Privacy Policy

• Account information. If you sign in with Google, we receive your name, email address and profile picture from Google. If you create an account with an email address and a password, we receive the address and email a link to it to confirm it; the password itself is never stored — our authentication provider, Supabase, keeps only a one-way hash of it.
• Page content. Everything you put on a page — its address, title, bio, links, colours, social handles and uploaded avatar. This is published by you, to the address you hand out.
• Payment information. Payments are processed by Stripe. We never see or store card details.
• Server logs. IP addresses, browser type and access times for the dashboard and the API, including the address each API key was last used from, kept for security and diagnostics.

If you join the waitlist

Until Bolt Claw opens, you can leave an email address at /waitlist, without an account. We keep the address, when you left it, where the link you followed said it came from, and a keyed hash of your IP address (not the address itself), which we use only to limit how many addresses one visitor can add. We use your email address only to tell you when Bolt Claw opens, and we delete the list within 30 days of sending that email. To come off it sooner, write to support@boltclaw.ai.

• To operate the Service and serve the pages you publish
• To process payments and manage your subscription
• To show you the views, clicks and messages your pages received
• To detect and prevent abuse
• To comply with legal obligations

We do not sell personal information, and we do not use the contents of anyone’s page or inbox for advertising.

Exactly three things, per page view:

• The time the page was opened
• The origin of the referring site, if there was one — the domain, never the full URL
• A two-letter country code, or nothing

And, per link click: the link, and the time.

For a page view or a click on a page’s links, we do not record IP addresses, user agents, cookies, device fingerprints, session identifiers or any other value that would recognise the same visitor twice. There is no unique-visitor count for a page because there is no way for us to produce one.

A referral link is the exception. When someone opens a link a partner shares for a business’s referral program, we keep a salted fingerprint of their IP address and a device class for 90 days, to detect fraud, as section 8 explains. We still never store the IP address itself.

No third-party analytics, advertising or measurement script runs on a page — not Google Analytics, not a Meta pixel, not Vercel Analytics, not one of ours. A measurement id shared across pages would identify their owner, and identifying page owners is the specific thing this design exists to prevent.

Our own marketing pages — the home page, pricing, features and so on — do use analytics. Those are our pages, not yours.

Reading a page, following its links and being counted as a view all happen without an account. Sending a message does not. To write to a creator you sign in, with Google or with an email address and a password, because the conversation that follows has to live somewhere both of you can come back to.

What we store is the text of each message and which account sent it. You do not type a name or an address: the people who manage the page see the display name and picture Google provides, if you signed in with Google (an account created with an email address and a password has neither), and a contact email that defaults to the address you sign in with and that you can change at any time in your account settings. We no longer store any form of IP address, hashed or otherwise, for messaging.

Both people can see when the other read a message. A creator can mark a conversation read, replied, archived or spam, and can close it, delete it, or block you from writing to that page again. You can delete your own copy of a conversation at any time — except one a creator has blocked, which is retained so that a record of abuse cannot be erased by the person responsible.

Replies reach you inside Bolt Claw. A creator’s own email address is never disclosed to you unless they deliberately choose to answer from their own mail client, and we never send mail on anybody’s behalf.

Every page sends noindex, nofollow to crawlers, as a header and as a meta tag. No page address appears in our sitemap or robots.txt, and there is no directory, explore feed or search across pages. Page identifiers are random rather than sequential, so there is nothing to enumerate.

Bolt Claw lets a business run a referral or affiliate program. This section is a short summary; the Referral Privacy Notice has the details, the legal bases and every retention period.

Who decides about your data

Bolt Claw is the controller of a partner’s own account: sign-in and security, profile, payout details, the collection and keeping of tax forms, and the record of consents. Bolt Claw is also the controller of the records it keeps about clicks on referral links. Each business is the controller of its own program’s data (its partners’ memberships and results, the people it adds from its own app, its referred customers and its waitlists), and Bolt Claw processes that data for it, as its processor. If your question is about data a business holds about you, ask that business first.

Partners

If you promote a program with a Bolt Claw account, we keep your account, your payout details (sealed with AES-256-GCM encryption), your memberships and results, and the results of fraud checks, to run your account and the programs you join (our contract with you) and to prevent fraud (a legitimate interest). When you apply to a program we keep a fingerprint of your IP address for 30 days. A business sees your display name for its program, your country, the type of payout method you use, your status, your results and your application; it sees your email address only if you choose to share it, and receives your payout details only to pay money it owes you. Fraud checks may make money wait longer or send it to a person at the business, but they never reject a commission, confirm fraud or ban anyone by themselves. In Settings, Account you can download your referral data or delete it; records each business must keep for its accounts and taxes are kept without your name or email address.

People a business adds from its app, and its referred customers

If a business added you to its program from its own app, or you became its customer after a referral, the business is the controller and Bolt Claw is its processor: please send your questions to the business. For a referred customer we keep the business’s own identifier, the identifier its payment system gives you, a fingerprint of your email address (never the address itself), and your conversions and rewards. For a person added from the business’s app, unless you joined a waitlist on a page Bolt Claw hosts (below), we keep no email address and never email you, except a six-digit code sent to an address you type yourself to sign a tax form.

People who click a referral link

When someone opens a referral link, we send them on to the business’s site and record the click: the link, the time, a two-letter country code, the referring site’s host name, a device class (mobile, tablet, desktop or unknown), a random click identifier, whether the link carried a paid-advertising signal, any campaign tag, and a salted fingerprint of the IP address (a keyed hash, not the address). We never store the IP address or the browser’s user agent, and the redirect sets no cookie. We use these records to count clicks, to credit a later sign-up or purchase to the right partner and to detect fraud, which is a legitimate interest of ours and of the businesses. The IP fingerprint and the device class are removed after 90 days; the click itself is deleted after 25 months, keeping only monthly counts. Our own marketing pages also keep a referral code in a cookie when you arrive through a link to Bolt Claw’s own referral program.

Waitlists

A business can run a waitlist, and is its controller. If you join on the business’s own form, we keep no email address for you. If you join on a page Bolt Claw hosts for it, we keep your address sealed, send it one confirmation email, and keep a fingerprint of your IP address for 30 days to limit sign-ups. An entry nobody confirmed is erased after 14 days, and your address is deleted 90 days after the waitlist ends.

Tax forms

A business may ask a partner, or someone it added from its app, to sign a US tax form (W-9, W-8BEN or W-8BEN-E) in Bolt Claw. Each form is sealed with AES-256-GCM encryption and given only to the business that asked for it; every opening is written in its access log. Bolt Claw files no return, withholds no tax and checks no tax number with any authority. A form is kept for 4 years after the later of the day it was signed and the last payout it supported.

• Stripe — payments and subscriptions
• Supabase — authentication, database and file storage
• Vercel — hosting
• Cloudflare — the API and MCP endpoints, api.boltclaw.ai and mcp.boltclaw.ai, and the check that a person, not a bot, is using the sign-in, sign-up and password forms (Turnstile)
• Sentry — reports of errors in our servers and in the dashboard, so we can fix them. Never from a creator’s public page
• Google — sign-in, if you choose it
• Resend — delivery of the emails we send
• Anthropic — suggested replies drafted with AI, from the recent messages of the conversation being answered, when you or one of your automations ask for one
• The social networks you connect — Instagram, Facebook and Threads (Meta), X and Bluesky directly, and TikTok, LinkedIn, YouTube and Pinterest through Zernio

No third-party script of any kind loads on a creator’s public page. Not an analytics tag, not a pixel, and no longer a bot-check either — requiring an account to send a message removed the last one.

Each has its own privacy policy, which we encourage you to read.

Account information is kept while the account is active. Deleting a page removes the page, its links and its view and click history, ends the owner’s access to every conversation on it, and frees its address for anyone else to take.

One thing deliberately survives that: if you messaged a page that has since been deleted, your copy of the conversation remains yours, marked read-only and showing the page’s name and nothing else. A conversation you took part in is not the other party’s alone to erase. You can delete it yourself whenever you like.

Billing records are kept as long as accounting and tax law require.

Connections are encrypted in transit. Database access is scoped by row-level security rather than by application code, so a query can only reach rows in the workspaces the person who made it belongs to, and only what their role there allows. Our support staff can open a workspace they do not belong to only from an administrative console that requires two-step verification; such a session lasts at most four hours, needs a stated reason, and is shown to the organisation’s owners and admins in that workspace’s activity log. API keys are stored as hashes, never as the key. No method of transmission or storage is completely secure, and we do not claim otherwise.

Depending on where you live, you may have the right to access, correct, export or delete your personal information. Write to us at the address below and we will respond within a reasonable time. If you are asking about messages you have sent to creators, they are all in your own account under Messages, where you can read and delete them without asking us.

The Service is not intended for anyone under 18. We do not knowingly collect personal information from children, and will delete it if we learn we have.

We may update this policy. Material changes will be posted here with a revised date, and continued use of the Service after that constitutes acceptance.

Questions go to support@boltclaw.ai.