# Program terms and privacy requests Terms written from your program's own settings, your customers' privacy requests answered, and what partners download and delete themselves. Your program's terms are the contract between your business and each partner. Bolt Claw writes a first version for you from a template, filled in with what your program really does, and answers the privacy requests your customers and your in-app referrers send you. Partners look after their own data themselves. None of this is legal advice. The template and Bolt Claw's own legal documents are drafts waiting for a lawyer's review: have your terms checked for the countries your partners live in. ## Write my terms On a program's **Settings**, **Write my terms** asks a few questions: - your business's legal name, as it signs contracts, and the address partners write to; - who may join (anyone, your own customers, or only people you invite) and the youngest age you accept, from 16 to 21; - countries partners may not join from, if any; - how many months a payout may wait for a missing tax form before you may forfeit it (0 for never); - the law that governs the terms, and the courts that decide disputes. Everything else is read from the program's own settings, so the terms cannot say something the program does not do: the cookie window and whether the first or the last click counts, the hold before a commission can be paid, the minimum payout and its currency, how often you pay, whether payouts wait for tax forms or invoices, self-billing, the second tier, partner levels, and the disclosure line partners add when they share. The text appears in an editable box. Change any word, then **Use these terms** and **Save settings**. Saving raises the terms' version, and every partner must accept the new version before their next payout. Every generated text ends with: "Based on Bolt Claw's template. Not legal advice; have it checked for the countries your partners live in." ### From the API, or an AI assistant `POST /v1/referrals/programs/{id}/terms/draft` takes the same answers and returns the text, the settings it read and the clauses it used. It saves nothing: ```bash curl -X POST https://api.boltclaw.ai/v1/referrals/programs/$PROGRAM_ID/terms/draft \ -H "Authorization: Bearer $BOLTCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{"answers": {"business_name": "Acme Ltd", "contact_email": "partners@example.com", "governing_law": "the laws of England and Wales", "courts": "the courts of England and Wales"}}' ``` To use the text, send it as `terms` to `PATCH /v1/referrals/programs/{id}`. Because every partner must accept new terms, an AI assistant's key is asked first when the body carries `terms` (`referral.terms.update`), unless your organisation lets assistants save terms without asking. ## Privacy requests from your own people Your customers and the users you made referrers in your own product are your data: Bolt Claw keeps it for you, as your processor. When one of them asks what you hold or asks you to delete it, look them up by the id your system uses for them. - **In the dashboard:** Referrals, **Privacy requests**, then **Look up a person**. - **Through the API:** `GET /v1/referrals/data-subjects/{external_id}`, with the `external_id` you sent with their conversions or when you made them a referrer, or the payment processor's customer id. Percent-encode it in the path. The answer lists every program in this workspace they were referred in or refer for: conversions and rewards for a customer; display name, status, links, commissions and rewards for a referrer. An email fingerprint is shown only as held or not, never its value. Bolt Claw holds no customer's name, email address, postal address or phone number. **Erase** (in the dashboard, or `DELETE /v1/referrals/data-subjects/{external_id}`) removes their ids and fingerprints in every program for good. Amounts, conversions and commissions stay as anonymous rows, because your books need them; a referrer's links stop counting and their payout details and panel sessions are deleted. Stored copies of webhook bodies that carried the id are scrubbed. An AI assistant's key is always asked first (`referral.subject.erase`). Each lookup and each erasure is in your activity log, with counts only. A Shopify shop's privacy webhooks use the same erasure: see [Shopify](https://boltclaw.ai/docs/referral-shopify). ## What partners do themselves Partners are Bolt Claw accounts, and their account is theirs. In **Settings, Account** a partner can: - **download their referral data**: a ZIP with every program they joined, their links, codes, commissions with the reason for each amount, rewards, payouts, tax forms and invoices as PDFs, their consents, and their saved payout details. It is built in the background, emailed when ready, and can be downloaded once within 24 hours; - **delete their referral data**: they leave every program, their name becomes "Former partner" and their payout and tax details go. What you must keep for your books stays: commissions, payouts, invoices, self-billing agreements, and tax forms until their retention date. A partner whose payout is on its way through a provider is asked to wait until it arrives or fails. ## How long data is kept Referral data is deleted or made anonymous on a schedule: click rows after 25 months (their monthly counts stay), a click's address fingerprint after 90 days, rejected applications after 6 months, a customer's email fingerprint 25 months after their last conversion, broadcasts after 25 months, invoices after 10 years, and tax forms 4 years after the last payout they supported. Amounts are never deleted. Bolt Claw's own privacy notice for referrals is at https://boltclaw.ai/privacy/referrals, and the terms for merchants at https://boltclaw.ai/terms/referrals.