1. About this agreement
1.1 This Data Processing Agreement (the "DPA") is between [[COMPANY LEGAL NAME]] ("Bolt Claw") and the organisation that has accepted the Referral Services Terms (the "Merchant"). It forms part of the Referral Services Terms and the Terms of Service (together, the "Agreement").
1.2 This DPA applies to Referral Data that Bolt Claw processes on the Merchant's behalf in the Referral Services. It does not apply to data Bolt Claw processes as a controller, which clause 3.3 describes.
1.3 If this DPA conflicts with any other part of the Agreement on the processing of Referral Data, this DPA wins. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses win.
2. Definitions
2.1 In this DPA:
- "GDPR" means Regulation (EU) 2016/679, and "UK GDPR" means the GDPR as it forms part of the law of the United Kingdom, read with the Data Protection Act 2018.
- "Data Protection Laws" means the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, and any other law on the processing of personal data that applies to a party's processing of Referral Data, including the privacy laws of the states of the United States.
- "Controller", "processor", "personal data", "processing", "data subject", "personal data breach" and "supervisory authority" have the meanings the GDPR gives them, and include the equivalent terms of other Data Protection Laws.
- "Referral Services" has the meaning the Referral Services Terms give it, and "Program", "Partner", "Referrer", "Promoter", "Referred Customer", "Provider", "Connector", "Credential", "Tax Form" and "Assistant" have the meanings given there.
- "Referral Data" means the personal data that Bolt Claw processes on the Merchant's behalf in the Referral Services, as Annex 1 describes.
- "Account Data" means the personal data of a Partner's own Bolt Claw account that Bolt Claw processes as a controller, as clause 3.3 describes.
- "Sub-processor" means a processor that Bolt Claw engages to process Referral Data.
- "Standard Contractual Clauses" means the clauses annexed to Commission Implementing Decision (EU) 2021/914.
- "UK Addendum" means the International Data Transfer Addendum to the Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
3. Roles
3.1 The Merchant is the controller of Referral Data. Where the Merchant processes Referral Data as a processor for another controller, the Merchant confirms that controller has authorised it to appoint Bolt Claw, and Bolt Claw is then the Merchant's sub-processor.
3.2 Bolt Claw is the processor of Referral Data and processes it only to provide the Referral Services to the Merchant.
3.3 Bolt Claw is a controller in its own right, and this DPA does not apply, for the following:
- (a) a Partner's own Bolt Claw account, which a Partner uses across every Merchant: their sign-in and the account's email address, their security settings and sessions, their payout details, the Tax Forms they sign as Bolt Claw collects and keeps them (including the identity details Bolt Claw uses to prefill a new form for another Merchant and to mark earlier forms out of date when their name, number or address changes), their own choices about what Merchants may see, and their requests to Bolt Claw to export or delete their referral data;
- (b) the security of the Service across all Merchants: one ceiling on clicks per address fingerprint across the whole Service, the comparison of Partner applications across the whole Service for bursts from one address or device and for near-identical answers, and the data-centre address lists;
- (c) reports that signed-in accounts make about listings in the partner directory;
- (d) Bolt Claw's own records of what its staff did, including support sessions, and its billing records; and
- (e) the monthly total of referred revenue per organisation and currency, which Bolt Claw keeps for its own planning and which identifies no person.
3.4 A Tax Form that a Partner signs is Account Data under clause 3.3(a), and the Merchant that asked for it receives it as clause 3.5 says. When a Partner deletes their referral data, Bolt Claw keeps the Tax Forms they gave each Merchant, sealed, until the date in Annex 2 section H, so that the Merchant can meet its own duty to keep them. A Tax Form that a Referrer signs in the in-app panel is Referral Data.
3.5 When Bolt Claw gives the Merchant Account Data about a Partner, such as an email address the Partner chose to share, payout details for a Payout the Merchant owes, or a Tax Form, the Merchant receives it as a separate controller and is responsible for its own use of it.
3.6 The Merchant is responsible for having a lawful basis for the Referral Data it puts into or causes to be collected by the Referral Services, for the notices it gives data subjects, including the notice and any consent its website needs for the referral tag, and for its instructions being lawful.
4. Instructions
4.1 Bolt Claw processes Referral Data only on the Merchant's documented instructions, including about transfers of Referral Data outside the European Economic Area, the United Kingdom and Switzerland, unless the law that applies to Bolt Claw requires otherwise. In that case Bolt Claw will tell the Merchant of that legal requirement before processing, unless that law forbids it.
4.2 The Merchant's documented instructions are this DPA, the rest of the Agreement, the settings the Merchant chooses in the Referral Services, the actions its people, its API keys and its Assistants take there, and any further instructions the parties agree in writing.
4.3 Bolt Claw will tell the Merchant at once if, in its opinion, an instruction infringes Data Protection Laws.
4.4 The Merchant instructs Bolt Claw to do the following when the data subject concerned asks Bolt Claw directly, without asking the Merchant first:
- (a) to include, in a Partner's export of their own referral data, what each of the Merchant's Programs records about that Partner: the membership, its links and codes, monthly counts of clicks and conversions, Commissions with their reasons, Grants, Payouts and invoices;
- (b) when a Partner deletes their referral data or their Bolt Claw account, to end each of their memberships in the Merchant's Programs, replace their display name with "Former partner", clear the link to their account, their leaderboard name, their name-on-welcome choice, their email sharing, their application answers and their fingerprints, archive their links under new random codes, switch off their discount codes, and keep against that nameless record the Commissions, Grants, Payouts, invoices, self-billing agreements, and the records of their acceptance of the Program Terms, of self-billing and of electronic delivery of Form 1099, without changing any of the Merchant's totals;
- (c) to let a Partner or Referrer correct what they gave, and withdraw a consent they gave in the Referral Services; and
- (d) to act on the privacy webhooks that Shopify sends for a shop the Merchant linked to a Program, as clause 9.4 describes.
4.5 A Partner's deletion under clause 4.4(b) is refused while a Payout to that Partner is in progress at a Provider, until it finishes.
4.6 The Merchant instructs Bolt Claw to keep Referral Data for the periods in Annex 2 section H and then to delete or anonymise it as that section says. The Merchant may delete Referral Data sooner with the tools clause 9 describes.
5. Confidentiality
5.1 Bolt Claw gives access to Referral Data only to the people who need it to run, support and secure the Referral Services, and makes sure each of them is bound by a duty of confidentiality.
5.2 Bolt Claw's support staff can open a Merchant's workspace only through a support session, which Annex 2 section E describes and which the Merchant's owners and admins can see in the workspace's activity log.
6. Security
6.1 Bolt Claw implements the technical and organisational measures in Annex 2, which are designed to give a level of security appropriate to the risk, as Article 32 of the GDPR requires.
6.2 Bolt Claw may change those measures, provided the change does not reduce the overall protection of Referral Data.
7. Sub-processors
7.1 The Merchant gives Bolt Claw general written authorisation to engage the Sub-processors listed in Annex 3.
7.2 Bolt Claw will tell the Merchant of any intended addition or replacement of a Sub-processor at least 30 days in advance, by email to the owners of the Merchant's organisation and by updating Annex 3. The Merchant may object on reasonable grounds relating to data protection within those 30 days. If the parties cannot resolve the objection, the Merchant may stop using the affected part of the Referral Services, or end the Referral Services Terms, before the change takes effect, and Bolt Claw will refund any fee the Merchant paid in advance for the Referral Services for the period after that.
7.3 Bolt Claw imposes on each Sub-processor, by written contract, data protection obligations that give at least the protection this DPA gives, and remains fully liable to the Merchant for each Sub-processor's performance of them.
7.4 A Provider that the Merchant connects with an account of its own is the Merchant's own provider, not Bolt Claw's Sub-processor. The Merchant chooses it, contracts with it, and instructs Bolt Claw to send it Referral Data through the Connector. Bolt Claw sends a Provider only what the Connector needs for the action the Merchant asked for.
8. International transfers
8.1 Where the processing of Referral Data under this DPA involves a transfer from the European Economic Area to a country without an adequacy decision, the Standard Contractual Clauses apply between the Merchant as data exporter and Bolt Claw as data importer, and are incorporated into this DPA: Module Two where the Merchant is a controller, and Module Three where the Merchant is a processor.
8.2 For the Standard Contractual Clauses: Clause 7 (the docking clause) applies; under Clause 9(a), Option 2 (general written authorisation) applies with the notice period in clause 7.2; the optional wording in Clause 11(a) does not apply; under Clause 13, the competent supervisory authority is the one that Clause 13 names for the data exporter; under Clause 17, Option 2 applies, and where the law of the Member State in which the data exporter is established does not allow third-party beneficiary rights, the law of Ireland applies; under Clause 18, disputes go to the courts of the Member State whose law applies under Clause 17; Annex I.A is the parties as clause 1.1 and the Merchant's account name them, with Bolt Claw's contact at [[PRIVACY CONTACT EMAIL]]; Annex I.B is Annex 1 of this DPA; Annex I.C is the authority under Clause 13; Annex II is Annex 2 of this DPA; and Annex III is Annex 3 of this DPA.
8.3 Where the transfer is from the United Kingdom, the UK Addendum applies and is incorporated into this DPA. Its Table 1 is completed with the parties' details as clause 8.2 gives them, Tables 2 and 3 with the choices and annexes in clause 8.2, and in Table 4 either party may end the UK Addendum as its section 19 allows.
8.4 Where the transfer is from Switzerland, the Standard Contractual Clauses apply as clause 8.2 sets them out, with the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority and references to Member State law read as references to Swiss law where the Swiss Federal Act on Data Protection applies.
8.5 Bolt Claw transfers Referral Data to a Sub-processor outside the European Economic Area, the United Kingdom or Switzerland only under an adequacy decision or the safeguards of Article 46 of the GDPR, and the equivalent UK and Swiss rules.
8.6 If a public authority asks Bolt Claw for Referral Data, Bolt Claw will tell the Merchant unless the law forbids it, will give only the data the request lawfully requires, and will challenge a request it reasonably believes is unlawful.
9. Help with data subjects' requests
9.1 Taking into account the nature of the processing, Bolt Claw helps the Merchant, by the tools in this clause, to answer requests from data subjects who exercise their rights under Data Protection Laws.
9.2 The Merchant can look up everything the Referral Services hold about one of its Referred Customers or Referrers by the Merchant's own identifier for them, in the dashboard under Referrals > Privacy or with GET /v1/referrals/data-subjects/{external_id}. The answer covers every Program of the workspace: the customer records (saying whether an email fingerprint exists, never its value), their conversions, the Grants they were given, and the Referrer record with its own Commissions and Grants. Every lookup is recorded in the audit log.
9.3 The Merchant can erase such a person with DELETE /v1/referrals/data-subjects/{external_id} or from the same screen. Erasure removes the person's identifiers and email fingerprint, the order references on their conversions, and their card and look-alike fingerprints; anonymises their Referrer record, deleting its payout details, session tokens and share counts, archiving its links under new codes and switching off its discount codes; and scrubs queued webhook messages that name them. It keeps amounts and Commissions so that the Merchant's books stay whole. Every erasure is recorded in the audit log, and an Assistant's request to erase always waits for a person's approval.
9.4 For a shop the Merchant linked to a Program through Bolt Claw's Shopify app, Bolt Claw acts on Shopify's privacy webhooks: a customer data request waits on the Program's Integration tab for the Merchant to view, download and mark answered; a customer erasure is carried out as clause 9.3 describes; and a shop erasure, which Shopify sends 48 hours after the app is uninstalled, deletes what the app brought.
9.5 The Merchant can also change or erase a Referrer, end a waitlist and delete its addresses at once, and correct Program records, through the dashboard and the API.
9.6 If Bolt Claw receives a request about Referral Data directly, other than one that clause 4.4 covers, it will pass it to the Merchant without undue delay and in any case within five working days, and will not answer it except to say that it has passed it on, unless the Merchant asks it to.
9.7 Bolt Claw does not charge for the tools in this clause.
10. Help with security, assessments and consultations
10.1 Taking into account the nature of the processing and the information available to it, Bolt Claw helps the Merchant meet its obligations under Articles 32 to 36 of the GDPR: security, notifying personal data breaches, data protection impact assessments and prior consultation with a supervisory authority.
10.2 Bolt Claw makes available its own assessments of the risk engine and of the fingerprints it uses, and its records of processing, to help the Merchant with its own assessments.
11. Personal data breaches
11.1 Bolt Claw will notify the Merchant of a personal data breach affecting Referral Data without undue delay, and in any case within 48 hours after becoming aware of it, so that the Merchant can meet its own deadline of 72 hours.
11.2 The notice goes by email to the owners of the Merchant's organisation and to any privacy contact the Merchant has given Bolt Claw. It says, as far as Bolt Claw then knows: what happened; the categories and approximate numbers of data subjects and records concerned; the likely consequences; what Bolt Claw has done and proposes to do, including to reduce any harm; and who at Bolt Claw can give more information. Where Bolt Claw cannot give all of this at once, it gives it in phases without further undue delay.
11.3 Bolt Claw will take reasonable steps to contain the breach and reduce its effects, will keep the Merchant informed, and will give the Merchant the information it reasonably needs to notify supervisory authorities and data subjects.
11.4 Bolt Claw will not notify a supervisory authority or a data subject about a breach of Referral Data on the Merchant's behalf unless the Merchant asks it to or the law requires it.
11.5 A notice under this clause is not an admission of fault.
11.6 Bolt Claw's Incident Response Plan for the Referral Services sets out how Bolt Claw handles a breach.
12. Deletion and return at the end
12.1 Before the Referral Services end, the Merchant can retrieve Referral Data through the dashboard's exports and the API. Deleting the organisation is permanent, so the Merchant should first export every record the law requires it to keep, such as Tax Forms, invoices and payout records.
12.2 When an owner deletes the Merchant's organisation, its workspaces and their Referral Data are deleted from the live database at once, and the files stored for them are deleted within 30 days.
12.3 When the Referral Services Terms end for any other reason, Bolt Claw will let the Merchant retrieve Referral Data for 30 days and will then delete it within a further 30 days, unless the Merchant asks for it to be deleted sooner.
12.4 Referral Data in backups is overwritten in the normal backup cycle of Bolt Claw's database host, and Bolt Claw does not restore deleted Referral Data from a backup except to recover from an incident.
12.5 Clauses 12.2 to 12.4 do not apply to data that the law requires Bolt Claw to keep, which Bolt Claw keeps only for as long as that law requires and protects under this DPA, or to Account Data.
13. Information and audits
13.1 Bolt Claw makes available to the Merchant the information necessary to demonstrate compliance with Article 28 of the GDPR, including this DPA and its annexes, and answers the Merchant's reasonable written questions about the processing of Referral Data once in any twelve months.
13.2 Where that information is not enough, the Merchant may audit Bolt Claw's processing of Referral Data, itself or through an independent auditor bound by confidentiality, once in any twelve months, on at least 30 days' written notice, during business hours, without access to other customers' data, and at the Merchant's own cost. The Merchant may audit more often where a supervisory authority requires it or after a personal data breach of Referral Data.
13.3 Bolt Claw may answer an audit with a current independent audit report covering the same processing, if it has one.
14. United States privacy laws
14.1 Where a US state privacy law applies to Referral Data, Bolt Claw is the Merchant's service provider, contractor or processor under that law.
14.2 Bolt Claw will not sell or share Referral Data, as those laws define selling and sharing, and will not retain, use or disclose it outside its direct business relationship with the Merchant, or for any purpose other than providing the Referral Services, except as those laws permit.
14.3 Bolt Claw will not combine Referral Data with personal data it receives from or on behalf of another person, except as those laws permit, including to detect security incidents and protect against fraud as clause 3.3(b) describes.
14.4 Bolt Claw will tell the Merchant if it can no longer meet its obligations under those laws, and the Merchant may then take reasonable steps to stop and remedy any unauthorised processing.
15. Liability, term and changes
15.1 Each party's liability under this DPA is subject to the limits in the Referral Services Terms, except where Data Protection Laws or the Standard Contractual Clauses do not allow it to be limited.
15.2 This DPA lasts for as long as Bolt Claw processes Referral Data for the Merchant.
15.3 Bolt Claw may change this DPA in the way the Referral Services Terms allow Bolt Claw to change them, but no change may reduce the protection this DPA gives Referral Data unless the law requires it.
15.4 Bolt Claw's contact for this DPA is [[DPO OR PRIVACY LEAD]], at [[PRIVACY CONTACT EMAIL]]. Bolt Claw's representative in the European Union is [[EU REPRESENTATIVE]] and in the United Kingdom is [[UK REPRESENTATIVE]].
16. Annex 1: Details of the processing
16.1 Subject matter: the Referral Services that the Merchant uses to run its Programs.
16.2 Duration: for as long as the Agreement lasts, and then until deletion under clause 12, with each kind of data kept no longer than Annex 2 section H allows.
16.3 Nature of the processing: collecting, recording, storing, sealing, fingerprinting, matching, computing, scoring, displaying to the Merchant and to Promoters, sending to the Merchant's systems by webhook and to its Providers through Connectors, emailing on the Merchant's behalf where this Annex says so, exporting at the Merchant's request, and erasing.
16.4 Purposes: running the Merchant's Programs; recording clicks and attributing conversions; computing Commissions and Grants; finding fraud against the Merchant's Programs and holding money while a person decides; preparing and sending Payouts through the Merchant's own Providers and files; collecting Tax Forms and preparing tax data and invoices for the Merchant; running waitlists, leaderboards, contests and the in-app panel; sending the Merchant's messages to its Promoters; and helping the Merchant answer privacy requests.
16.5 Frequency: continuous.
16.6 Special categories: none are intended. The Merchant must not send special categories of personal data, or data about criminal convictions, to the Referral Services. Taxpayer identification numbers and payout details are sensitive and are protected as Annex 2 sections A and D describe.
16.7 The categories:
| Category | Data subjects | Personal data | Where it comes from | Who receives it |
|---|---|---|---|---|
| 1. Link clicks | People who follow a Promoter's referral link | The time; a two-letter country code; the referring site's host name, never its address; a keyed HMAC-SHA256 fingerprint of the IP address, never the address, kept 90 days; a device class (mobile, tablet, desktop, bot or unknown); a random click id; whether an advertising click id was present and the campaign id; a campaign tag; fraud flags | The referral redirect and the Merchant's own server | The Merchant; the Promoter sees counts only |
| 2. Referred Customers | The Merchant's customers who arrived through a Promoter or were reported as referred | The Merchant's own customer id; the Provider's customer id; which Promoter, link, code and click brought them; a keyed fingerprint of their email address, never the address; their conversions (lead, sale, refund or dispute, amount, currency, source, the Provider's event and order references, time, campaign tag); a keyed fingerprint of their payment card's Stripe fingerprint; keyed fingerprints of near variants of their email address, kept 8 days; risk scores and reasons; the Grants given to them; for a Shopify order, a SHA-256 of the checkout token, kept 2 days | The Merchant's API calls, its connected billing and shop Providers, the website tag, and the referral redirect | The Merchant; the Promoter sees the referral's event, amount and status, never the customer's name, email or identifier |
| 3. Referrers | The Merchant's own users whom its server makes Promoters | The Merchant's own id for them; a display name the Merchant sends; a keyed fingerprint of their email; status; links and codes; counts of shares per channel, never to whom; panel session tokens, stored as SHA-256 only; payout details they enter, sealed; Tax Forms they sign in the panel, sealed, and a keyed fingerprint of the address they type to receive the signing code; Commissions, Grants and Payouts; their leaderboard name choice; consents; fraud flags | The Merchant's server and the Referrer in the in-app panel | The Merchant; the Referrer in the panel |
| 4. Waitlist entrants | People who join the Merchant's waitlist | A Referrer record as category 3; for an entry made through Bolt Claw's hosted page, the email address sealed, a keyed fingerprint of the canonical mailbox, a SHA-256 of the entrant's private link, a keyed fingerprint of the visitor's address, confirmation, place, confirmed friends, flags and any disqualification with its reason; for an entry made through the Merchant's own form, the Merchant's id and no email | The Merchant's server, or the entrant on the hosted page | The Merchant; the entrant on their private page. Bolt Claw emails a hosted-page entrant one confirmation and, when the Merchant presses Invite, the Merchant's invitation |
| 5. Partners in the Merchant's Programs | Partners who apply to or join a Program | The membership: display name for the Program, status and dates, the Program Terms versions accepted, application answers with the questions as asked, the website they gave, a similarity fingerprint of their answers, a keyed address fingerprint for 30 days and a device class; their email only if they chose to share it; links and codes; clicks and conversions attributed to them; Commissions with their reasons, Grants, Payouts with the payout method type and country, and their delivery status; risk scores, reasons and flags; whether a Tax Form is in and since when (the forms themselves are Account Data, clause 3.4); invoices and self-billing agreements; acknowledgement of the disclosure line; leaderboard name choice and contest places; who recruited them and whom they recruited; broadcasts sent to them and whether they muted them | The Partner, the Merchant, and the Program's activity | The Merchant; payout details and Tax Forms only as clause 3.5 says |
16.8 The Merchant's own people who use the dashboard are not Referral Data. Bolt Claw processes their account data as a controller under its Privacy Policy.
17. Annex 2: Technical and organisational measures
These measures are those the Referral Services have as built.
A. Encryption and sealing
17.1 Connections to the Service are encrypted in transit.
17.2 Bolt Claw seals the most sensitive Referral Data with AES-256-GCM under a key held only as a secret of its server functions, with a one-byte key id in front of every value so that the key can be rotated and every value sealed again without loss. What is sealed: Partners' and Referrers' payout details; signed Tax Forms in full, and the Merchant's own tax and invoicing details; self-billing agreements; invoice files and data-export files; waitlist entrants' email addresses; and every Credential the Merchant connects, including billing signing secrets and read keys, restricted Stripe keys, the Stripe App's and the Shopify app's tokens, and payout Provider credentials.
17.3 A copy of each key is kept outside the database host, so that losing the host's copy does not lose the data, and the rotation steps are written down and tested.
B. Fingerprints and tokens
17.4 Where the Service needs to recognise a value again without keeping it, it keeps a keyed HMAC-SHA256 fingerprint instead: of a click's IP address (under its own salt), of email addresses, of payment card fingerprints (per workspace), of near variants of email addresses, of waitlist mailboxes, of payout destinations and of tax identities.
17.5 Every bearer token and link the Service issues is stored only as its SHA-256: API keys, panel session tokens, one-download file links, unsubscribe links, payout-lock links, portal sessions and sign-in handoff codes, and waitlist entrants' private links.
C. Data minimisation
17.6 The Service never stores a click's IP address or user agent, only the fingerprint and device class in category 1 of Annex 1, and it never stores the email address of a Referred Customer or of a Referrer the Merchant's server creates.
17.7 The Service never receives a payment card number. It keeps only a keyed fingerprint of Stripe's own card fingerprint.
17.8 The referral redirect, the in-app panel, the partner portal, the hosted waitlist page and the join page load no third-party script. The website tag stores only the referral code, the click id and the campaign tag on the Merchant's own domain.
17.9 Error reports sent to Sentry are scrubbed of query strings, headers, cookies, request bodies and user details, are never sent from a public referral page, and, from the server functions that write referral data, carry only an error's code.
17.10 The API call log records the operation, the key, the status, the duration and a request id, never a request body, and keeps them for 14 days.
D. Access control within a Merchant
17.11 Every tenant table has row-level security switched on. The referral tables grant a signed-in session nothing, or only what its own workspace may read, and are reached through server functions in which every statement is filtered by the caller's workspace, checked by automated tests on every change.
17.12 A request with an API key acts only in the workspace that issued the key, and anything belonging to another workspace is answered as not found. A key's authority is the scopes it was given, narrowed on every request to the permissions its creator still holds.
17.13 Within the Merchant's organisation, roles and permissions decide who may view referral programs, manage them, or adjust commissions and pay. Sending a Payout Batch, connecting a payout Provider, changing how a Program pays, opening a Tax Form, exporting tax data and adding a domain need a Two-Step Session, and the money actions also need a sign-in in the last 15 minutes.
17.14 An Assistant can never hold the payout scope or the panel-session scope, and its requests to move money, message people, publish or delete wait for a person's approval, which is bound to that one request, lasts 24 hours and can be used once.
E. Access by Bolt Claw staff
17.15 The administrative console is open only to Bolt Claw's platform administrators. Every administrator must pass two-step verification once the platform switch that requires it is on, which is one of the steps of going live; until then an administrator who has set up two-step must use it. Every cross-customer read in the console goes through a function that checks the administrator first and records what was read.
17.16 A support session into a Merchant's workspace can be started only from the console, by an administrator in a two-step session, with a typed reason of 10 to 300 characters. It lasts at most four hours. In the Referral Services it can read and cannot change anything; it cannot open sealed values, payout details, Tax Forms or Credentials, and cannot export anything. The Merchant's owners and admins see it, with its reason, in the workspace's activity log as "BoltClaw support".
17.17 Administrative access to the database host, the hosting and the API Workers is limited to the people who run the Service.
F. Logging
17.18 The Service records in an audit log every action the Merchant's people, keys and Assistants take on referral settings, payouts, Tax Forms, data-subject lookups and erasures, and support sessions.
17.19 Each Tax Form has an append-only access log of when it was created, viewed, downloaded, superseded, expired, exported and reminded about.
17.20 A consent ledger records every consent given or withdrawn in the Referral Services, with the text version shown and the time. It is append-only: no session can read or write it, and only an erasure removes a row or its link to an account.
G. Abuse and fraud controls
17.21 The visitor-facing doors of the Referral Services, such as the join page, the in-app panel's data, the friend's offer, the payout-lock link, the hosted waitlist page and the unsubscribe link, have per-visitor limits applied before anything is looked up. The API has per-key and per-address ceilings. Clicks from one address fingerprint are not recorded past a ceiling per minute across the whole Service, and clicks from known data-centre address ranges are stored and not counted.
17.22 The risk engine scores each conversion from 0 to 100 with a sentence for each reason. A high score makes money wait longer or wait for a person. It never rejects a Commission, bans a Promoter or confirms fraud: only a person does.
H. Retention
17.23 Daily jobs apply this schedule, and the job that applies the longer periods writes the counts it will delete to the audit log before it deletes anything. Each period is a setting Bolt Claw can change in its console, and Bolt Claw's retention schedule for the Referral Services gives the reason for each.
| Data | Kept for | Then |
|---|---|---|
| Click IP fingerprint and device class | 90 days from the click | Removed from the click |
| Click rows, with their click ids | 25 months from the click | Deleted; monthly counts per link and Promoter kept |
| Risk assessments | 90 days for a click's; 180 days for others unless a fraud flag points at them; 13 months at most for any | Deleted |
| Look-alike email fingerprints | 8 days | Deleted |
| Card fingerprints | 400 days after the card was last seen, or at once when the Promoter is erased | Deleted |
| An application's address fingerprint, and a waitlist visitor's | 30 days | Removed |
| Panel session tokens, one-download file links and emailed signing codes | 1 day after they expire | Deleted |
| Payout-lock links | 30 days after they expire or are used | Deleted |
| Billing and payout webhook receipts | 30 days | Deleted |
| Shopify checkout token hashes | 2 days | Deleted |
| Rejected applications from Partners who never earned anything | 6 months after the membership last changed | The membership is deleted |
| Waitlist addresses and entrants' link hashes | 14 days if nobody confirmed the entry, which is then erased; otherwise until 90 days after the waitlist ends, or at once when the Merchant deletes them or the entrant is erased | Removed |
| Referred Customers' email fingerprints | 25 months after the customer's last conversion, or after they were first seen if there was none | Removed |
| Commissions, Grants and Payouts | For as long as the Program exists | Never deleted by a job; a rejected or banned membership with no money activity for 10 years is anonymised, and amounts stay |
| Invoices and their files | 10 years from issue | Deleted, files included |
| Tax Forms and their access logs | 4 years after the later of signing and the last Payout paid to that person by that Merchant, and never while the form is the live form of a pending or approved member | Deleted |
| Broadcast messages and their delivery records | 25 months after sending | Deleted |
| Broadcast drafts nobody sent | 30 days after the last edit | Deleted |
| A Partner's data export | The file until downloaded or 24 hours after it is ready; its record 30 days | Deleted |
| API call log | 14 days | Rolled up into daily counts |
| Webhook delivery attempts | 30 days | Deleted |
I. Testing and change control
17.24 Every change runs an automated test suite that applies every database migration to a real Postgres database and checks, table by table, what each kind of member and each other organisation can reach, together with static checks that no public response, webhook or email carries an owner, workspace or organisation identifier. Each stage of the referral platform was reviewed for security and its database changes reviewed before it was finished.
J. Incidents and resilience
17.25 Bolt Claw follows its Incident Response Plan for the Referral Services. During maintenance the Service becomes read-only for people, never stops a public page or a referral link, and keeps every stop button working, including disconnecting a Provider.
K. Connectors
17.26 Each payout Connector reaches only its own Provider's hosts, through one bounded request function, with the Credential the Merchant connected, and uses idempotency keys made from Bolt Claw's own ids so that a repeated request cannot pay twice.
18. Annex 3: Sub-processors
18.1 Bolt Claw uses these Sub-processors for Referral Data. Bolt Claw treats each of them as processing Referral Data outside the European Economic Area and the United Kingdom, and relies on clause 8.5 for each.
| Sub-processor | What it does with Referral Data |
|---|---|
| Supabase | Hosts the database, authentication, file storage and the server functions that hold and process all Referral Data. Database region: [[DATABASE HOSTING REGION]]. |
| Vercel | Hosts the website, the dashboard, the referral redirect, the in-app panel, the partner portal and the hosted waitlist page, so it receives each request to them, including the visitor's IP address; holds the Merchant's custom host names to serve them. |
| Cloudflare | Runs the API gateway at api.boltclaw.ai and the MCP server at mcp.boltclaw.ai, so it carries every API and assistant request and its contents, and keeps short-lived counters by address for abuse limits. |
| Resend | Delivers the emails the Referral Services send, including the waitlist confirmation and the Merchant's invitations, the signing code a Referrer asks for, broadcasts to Partners, and notices to Partners and to the Merchant's people. |
| Sentry | Receives error reports from Bolt Claw's servers, server functions and dashboard, scrubbed as Annex 2 section C describes. |
18.2 These are not Sub-processors for Referral Data: Google (sign-in to Bolt Claw accounts), Stripe for Bolt Claw's own subscription billing, Cloudflare Turnstile on Bolt Claw's own sign-in forms, and Anthropic, which drafts replies only in the social features.
18.3 The Merchant's own Providers, when it connects them, are not Sub-processors either (clause 7.4). They are: Stripe (through a restricted key or Bolt Claw's Stripe App), PayPal, Wise, Tremendous, Trolley, Tango, Shopify (through Bolt Claw's Shopify app or the Merchant's own webhooks), Paddle, Polar, Whop, RevenueCat, WooCommerce, FastSpring, Lemon Squeezy, Chargebee, Recurly, Gumroad, the Merchant's own systems that receive Bolt Claw's webhooks, and the automation tools the Merchant connects to them, such as Zapier, Make or n8n.