BoltDesk AI — Operated by BoltDesk LLC
Last Updated: November 13, 2026
This Data Processing Agreement (“DPA”) is between BoltDesk LLC (“BoltDesk,” “we,” or “Processor”) and the business that subscribes to the Service (“Client” or “Controller”). It is incorporated into the Terms of Service. If the Terms and this DPA conflict on processing of personal information, this DPA controls.
For personal information about callers, chat users, and other end users that Client submits to the Service, Client is the controller (or “business” under the CCPA/CPRA) and BoltDesk is the processor (or “service provider”). BoltDesk processes that information only to provide the Service and on Client's documented instructions, including the instructions in the Terms, this DPA, and the settings Client configures.
The data covered by this DPA is personal information BoltDesk processes for Client through the Service. That includes contact details, appointment details, email content sent through the Service, call recordings, transcripts, and chat content. It does not include SMS or other text-message content, because the Service does not send text messages. It does not include BoltDesk's own business records about the Client account, such as billing records, which BoltDesk handles as a controller under the Privacy Policy.
Client will not submit protected health information, consumer reports regulated by the FCRA, or student records regulated by FERPA. BoltDesk does not sign business associate agreements.
BoltDesk will process covered data to answer and route calls, book appointments, send email Client configures, request reviews as Client configures, provide transcripts to Client, make call recordings available by fetching them from the telephony subprocessor, and provide related support. BoltDesk does not send SMS or other text messages. BoltDesk will not sell covered end-user personal information, and will not use it for BoltDesk's own advertising.
Our primary platform provider has confirmed it does not use customer data to train or fine-tune foundation models and contractually prohibits its AI model providers from doing so. BoltDesk does not train foundation models on customer data. AI features are optional.
BoltDesk does not collect, extract, generate, or store voiceprints or other biometric identifiers from call audio, and does not perform cross-call speaker identification or caller matching.
Client is responsible for the business information it configures, including services, prices, hours, and service area, and for having a lawful basis to collect information from the people it talks with and to email them. The Service does not send text messages.
Client authorizes BoltDesk to use subprocessors that are bound by written terms limiting their use of personal information to providing services to BoltDesk. Platform subprocessors are listed at gohighlevel.com/sub-processors. Our own list currently includes HighLevel Inc. (automation platform, telephony orchestration, and AI features); LeadConnector / Twilio (telephony and call-recording storage); Stripe (Client billing only); Google, Microsoft, and Apple (calendar connections when Client enables them); cloud hosting providers; and BoltDesk's transactional email provider. Voice and model providers engaged for a specific AI feature are subprocessors for that feature.
Meta and Google may be used as advertising or analytics partners on the public marketing site, boltdesk.ai. They are not used to sell or share end-user call recordings or transcripts.
BoltDesk will give at least 30 days' notice of a material new subprocessor where that is commercially feasible, and will consider a reasonable objection from Client. A countersigned copy of this DPA is available on request to help@boltdesk.ai.
BoltDesk will maintain reasonable administrative, technical, and physical safeguards designed to protect covered data, including encryption in transit, encryption at rest where the relevant provider supports it, access controls, and multi-factor authentication on BoltDesk administrative accounts. No safeguard is perfect.
BoltDesk will assist Client, taking into account the nature of the processing, with data-subject requests and with reasonable security or privacy information Client needs to meet its own obligations. End users should contact Client first.
If BoltDesk confirms a security incident affecting covered data, BoltDesk will notify Client without undue delay and, where feasible, within 72 hours of confirmation, with the information reasonably available at that time. If an upstream provider notifies BoltDesk later than that, BoltDesk will notify Client when BoltDesk is notified.
During the subscription, Client can use the Service to access transcripts and contact records, and call recordings are fetched on demand from the telephony subprocessor. After cancellation, BoltDesk will delete or anonymize account data, contact records, transcripts, and chat logs within 90 days, except where a longer period is required for tax, legal, or security reasons. Call recordings are stored by our telephony subprocessor (Twilio) and are not stored separately by the platform. On account closure, the associated telephony account is closed after approximately 14 days, and recordings remain retrievable for up to approximately 40 more days, after which they are no longer retrievable. This is not a configurable retention period. Client may request an export of data within our direct control before that deletion, as stated in the Terms.
On reasonable written request, and no more than once a year unless a confirmed incident requires it, BoltDesk will provide information reasonably needed to demonstrate compliance with this DPA. Site visits, if any, will be scheduled in advance, during business hours, and subject to confidentiality.
The Service is hosted in the United States. If covered data is transferred from a jurisdiction that requires a transfer mechanism, BoltDesk will use a mechanism the applicable law allows, such as a provider's certification or standard contractual clauses, where that mechanism is available for the transfer.
This DPA lasts for as long as BoltDesk processes covered data for Client. Sections that should survive deletion, including confidentiality and allocations of responsibility, survive.
BoltDesk LLC
Mailing Address: 30 N Gould St, STE R, Sheridan, WY 82801, USA
Email: help@boltdesk.ai