Referral Privacy Notice

2.1 In this notice:

• "Business" means a business that runs a referral, affiliate or similar program on Bolt Claw.
• "Controller" means the organisation that decides why and how personal data is used, and "Processor" means an organisation that uses it only on a controller's instructions.
• "Dashboard" means the signed-in part of boltclaw.ai.
• "Fingerprint" means a value made from a piece of data with a keyed hash (HMAC-SHA256) under a secret key, which lets our systems recognise the same value again without storing the data itself.
• "In-app Referrer" means a person a Business adds to its program from its own app, who has no Bolt Claw account.
• "Partner" means a person who uses a Bolt Claw account to promote a Business's program.
• "Program" means a Business's referral, affiliate or similar program.
• "Referral Link" means a link such as boltclaw.ai/r/jane, or the same link on a Business's own links domain.
• "Referred Customer" means a person who signs up with or buys from a Business after a referral.

3.1 Bolt Claw is the Controller of the data that belongs to a Partner's own account rather than to any one Program: sign-in and security details, the Partner's profile, Payout Details, the collection and keeping of tax forms, the record of consents, and the Partner's export and deletion requests.

3.2 Bolt Claw is also the Controller of the records it keeps about clicks on Referral Links, described in clause 6, and of the checks against fraud and abuse that it runs across all Programs.

3.3 Each Business is the Controller of the data about its own Program: its Partners' memberships and results, its In-app Referrers, its Referred Customers and the people on its waitlists. Bolt Claw is that Business's Processor and uses that data only to provide the Program on the Business's instructions.

3.4 If your question is about data a Business holds about you, ask that Business first, because its own privacy notice applies. Bolt Claw gives every Business tools to find and erase what it holds about one person, and we help it answer you.

4.1 We collect this data about you as a Partner:

1. (a) your account: your email address, and your name and picture if you sign in with Google; whether your address is confirmed; whether you use two-step verification; and when and how you signed in;
2. (b) your profile: your country and the type of payout method you use;
3. (c) your Payout Details: where you want to be paid, such as a PayPal or Wise email address or bank details, and an email address for gift cards, which we keep sealed; and the identifiers of accounts a payment provider creates for you when a Business pays you through it;
4. (d) your memberships: for each Program, your application and its answers, your website, your display name, your status, the version of the Program's terms you accepted, whether the Business may see your email address, whether friends may see your name, how you appear on the Program's leaderboard, when you acknowledged its disclosure line, whether you muted its messages, and who recruited you if the Program pays a second tier;
5. (e) application checks: when you apply, a Fingerprint of your IP address, your device class, a similarity Fingerprint of your answers, and counts of similar applications;
6. (f) your activity: your links, codes and campaign tags, click and conversion counts, commissions with the reason for each amount, rewards that are not money, payouts, statements, contest places, and the results of fraud checks on your conversions and applications;
7. (g) tax and invoices: your tax forms, described in clause 8, your invoicing details for self-billing, which we keep sealed, invoices issued to you or uploaded by you, and your choice about receiving Form 1099-NEC electronically;
8. (h) consents: a record of each consent you give or withdraw, with the version of the text you were shown and the time;
9. (i) a Fingerprint of a payment card, made from the card fingerprint that a Business's Stripe account reports, if that Business's Stripe reports a purchase by you.

4.2 We use this data for these purposes, on these legal bases under Article 6(1) of the GDPR and the UK GDPR:

1. (a) to run your account and the Programs you join, show you your results and let Businesses pay you, because it is necessary for our contract with you, the Partner Terms (Article 6(1)(b));
2. (b) to keep accounts and payouts secure and to prevent fraud and abuse, through sign-in checks, the hold after Payout Details change, the email that lets you lock your payouts, application checks, fraud scores and card Fingerprints, because Bolt Claw and the Businesses have a legitimate interest in preventing fraud and protecting Partners' money (Article 6(1)(f));
3. (c) to collect tax forms and to prepare invoices and year-end data for the Businesses that pay you, because it is necessary for our contract with you and for the Businesses' legitimate interest in meeting their tax obligations, and where a Business has a legal obligation under the law of the UK or of an EU member state, because of that obligation (Article 6(1)(c));
4. (d) to keep the record of consents and of payments, because Bolt Claw and the Businesses have a legitimate interest in being able to show what was agreed and paid, and where the law requires those records, because of that obligation;
5. (e) for your optional choices, such as showing your name to friends or on a leaderboard, sharing your email address with a Business, receiving Form 1099-NEC electronically and receiving a Program's messages by email, because you consent (Article 6(1)(a)), and you can withdraw that consent at any time in the Dashboard.

4.3 A Business whose Program you apply to or join sees your display name for that Program, your country, the type of payout method you use, your status, your results and your application. It sees your email address only if you switch on sharing it for that Program, and it never sees your Bolt Claw account's identifier.

4.4 A Business receives your Payout Details only to pay money it owes you, in a payout file, through the payment provider it pays you with, or through its own payout system. The payment provider receives the details it needs to pay you.

4.5 This table shows how long we keep a Partner's data.

4.6 You have these rights, and can use them as follows:

1. (a) to get a copy of your data, and to take it elsewhere: use "Download my referral data" in Settings, Account, which builds a ZIP file of your referral data with each table as JSON and as CSV and a README explaining every file, and emails you when it is ready, without a link to the file; you download it once, while signed in, within 24 hours;
2. (b) to correct your data: edit your profile, display names and Payout Details in the Dashboard, and sign a new tax form to replace an old one;
3. (c) to have your data deleted: use "Delete my referral data" in Settings, Account, which shows you first what is deleted, what is kept and why, and any money still owed to you;
4. (d) to object to our use of your data on the basis of legitimate interests, or to ask us to restrict it: write to [[PRIVACY CONTACT EMAIL]];
5. (e) to withdraw a consent: switch the choice off in the Dashboard, which does not affect what was done before;
6. (f) to complain to a data protection authority, such as [[LEAD SUPERVISORY AUTHORITY]] or the authority where you live or work.

4.7 When you delete your referral data, we keep some records, without your name or email address, because each Business must keep them for its accounts and taxes: commissions, rewards, payouts, invoices, self-billing agreements, the record that you accepted a Program's terms, self-billing and electronic Form 1099-NEC, and your tax forms until their retention date. Money still owed to you can then no longer be paid to you through Bolt Claw.

4.8 We answer a request you send us within one month. We may ask you to confirm it comes from you, for example by writing from your account's sign-in address.

5.1 If a Business added you to its Program from its own app, or you became its customer after a referral, the Business is the Controller and Bolt Claw is its Processor. Please send your questions and requests to the Business.

5.2 For an In-app Referrer, Bolt Claw holds the Business's own identifier for you, a Fingerprint of your email address if the Business sends one, your results and rewards, counts of how often you shared through each channel, your Payout Details if you entered them in the referral panel, which we keep sealed, and a tax form if you signed one in the panel. Unless you joined a waitlist on a page Bolt Claw hosts, as clause 7 describes, Bolt Claw keeps no email address for you and never emails you, except a six-digit code to an address you type yourself when you sign a tax form.

5.3 For a Referred Customer, Bolt Claw holds the Business's own identifier for you, the identifier its payment system gives you, a Fingerprint of your email address, your conversions and their amounts, the rewards you were given, and, where the Business's Stripe account reports it, a Fingerprint of the card you paid with. To spot people referring themselves, we also keep Fingerprints of addresses that look similar to yours, for 8 days.

5.4 The Fingerprint of a Referred Customer's email address is removed 25 months after their last conversion. Amounts and commissions are kept for 10 years, for the Business's accounts.

5.5 A Business can look up and erase everything Bolt Claw holds about one of its customers or In-app Referrers, by its own identifier, in its dashboard or through Bolt Claw's API. A shop that uses Bolt Claw's Shopify app receives Shopify's privacy requests the same way.

6.1 When someone opens a Referral Link, Bolt Claw sends them on to the Business's site and records the click.

6.2 For each click we record the link, the time, a two-letter country code, the host name of the referring site but never its full address, a device class that is one of mobile, tablet, desktop or unknown, a Fingerprint of the IP address, a random click identifier, whether the link carried a paid-advertising signal and the advertising campaign's identifier, and a campaign tag the Partner chose, if any.

6.3 We do not store the IP address or the browser's user agent, and the redirect sets no cookie. We use the IP address only to make its Fingerprint and to check, in memory, whether it belongs to a data centre, and then discard it. A link-preview service or another automated visitor is not recorded.

6.4 We use these records to count clicks for the Program, to credit a later sign-up or purchase to the right Partner, and to detect fraud such as automated or repeated clicks and purchases that follow a click too quickly. Bolt Claw and the Businesses have a legitimate interest in counting referrals accurately and preventing fraud (Article 6(1)(f)).

6.5 The Fingerprint lets our checks notice many clicks from one address, but it does not tell us who you are, and nobody outside Bolt Claw's systems sees it. Businesses and Partners see counts of clicks.

6.6 The Fingerprint of the IP address and the device class are removed after 90 days. The click is deleted after 25 months, keeping only monthly counts, and its click identifier is deleted with it. A fraud check about a click is deleted after 90 days.

6.7 Bolt Claw decides what a click records and how long it is kept, in the same way for every Program, so Bolt Claw is the Controller of these click records. The Business decides what to do with its referral results.

6.8 After the redirect, the Business's site may keep the referral code in the visitor's browser with Bolt Claw's tag, as the Cookie and Tag Notice explains. If the Business shows a welcome offer, the visitor's browser asks Bolt Claw for it once, sending only the referral code; for that request we use a Fingerprint of the IP address only to limit requests per minute, and delete the counter within a day.

7.1 A Business can run a waitlist. If you join on the Business's own form, the Business sends Bolt Claw only its own identifier for you, and Bolt Claw keeps no email address for you.

7.2 If you join on a page Bolt Claw hosts for the Business, we keep your email address sealed so that only the Business can read it through Bolt Claw, a Fingerprint of the address in a standard form so that one person has one place, a Fingerprint of your personal link, and a Fingerprint of your IP address and your device class to limit sign-ups. Your browser solves a small puzzle before you join, and the page sets no cookie and loads nothing from any other site.

7.3 We send one confirmation email to the address you give, and you confirm on the page it links to. The Business can send invites through Bolt Claw, and export addresses, only for people who confirmed.

7.4 An entry nobody confirmed is erased after 14 days, and the Fingerprint of an IP address is removed after 30 days. Your address and your personal link are deleted 90 days after the waitlist ends, or at once if the Business deletes the waitlist's addresses or erases your entry, and the Fingerprint of your address stays with your entry until the Business deletes the waitlist's addresses or erases your entry.

7.5 The Business is the Controller of its waitlist, and Bolt Claw is its Processor. Please send your questions and requests to the Business.

8.1 A Business may ask a Partner, or an In-app Referrer through its app's referral panel, to sign a US tax form in Bolt Claw: a Form W-9, W-8BEN or W-8BEN-E, or Bolt Claw's statement that the person is not a US person.

8.2 A form holds what the IRS form asks for, such as your name or your organisation's name, address, tax classification, tax identification number, country of residence, date of birth on a Form W-8BEN, and, on some Forms W-8BEN-E, the names, addresses and tax identification numbers of an organisation's substantial US owners. It also holds your electronic signature record.

8.3 Each form is sealed with AES-256-GCM encryption and given only to the Business that asked for it. It is opened only for you, to give you your copy and to fill in your next form, for that Business in a session with two-step verification, and to prepare that Business's year-end Form 1099-NEC data and recipient copies. It is never sent in an email, an API response or a webhook, and every opening is written in its access log.

8.4 Bolt Claw decides how forms are collected, sealed and kept, and the Business that receives a form decides how it uses it for its own tax reporting, so each is a Controller for its own part. The legal bases are those in clause 4.2(c).

8.5 Bolt Claw does not file any return, does not withhold tax, does not check tax identification numbers with any tax authority and does not report anyone's earnings to any tax authority.

8.6 A form and its access log are kept for 4 years after the later of the day it was signed and the last payout it supported, and a form still in force for an active member is kept for longer, such as a Form W-8BEN while it is valid. They are then deleted.

9.1 Bolt Claw's fraud checks give each conversion a score from 0 to 100 with a reason for each part of it. A high score makes the money wait longer, or sends it to a person at the Business to review.

9.2 A check never rejects a commission, confirms fraud or bans anyone by itself; only a person at the Business does that. A Partner sees "Under review" only while a person must decide, and can ask the Business to look again.

10.1 Payout Details, invoicing details, tax forms and waitlist addresses are sealed with AES-256-GCM encryption, and email addresses, payout destinations and cards are compared only as Fingerprints.

10.2 Signed-in sessions cannot read the referral tables that hold Partners', In-app Referrers' or customers' data directly; every read goes through code that checks whose data it is. Files such as tax forms, invoices and data exports leave Bolt Claw only through single-use download links that work for ten minutes.

10.3 Bolt Claw support can open a Business's workspace only through an audited support session that requires two-step verification and that the Business can see in its activity log.

10.4 Public entry points are limited per visitor, and the API per key. Payouts are held for 48 hours after Payout Details change, and the change is announced to the account's own address.

11.1 Bolt Claw uses these providers for the referral features: Supabase for the database, sign-in, file storage and server functions; Vercel for hosting the website, Referral Links and partner portals; Cloudflare for the API and the AI-assistant endpoint, and for the bot check on password forms; Resend for delivering email; Sentry for reports of errors; and Google for signing in, if you choose it.

11.2 Sentry receives error reports from our servers and from the signed-in dashboard, with addresses, headers, cookies and request bodies removed. Its code never runs in the browser on a Referral Link, a referral panel, a waitlist page or a partner portal.

11.3 A Business may connect its own payment, payout or billing providers, such as PayPal, Wise, Stripe, Tremendous, Trolley, Tango or its billing system. Those are the Business's providers, used on its instructions, and data reaches them only when the Business connects them.

11.4 We do not use artificial intelligence services for the referral features.

12.1 Some of the providers in clause 11 process personal data outside the United Kingdom and the European Economic Area, including in the United States. Where they do, Bolt Claw relies on an adequacy decision or on the safeguards the law provides, such as the European Commission's standard contractual clauses and the UK's International Data Transfer Addendum, and you can ask us for details at [[PRIVACY CONTACT EMAIL]].

13.1 Section 4 of our Privacy Policy says: "We do not record IP addresses, user agents, cookies, device fingerprints, session identifiers or any other value that would recognise the same visitor twice." That sentence describes visitors to a link-in-bio page, and it remains true for them.

13.2 It is not true of a Referral Link. When someone opens a Referral Link, we keep a Fingerprint of their IP address and a device class for 90 days, as clause 6 explains, and an application to a Program and a waitlist's hosted page keep a Fingerprint of the IP address for 30 days.

13.3 Our own marketing pages also keep a referral code in a cookie when someone arrives through a link to Bolt Claw's own referral program, as the Cookie and Tag Notice explains.

14.1 Bolt Claw accounts, and so being a Partner, are not for anyone under 18. A Business whose customers or users may be children is responsible for what its own Program asks of them.

15.1 We will post any change to this notice here with a new date, and tell Partners about a material change by email or in the Dashboard.

15.2 Questions go to [[PRIVACY CONTACT EMAIL]]. For help with your account, write to support@boltclaw.ai.