of personal information from the sources described above (your interactions with the Service, our customers' systems and storefronts, and our subprocessors):
We do not collect "sensitive personal information" as defined under CPRA, and we do not collect biometric information, genetic data, health or medical data, racial or ethnic origin, religious beliefs, sexual orientation or sex life, or the contents of consumer communications.
For operators in the European Economic Area, the United Kingdom, and Switzerland, we rely on the following lawful bases under Article 6 GDPR:
Where we process Customer Data on behalf of a customer, the lawful basis is the customer's, and we rely on the customer's representation that it has obtained the necessary consent and provided the required notices.
We disclose personal data only as described below:
For California residents, the categories of recipients to whom we have disclosed each CCPA category of personal information for a business purpose are:
We have not sold or shared any of the above for cross-context behavioral advertising in the preceding twelve (12) months.
We rely on the following subprocessors. Each operates under a written data-protection agreement with us. We give at least thirty (30) days' advance notice of any addition or replacement of a subprocessor that processes personal data, by email and in-product. You have fifteen (15) days after notice to object on reasonable data-protection grounds; if we cannot accommodate the objection, you may terminate the affected portion of the Service for a pro-rata refund of prepaid, unused fees.
The canonical, up-to-date list is at /legal/subprocessors. As of the last updated date, it includes:
Additional subprocessors are listed on the canonical page as we add them. See /legal/subprocessors for current list, locations, data categories, and transfer mechanisms.
See our Cookie Policy for a complete inventory of cookies, local storage, and session storage used by the Service, including the cookies set by the BHmetrics first-party pixel on customer storefronts.
Sec-GPC: 1 or DNT: 1, we drop the user-agent and IP-hash fields before persisting the event — the event is still recorded for the customer's analytics (the customer is the controller for end-consumer data), but no end-consumer device identifiers are stored on our side. We will treat the same signals as valid opt-out requests for any optional tracking we add in the future.Customers install our pixel on their own storefronts (typically Shopify) to capture conversion events and click identifiers. When installed, the pixel sets first-party cookies and storage on the storefront's domain (not on bhmetrics.com), including _cdt_sid (cookie, up to 1-year max-age, SameSite=Lax) and _cdt_sid/_cdt_clicks in localStorage / sessionStorage. End-consumer identifiers are SHA-256 hashed before persistence: where the BHmetrics first-party pixel is the source, hashing happens in the browser; where data arrives via a server-to-server integration (e.g., a Shopify webhook delivers a payload that includes plaintext email and phone), hashing happens at the earliest server-side entry point and the plaintext values are not persisted. As the operator of the storefront, the customer is the controller for these cookies and is responsible for end-consumer consent and notices under applicable law. End consumers should consult the privacy policy of the storefront they are visiting; this Policy describes only the data we Process as a processor on behalf of that customer.
Where customers route ad clicks through BHmetrics click-redirect endpoints, we receive the click identifiers, user-agent string, IP address (hashed before retention), and the destination URL. We use this data solely to (a) reconcile clicks to subsequent conversions, (b) provide click-quality diagnostics to the customer, and (c) operate the redirect itself. Click-redirect data is retained per Section 11.
This section explains how to request deletion of personal data we hold about you. A stand-alone, equivalent page is available at /legal/data-deletion — that is the canonical URL we submit to advertising platforms (e.g., Meta's "User Data Deletion" field for OAuth-enabled apps).
Use the in-product self-service controls under Settings → Brand → Your data:
DELETE to confirm. We acknowledge within ten (10) business days and complete verified requests within thirty (30) days, except where applicable law requires longer retention (e.g., tax records held for 7 years and audit logs as described below).If you cannot access your account, email [email protected] from the email address associated with your account and we will verify your identity and process the request manually.
When you revoke an OAuth grant from Settings → Connections — or from the Connected Platform's own apps/permissions page — we delete the associated OAuth refresh tokens immediately and stop ingesting new data from that platform. To also delete the historical data we already ingested from that platform, additionally use the Export / Delete flow above, or email [email protected] requesting deletion scoped to the specific Connected Platform.
BHmetrics is a B2B processor. Our customer (the brand whose ad you clicked or whose storefront you bought from) is the controller for your personal data. Please contact the brand directly using the contact details on their website or in their privacy policy. We will assist the brand in fulfilling verified deletion requests as required by our DPA and applicable law. If you cannot identify the brand or are unable to reach them, email [email protected] with as much detail as you can (the brand name, the ad platform, the date of the event), and we will attempt to route your request.
Deletion removes the Personal Data we hold about you from active systems. Some data is retained beyond a deletion request, as permitted or required by law:
We acknowledge deletion requests within ten (10) business days and complete verified requests within thirty (30) days for U.S. residents and forty-five (45) days for EU/UK/EEA residents (extendable as described in Section 12.1). We may need to verify your identity before processing a request; see Section 12.2.
The targets below describe how long we intend to retain each category of data. These targets are enforced through a combination of operational practices and scheduled clean-up jobs that we continue to build out as the product matures; specific retention cut-offs may currently be applied on a periodic, manual basis. Verified deletion requests are honored within the timelines in §11.5 regardless of these targets.
Beyond the periods above, we may retain personal data as required by law or for the establishment, exercise, or defense of legal claims. We may delete or de-identify any personal data at any time, with or without notice, in accordance with our retention policy.
Depending on where you live (and where your end consumers live), you may have the following rights under the GDPR, the UK GDPR, the Swiss FADP, the California Consumer Privacy Act as amended by the CPRA, the Virginia CDPA, the Colorado CPA, the Connecticut CTDPA, the Utah UCPA, the Texas TDPSA, the Oregon Consumer Privacy Act, the Delaware Personal Data Privacy Act, the Iowa Consumer Data Protection Act, the Tennessee Information Protection Act, the Montana Consumer Data Privacy Act, the Indiana Consumer Data Protection Act, and other applicable laws:
Most controls are available in-app at Settings → Brand → Export / Delete. For requests we cannot service in-product, email [email protected]. We respond within forty-five (45) days, extendable once for another forty-five (45) days where reasonably necessary, with notice (or sooner where applicable law requires). For UK/EEA requests we will respond within thirty (30) days, extendable by up to sixty (60) more days where reasonably necessary.
We will verify your identity before fulfilling a request by matching at least two data-points associated with your account (or, for end consumers, by working through our customer of record). We may redact from any disclosure any personal data relating to other individuals.
You may use an authorized agent, including one with a power of attorney; we may require written authorization, verification of the agent's authority, and direct verification of your identity.
We will not charge a fee for processing or responding to a verifiable request, unless the request is excessive, repetitive, or manifestly unfounded, in which case we will tell you why and provide a cost estimate before proceeding.
If we deny a request, you may appeal by replying to our denial with "Appeal" in the subject line, or by emailing [email protected]. We will respond to the appeal within sixty (60) days. If your appeal is denied, you may contact your state attorney general or supervisory authority.
If you are an end consumer of a BHmetrics customer, the customer is the controller / business of record. Please direct your request to them first. We will assist the customer in fulfilling verified requests as required by our DPA and applicable law.
This section supplements Sections 3 through 12 for California residents. In the preceding twelve (12) months, we collected and disclosed the categories of personal information listed in Section 3.5 for the business purposes described in Section 6. We did not sell or share personal information for cross-context behavioral advertising. We do not collect "sensitive personal information" as defined under CPRA. We act as a "service provider" to our customers with respect to Customer Data; the customer is the "business". We retain personal information for the periods described in Section 11.
California Shine the Light (Cal. Civ. Code § 1798.83). We do not share personal information with third parties for those third parties' direct marketing purposes. California residents may submit Shine-the-Light inquiries to [email protected].
"Your Privacy Choices". Because we do not sell or share personal information, we do not maintain a "Do Not Sell or Share My Personal Information" link. You may nonetheless submit a confirmatory opt-out request to [email protected]. We do not sell or share for cross-context behavioral advertising, so a confirmed opt-out reaffirms that posture.
Nevada residents may submit a verified request not to sell certain covered personal information to [email protected]. We do not currently engage in the sale of personal information as defined under Nevada law.
Residents of these states may exercise the rights listed in Section 12, as applicable. We process personal information in our capacity as a "controller" for Prospect Data and operator-side User Data, and as a "processor" for Customer Data. We do not engage in "targeted advertising" or "profiling" decisions producing legal or similarly significant effects.
BHmetrics's infrastructure is primarily located in the United States. If you or your end consumers are in the European Economic Area, the United Kingdom, Switzerland, or other jurisdictions with cross-border-transfer restrictions, personal data is transferred to and processed in the United States and other countries that may not offer the same level of data protection as your home jurisdiction. We rely on the following safeguards:
We may, in the future, self-certify under the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. DPF; if and when we do, we will update this Section and the DPA accordingly. Copies of the SCCs are available on request.
We maintain administrative, technical, and physical safeguards designed to protect personal data, including:
NO SYSTEM IS FULLY SECURE. We cannot guarantee that the Service will be immune from wrongdoing, malfunction, unlawful interception, hacking, tampering, or other misuse. You provide personal data at your own risk and are responsible for protecting your credentials and devices. If we become aware of a personal-data breach affecting Customer Data, we will notify you without undue delay (and in any event in accordance with our DPA and applicable law), provide information reasonably needed to comply with notification obligations, and cooperate in remediation. To report a suspected vulnerability or incident, email [email protected].
The Service includes automated processing — rule engines, multi-armed bandits, budget allocators, attribution models (MTA, MMM, incrementality), predictive lifetime-value modeling, anomaly detection, creative tagging and embeddings, and the AI Copilot. By default, BHmetrics recommends actions and the operator (you) decides whether to apply them. You may enable auto-apply for specific rule categories. These features operate against you, the operator, and against advertising campaigns, not against your end consumers. They do not produce legal or similarly significant effects on identified individuals. You remain responsible for the configuration, supervision, and outcomes of any automation you enable, and you can disable automation at any time via Settings → Brand or the "Freeze All Automation" toggle.
When you use the AI Copilot, we send to our AI subprocessor (currently Anthropic) only the chat input you submit together with aggregated brand context: brand name, current guardrail configuration, list of active rule names and statuses, summaries of open anomalies, summaries of recent automation-log entries, and your conversation history within that thread. We do not send raw end-consumer event data, hashed end-consumer identifiers, individual click events, or any PII to the AI subprocessor. Under Anthropic's commercial terms of service, Anthropic does not use inputs or outputs submitted through its commercial API to train its foundation models.
Where the Service generates vector embeddings of creative assets (images, video frames, ad copy) for similarity search, brand-voice matching, or fatigue detection, the embedding provider receives only the asset reference necessary to compute the embedding and is is engaged under terms that do not permit retention or training on the asset.
We do not use Customer Data, Prospect Data, or User Data to train foundation AI models. We rely on our AI subprocessors' commercial terms (e.g., Anthropic's commercial API terms) which provide that customer inputs and outputs are not used for foundation-model training. We may use aggregated and de-identified usage data to evaluate, monitor, and improve our internal models (e.g., predictive-LTV, MMM) and the Service.
BHmetrics operates a cooperative benchmarking pool that contributes anonymized, aggregated performance metrics — for example, industry-tier ROAS, CPM, CTR, and CPA at the brand-cluster level — so that participating brands can compare against the pool. Brands are enrolled by default, and you may opt out at any time from Settings → Brand.
Contributions are de-identified: the brand identifier is hashed and metrics are aggregated across multiple brands within an industry / revenue tier so that re-identification of a contributing brand is not reasonably possible. No end-consumer personal data, hashed identifiers, click data, or PII is included — only aggregated brand-level performance KPIs.
After you opt out, we stop contributing further metrics from your brand on a going-forward basis. Aggregated metrics already contributed remain in the pool and are not retroactively removable because they are not identifying.
The Service is a B2B product not directed to children. We do not knowingly collect personal data from anyone under sixteen (16) — or under thirteen (13) in the United States, consistent with COPPA. If we learn we have collected such data, we will block use and delete it. If you believe a child has interacted with the Service, contact us at [email protected].
The Service contains links to, and integrations with, third-party services (Connected Platforms, payment providers, support tools, advertisers). Their privacy practices are governed by their own policies, not this Policy. We encourage you to review them. We are not responsible for the privacy practices, content, or security of any third-party service.
We send transactional and account-related email (sign-up confirmation, billing, rule fires, security notices, weekly digest) on a service-essential basis; you cannot opt out of service-essential communications. Marketing email is opt-in (where required) and includes one-click unsubscribe. You can manage email preferences in Settings at any time. If you unsubscribe from marketing email, we will continue to send transactional and legal notices required to operate the Service.
We do not sell or share personal information for cross-context behavioral advertising, and we have no "Do Not Sell or Share" action to take on your behalf. You may submit a confirmatory request to [email protected]; we will respond in writing reaffirming the no-sale, no-share posture.
Our customers are solely responsible for determining whether and how they use the Service, and for ensuring that all Authorized Users, and all individuals whose personal data is included in Customer Data processed through the Service, have been provided with adequate notice and given informed consent to the processing of their personal data where consent is necessary or advised, and that all legal requirements applicable to the collection, recording, use, or other processing of data through the Service are fully met. Customers are also responsible for handling data-subject rights requests under applicable law by their users and other individuals whose data they process through the Service. Our role, responsibilities, and Customer's responsibilities are further described in our DPA.
We may update this Policy from time to time. Material changes are announced by email at least thirty (30) days before they take effect, or, where required by law, with the consent we are required to obtain. Minor edits (typos, contact-info updates, subprocessor additions covered by Section 9) are reflected here with a new "Last updated" date. Continued use after the effective date of a material change constitutes acceptance to the extent permitted by law.
General privacy inquiries. Choclement LLC, doing business as BHmetrics
c/o registered agent on file with the Delaware Secretary of State
Email: [email protected]
Service URL: bhmetrics.com
Data Protection Officer. We are not currently required to appoint a statutory Data Protection Officer under GDPR Article 37. If and when we do, we will publish their contact here. In the meantime, privacy inquiries are handled by [email protected].
EU and UK Representatives. If we appoint a Representative under GDPR Article 27 or UK GDPR Article 27, their contact details will be listed here. In the meantime, EU/EEA, UK, and Swiss residents may direct inquiries to [email protected], and may also contact their local supervisory authority.
Supervisory authorities. EU/EEA residents may lodge complaints with the supervisory authority in their member state (a list is at edpb.europa.eu). UK residents may contact the Information Commissioner's Office (ico.org.uk). Swiss residents may contact the Federal Data Protection and Information Commissioner. U.S. residents may contact their state attorney general or applicable privacy regulator.