Referral Services Terms

2.1 In this Addendum:

• "Bolt Claw", "we" and "us" mean [[COMPANY LEGAL NAME]], company number [[COMPANY NUMBER]], whose registered office is at [[REGISTERED ADDRESS]].
• "Merchant" and "you" mean the organisation that uses the Referral Services, and include its workspaces.
• "Referral Services" means the referral and affiliate features of the Bolt Claw service: programs, reward rules, links and codes, the website tag, click and conversion recording, commissions and grants, payouts, tax forms and invoices, the in-app panel, the partner portal, custom domains and brand, the Directory, broadcasts, imports, campaigns, the referral parts of the API, the MCP server and the CLI, and the dashboard screens for them.
• "Program" means one referral, affiliate, refer-a-friend, creator, ambassador, reseller, shop or waitlist program that the Merchant runs.
• "Partner" means a person with a Bolt Claw account who has joined a Program.
• "Referrer" means one of the Merchant's own users whom the Merchant's systems create in a Program and who has no Bolt Claw account for it. A waitlist entrant is a Referrer.
• "Promoter" means a Partner or a Referrer.
• "Referred Customer" means a person who arrives through a Promoter's link or code, or whom the Merchant reports as a customer, in a Program.
• "Program Terms" means the agreement between the Merchant and each Promoter for a Program.
• "Commission" means a cash reward owed to a Promoter. "Grant" means any other reward, such as credit, a free period, a discount, a perk or a gift card. "Reward" means either.
• "Payout" means a payment of Commissions to one Promoter, and "Payout Batch" means a group of Payouts sent together.
• "Provider" means a payment, payout, gift-card, shop or billing service that the Merchant connects with an account of its own, such as Stripe, PayPal, Wise, Tremendous, Trolley, Tango, Shopify, Paddle, Polar, Whop, RevenueCat, WooCommerce, FastSpring, Lemon Squeezy, Chargebee, Recurly or Gumroad, and the Merchant's own payout system reached by webhook.
• "Connector" means the part of the Referral Services that uses a Provider on the Merchant's instruction.
• "Credential" means an API key, restricted key, secret, token, password or OAuth grant for the Merchant's account at a Provider.
• "Tax Form" means a Form W-9, W-8BEN or W-8BEN-E, or the statement that a Promoter is not a US person, completed and signed in the Referral Services.
• "Directory" means the partner directory where signed-in Bolt Claw accounts find Programs whose Merchant has listed them.
• "Assistant" means an AI assistant or other software acting through the API, the MCP server or the CLI under the authority of the person who connected it.
• "Approval" means a decision by a person in the dashboard that lets one specific request of an Assistant go ahead.
• "Two-Step Session" means a session in which the person has passed two-step verification.
• "Data Processing Agreement" means Bolt Claw's Data Processing Agreement for the Referral Services.

2.2 Words defined in the Terms of Service have the same meaning here.

3.1 The Referral Services let the Merchant run Programs: set reward rules, give Promoters links and codes, record clicks and conversions reported by its website tag, its own servers and its connected Providers, compute Commissions and Grants, prepare and send Payouts through its own Providers or in a file, collect Tax Forms, and manage Promoters.

3.2 The Merchant chooses every setting of a Program, including who may join, what earns a Reward, how much, the cookie window, the attribution rule, the hold, the minimum payout, the currency, the schedule, how it pays, whether it asks for Tax Forms and whether it pays a second tier.

3.3 No referral feature is kept for a paid plan. A plan's allowances (for example the number of Programs, approved Partners, Referrers, stored clicks a month and custom domains) are those shown on the pricing page.

3.4 When an organisation is over an allowance, nothing already live stops: links keep working and data is kept, and only new additions of the kind that is over the allowance are refused until the organisation is within it. Clicks beyond the monthly click allowance are counted but not stored.

4.1 Bolt Claw is a software provider. It does not accept, hold, pool, route or transmit money for the Merchant or for any Promoter, it collects no money from the Merchant to pay Promoters, and it takes no share of any sale, Commission or Payout.

4.2 Bolt Claw is not a party to any Program Terms. The Merchant alone owes its Promoters the Rewards its Program Terms promise.

4.3 Bolt Claw does not give tax, legal, accounting or financial advice. It does not file any tax return or information return, does not withhold tax, and does not match taxpayer identification numbers with any tax authority.

4.4 Bolt Claw does not vet, approve or guarantee any Promoter, Referred Customer or Merchant. The Merchant decides which Partners it approves, or chooses to approve them automatically.

4.5 Attribution depends on what the Merchant's site, servers and Providers report. Bolt Claw does not promise that every sale will be attributed, or attributed to the right Promoter, and the Merchant reviews Commissions before it pays them.

4.6 The risk engine scores conversions and may hold a Commission or Grant for longer or for a person's review. It never rejects a Commission, bans a Promoter or confirms fraud on its own, and Bolt Claw does not promise that it will find every fraud.

4.7 Bolt Claw never sends an invitation email to an address that a user types. Promoters share through links, codes, QR codes, their device's share sheet, their own email app and messaging apps.

5.1 The Merchant must have Program Terms for each Program, publish them to its Promoters before they join, and keep them true to the Program's settings.

5.2 The Merchant may write its own Program Terms or use "Write my terms", which assembles Bolt Claw's template from the Program's own settings. Generated terms carry the line "Based on Bolt Claw's template. Not legal advice; have it checked for the countries your partners live in." The Merchant is responsible for the final text.

5.3 Saving new Program Terms gives them a new version. Each Partner accepts the current version before their next Payout, and a Partner who has not accepted it is held until they do.

5.4 A second tier, where a Partner earns a share of the Commissions of Partners they recruited, may be switched on only within the fences the Referral Services enforce: one level, a share of at most 20% of the recruit's own Commission, for at most 24 months from when the recruit was recorded, paid in cash only on a real customer's sale, never for recruiting itself and never with a fee to join. Switching it on writes a fixed clause into the Program Terms under a new version.

6.1 The Merchant pays its Promoters what its Program Terms say, on time, whether it pays through a Connector, by a file, through its own system or by hand.

6.2 The Referral Services compute Commissions and Grants from the Merchant's own reward rules and the conversions the Merchant's systems report, and show the reason for each amount. The Merchant is responsible for checking them before it pays.

6.3 A Payout Batch leaves the Merchant's Provider account through a Connector only when a person in the Merchant's organisation who holds the payout permission presses Send in a Two-Step Session, having signed in within the last 15 minutes, after the Referral Services have shown that person the total per currency and the Provider. That press is the Merchant's authorisation of that Payout Batch, and the Referral Services send only the Payouts and totals the person saw.

6.4 Through the API, a key that is not an Assistant's may send a Payout Batch only if it holds the payout scope. An Assistant's request to send waits for an Approval, which only a person in a Two-Step Session who is not paid by that Payout Batch can give.

6.5 Sending on a schedule without a person pressing Send is built but switched off by Bolt Claw for every Merchant. Bolt Claw will not switch it on before it has taken legal advice on whether that would be a regulated payment service in the European Union or the United Kingdom, and will give Merchants notice before it does. If it is switched on, it applies only to a Program whose Merchant switches it on, after a 24-hour notice to the people who manage payouts, and the Merchant's switch is then its standing authorisation for each scheduled Payout Batch.

6.6 The Referral Services hold a Payout while the Program's hold has not passed, while the risk engine or a person holds it, for 48 hours after a Promoter's payout details change or while the Promoter has locked their payouts, while a Tax Form the Program asks for is missing, while the Promoter has not accepted the current Program Terms, and while an invoice the Program asks for is missing. These holds apply to sending through a Connector and to payout files. The Merchant may still pay by hand and record the Payout as paid, and is responsible if it does.

6.7 A Provider's fees are the Merchant's. The fees the Referral Services show before sending are estimates.

6.8 The Referral Services record the status each Provider reports. Bolt Claw is not responsible for a Provider's refusal, delay, hold, return or failure, or for a Payout that a Promoter does not claim. A Payout whose result is unknown is asked about, never sent again blind.

6.9 When a refund or dispute arrives after a Payout was sent, the Referral Services record it as a deduction from the Promoter's next Payout. Bolt Claw never takes money back from a Promoter.

7.1 The Merchant may connect Providers with its own accounts. A person in the Merchant's organisation makes each connection in the dashboard. No Credential is accepted through the API or from an Assistant, so that a secret never passes through a conversation with an AI model.

7.2 By connecting a Provider, the Merchant instructs Bolt Claw to store its Credential and to use it only to do what the Merchant asks of that Connector through the Referral Services: for a billing or shop Provider, to verify and receive its events, read back the objects needed to credit a conversion, and keep Promoters' discount codes in step; for a payout or gift-card Provider, to check the connection, create the recipients that Promoters set up, send the Payout Batches and gift cards that a person authorised, and read their status.

7.3 The Merchant promises that its agreement with each Provider allows it to let a software provider hold and use the Credential in this way, and that its use of the Connector complies with the Provider's terms. Bolt Claw has not obtained each Provider's confirmation of this. Bolt Claw may switch a Connector off for every Merchant if a Provider objects to it.

7.4 Each Provider's own terms govern the Merchant's account at that Provider. Bolt Claw is not a party to them, and the Provider's decisions about the Merchant's account, its limits, its checks and its fees are the Provider's.

7.5 Bolt Claw seals every Credential with AES-256-GCM before storing it, never shows it again, and never puts it in a log, an API response, a webhook or an email. Stripe is connected only with a restricted key (one beginning rk_) or Bolt Claw's Stripe App, never with a full secret key.

7.6 The Merchant may disconnect a Provider at any time, including during maintenance. Disconnecting deletes the stored Credential. The Merchant should also revoke the Credential at the Provider.

7.7 The Merchant must tell Bolt Claw at [[SECURITY CONTACT EMAIL]] without delay if it believes a Credential it connected has been exposed. Bolt Claw tells the Merchant of a breach affecting a Credential as the Data Processing Agreement says.

8.1 Tax Forms are collected as the Merchant's own tool. The Merchant chooses whether a Program asks for them (not at all, from United States persons only, or from every Promoter), and each signed Tax Form is given to the Merchant that asked for it.

8.2 Every tax screen says "Bolt Claw prepares these forms; it does not give tax advice or file anything for you". The Merchant decides, with its own advisers, which forms it needs, whether a form it received is valid for its purposes, and what it must withhold, report and file.

8.3 While a Tax Form the Program asks for is missing, the Promoter's Payouts wait. Only a person in the Merchant's organisation may forfeit a Promoter's held Commissions, with a reason that is recorded. The Merchant is responsible for making sure its Program Terms allow forfeiture and that forfeiting is lawful where the Promoter lives.

8.4 The year-end screen prepares Form 1099-NEC data from the Payouts the Referral Services recorded and the Tax Forms the Merchant holds, using the reporting threshold Bolt Claw sets for each year and a table of which payout Providers to include, parts of which the Merchant can change. The Merchant checks that data and files it. The IRIS file follows the latest template the IRS has published, which may differ from the template in the IRS portal for the year being filed.

8.5 A Partner's Copy B is made available electronically only to a Partner who consented to electronic delivery, and only once the Merchant publishes a year that is over.

8.6 Where a Program uses self-billing, the Merchant issues invoices on behalf of its business Partners under a self-billing agreement with each of them, and each invoice is treated as accepted 14 days after issue unless the Partner disputes it. The Merchant is responsible for the VAT treatment of each invoice.

8.7 The Referral Services do not make any report under the EU's DAC7 rules or the United Kingdom's equivalent rules. An export of the data those rules ask for is built and is switched off.

8.8 Opening a Promoter's Tax Form, exporting 1099 data and publishing Copy B need a Two-Step Session, and each opening of a Tax Form is recorded in that form's access log.

9.1 The Merchant is responsible for training and monitoring its Promoters so that they disclose their relationship with the Merchant clearly wherever they promote it, as the US Federal Trade Commission's Guides Concerning the Use of Endorsements and Testimonials in Advertising (16 CFR Part 255) and the equivalent rules where its Promoters and their audiences are require, and for acting when a Promoter does not.

9.2 Every Program has a disclosure line that cannot be empty. The Referral Services fill it in for the Program's currency region, show it to a Partner the first time they copy a link or a code and then monthly, show it beside every link a Partner places in a post, an automation or a bio page, add it to every library snippet, and show it under the in-app panel's share buttons. The Merchant can see when each Partner acknowledged it. The Merchant must keep the line accurate and adequate for its Promoters' audiences.

9.3 The Merchant's Program Terms must forbid the methods the Referral Acceptable Use Policy bans, and the Merchant must enforce them.

9.4 The Merchant must not procure, reward or publish fake or misleading reviews or endorsements, including through its Promoters, and must not make a Reward depend on the sentiment of a review.

10.1 The Merchant is responsible for its products, its offers to Promoters and Referred Customers, and the claims it makes about them, and for making sure that each Program and each offer is lawful in every place where it runs.

10.2 The Merchant must report conversions, refunds and disputes accurately and promptly, through its own systems or its connected Providers, and must not report a conversion that did not happen.

10.3 The Merchant must have a lawful basis for every piece of personal data it sends to the Referral Services, including lists it imports and Referrers it creates.

11.1 The website tag runs on the Merchant's own site. When a visitor arrives with a referral code, it stores the code (bc_ref), the click id (bc_click) and any campaign tag (bc_sub) on the Merchant's own domain, each as a first-party cookie with a localStorage copy of the same expiry, for the cookie window the Merchant sets (1 to 365 days, 30 by default). It also stores in localStorage that a visitor closed the welcome bar. It sets no Bolt Claw cookie and no visitor identifier.

11.2 The Merchant decides whether its visitors' consent is needed before the tag stores anything, and is responsible for obtaining it where the law requires it. In the European Union and the United Kingdom, Bolt Claw's understanding is that cookies used to attribute affiliate sales need consent.

11.3 The Integration tab asks the Merchant whether its visitors come from the European Union or the United Kingdom, and when the answer is yes, the snippet it shows turns on the tag's consent mode. In consent mode the tag keeps the code in memory only, and stores nothing and sends nothing about the visitor until the Merchant's consent tool tells it the visitor agreed.

11.4 The Merchant must tell its visitors about the tag in its own privacy or cookie notice. Bolt Claw provides a paragraph the Merchant may adapt.

11.5 Clicks and conversions that the Merchant's own servers send to the Referral Services are the Merchant's responsibility in the same way.

12.1 Listing a Program in the Directory is optional and off until the Merchant switches it on. The Directory Listing Terms apply to every listing.

12.2 The Directory is open only to signed-in Bolt Claw accounts, is never indexed by search engines, appears in no sitemap, and shows no Partner, no count of Partners, no revenue and no identifier of the Merchant's workspace or organisation.

12.3 Bolt Claw may hide or remove a listing as the Directory Listing Terms describe.

13.1 The Merchant may serve its referral links and its partner portal on hosts of its own, each a subdomain such as go.example.com or partners.example.com, up to the number of domains its plan allows. The Merchant must own or control every host it adds.

13.2 A host is claimed only once the Merchant proves control of it with the TXT record the dashboard shows, and only one organisation can hold a host at a time. Bolt Claw then adds the host to its hosting provider, which issues the certificate.

13.3 Bolt Claw checks each host's records regularly. A host whose records are missing at two checks is detached, the Merchant is emailed, and seven days later the host is deleted and removed from Bolt Claw's hosting provider. Links on boltclaw.ai keep working for every Program throughout.

13.4 Bolt Claw serves each host over HTTPS only and sends a Strict-Transport-Security header for it. The Merchant should add a host only if it intends that host and its subdomains to be served over HTTPS only.

13.5 The Merchant may set a brand: a name, logos, colours, a corner radius, a sender name and a support address. The Merchant promises that it has the right to use every name and image it uploads, and must not use a brand that names or imitates Bolt Claw or any other business. The Referral Services refuse a brand name or sender name that claims to be Bolt Claw's.

13.6 Emails to Partners in the Merchant's brand leave from Bolt Claw's own address with the brand's sender name. The brand's support address is used as the reply-to only after someone entered the code Bolt Claw sent to it.

13.7 "Powered by Bolt Claw" appears on a branded page or email only if the Merchant switches it on. The statement on a tax screen of who prepared a Tax Form stays.

13.8 A Partner always signs in on boltclaw.ai, never on the Merchant's host, and a portal session can reach only that Merchant's Programs. The Merchant must not try to collect a Partner's Bolt Claw sign-in details.

14.1 Referrers are the Merchant's own users. The Merchant's server creates them with its own identifier for each, and the Merchant is responsible for telling them about the Program and for the personal data it sends. Bolt Claw stores no email address for a Referrer the Merchant's server creates, only a keyed fingerprint used to detect self-referral. Apart from the waitlist emails in clause 14.3, Bolt Claw emails a Referrer only to send a six-digit code to an address they type for themselves when the Program asks them for a Tax Form.

14.2 The in-app panel opens for a Referrer only with a session token that the Merchant's server mints with a key of its own. The Merchant is responsible for signing its users in before it mints a token for them.

14.3 A waitlist's hosted page collects the email addresses of people who want to join the Merchant's waitlist, on the Merchant's behalf. Bolt Claw sends each address one confirmation under a fixed subject of its own, and the Merchant's invitations go only to addresses whose owners confirmed. Only a person in the Merchant's organisation, or the Merchant's own server, may switch the hosted page on. Addresses are kept for the periods the Data Processing Agreement states.

14.4 A broadcast is the Merchant's own message to a Program's Partners. Bolt Claw emails it to Partners with a one-click unsubscribe and shows it on their program page, never emails it to a Referrer, and sends at most two a day and ten in thirty days for each Program. The Merchant is responsible for its content and for the laws on marketing messages.

14.5 An import turns a list of people into invitations that the Merchant sends itself. Bolt Claw emails nobody on an imported list and keeps only a keyed fingerprint of each address.

15.1 The Merchant may run its Programs through the API, the MCP server and the CLI. An Assistant acts with the authority of the person who connected it, never more.

15.2 An Assistant's request to do anything that moves money, sends a message to people, publishes or deletes answers with a request for Approval and does nothing until a person approves it. An Approval is for one request, lasts 24 hours and can be used once.

15.3 Some actions always need an Approval, including sending a Payout Batch, changing how a Program pays, forfeiting Commissions, adding or removing a domain, sending a broadcast, committing an import, awarding a contest and erasing a Referrer or a Referred Customer. The Merchant's organisation may waive the Approvals that are switchable, such as changing the brand or a listing. The Merchant is responsible for what its Assistants do within the authority it gave them, for every Approval its people give and for every Approval it waives.

15.4 Some things can never be done by an Assistant: connecting a Provider or entering a Credential, anything that needs a Two-Step Session (such as opening a Tax Form or exporting 1099 data), what belongs to a Promoter (such as signing a Tax Form or entering payout details), team, roles, billing and agent settings, and browsing the Directory.

15.5 The Merchant is responsible for keeping its API keys secret and for what is done with them.

16.1 Bolt Claw charges nothing for the Referral Services beyond the plan the Merchant's organisation is on under the Terms of Service, and takes no share of any referred sale, Commission or Payout.

16.2 Bolt Claw may introduce fees for the Referral Services, or change them, by giving the Merchant at least 30 days' notice by email to the owners of its organisation. A new fee applies only from the end of that notice, and the Merchant may stop using the Referral Services before then.

16.3 Bolt Claw measures the referred revenue of each organisation each month, in total per currency, to plan its own pricing. It is never billed and never used as a limit.

17.1 The Data Processing Agreement applies to the personal data Bolt Claw processes for the Merchant in the Referral Services, and is part of this Addendum.

17.2 The Merchant is the controller of its Program data: its Referred Customers, its Referrers (including waitlist entrants), and what each Program records about its Partners. Bolt Claw processes that data on the Merchant's behalf.

17.3 Bolt Claw is the controller of each Partner's own Bolt Claw account, which a Partner uses across every Merchant: their identity and sign-in, security, payout details, and the Tax Forms they sign as Bolt Claw collects and keeps them. The Partner Terms and Bolt Claw's referral privacy notice cover that data. The Merchant receives a Partner's signed Tax Form as a separate controller, for its own tax obligations. The Merchant receives a Partner's email address only if the Partner chooses to share it with that Program, and a Partner's payout details only for a Payout the Merchant owes: inside a payout file, in the request a Connector sends to the Merchant's Provider, or when the Merchant's own payout system reads them for that Payout.

18.1 Bolt Claw may suspend the Referral Services for an organisation, a Program or a listing if the Merchant materially breaches this Addendum or the Referral Acceptable Use Policy, if Bolt Claw has good reason to believe a Program is unlawful or is defrauding Promoters or customers, or if a Provider or authority requires it. Bolt Claw will tell the Merchant why, unless the law or an authority forbids it, and will lift the suspension once the reason has gone.

18.2 A suspended organisation can read its data but cannot change it, as the Terms of Service describe. Suspension does not end the Merchant's duty to pay its Promoters, and Bolt Claw will, on request, give the Merchant a way to see and pay what it owes.

18.3 The Merchant may stop using the Referral Services at any time by pausing or archiving its Programs.

18.4 An owner may delete the organisation. Deleting it deletes every workspace and all of its Program data, including Tax Forms, invoices and payout records, and cannot be undone. Before deleting it, the Merchant must export every record that the law requires it to keep.

18.5 Clauses 4, 6.1, 8.2, 8.3, 10, 17, 18.4, 19, 20 and 21 survive the end of this Addendum.

19.1 Each party promises that it has the power to enter into this Addendum.

19.2 Apart from what this Addendum says, the Referral Services are provided as the Terms of Service describe, "as is" and "as available". Bolt Claw does not promise that the Referral Services will detect every fraud, attribute every sale, or meet any law that applies to the Merchant's Programs.

20.1 Nothing in this Addendum limits liability that cannot be limited by law, including for death or personal injury caused by negligence, or for fraud.

20.2 Bolt Claw is not liable for any Reward the Merchant owes to a Promoter, for the acts of any Provider, Promoter or Referred Customer, for tax, withholding or reporting the Merchant owes, or for loss caused by data, settings or instructions the Merchant or its Assistants gave.

20.3 Neither party is liable to the other for loss of profit, revenue, goodwill or data, or for indirect or consequential loss, arising from the Referral Services.

20.4 Bolt Claw's total liability to the Merchant arising from the Referral Services in any twelve months is limited to the greater of the fees the Merchant paid Bolt Claw in the twelve months before the claim and [[LIABILITY CAP AMOUNT]].

21.1 The Merchant will defend Bolt Claw against any claim by a Promoter, a Referred Customer, a Provider or an authority arising from the Merchant's Programs, its Program Terms, its offers, its non-payment of a Reward, its taxes, its use of a Credential or Connector, its brand or domains, its site's consent and notices, or its breach of this Addendum, and will pay what a court awards or the Merchant agrees in settling it.

21.2 Bolt Claw must tell the Merchant of such a claim promptly, let the Merchant control its defence, and give reasonable help at the Merchant's cost.

22.1 Bolt Claw may change this Addendum by giving at least 30 days' notice by email to the owners of each organisation that uses the Referral Services. A change that the law or a Provider requires sooner may take effect sooner, with as much notice as possible.

22.2 If the Merchant does not agree to a change, it may stop using the Referral Services before the change takes effect.

23.1 Notices to Bolt Claw under this Addendum go to [[LEGAL NOTICES EMAIL]]. Support questions go to support@boltclaw.ai. Notices to the Merchant go by email to the owners of its organisation.

23.2 This Addendum is governed by [[GOVERNING LAW]], and the courts of [[COURTS]] have exclusive jurisdiction over any dispute arising from it, unless the law where the Merchant is established gives the Merchant a right to bring proceedings elsewhere.