Privacy Policy

1. Introduction

BoltDesk LLC ("BoltDesk AI," "we," "us," or "our") operates the website boltdesk.ai and provides a website, AI-powered call answering, AI chat, lead qualification, appointment booking, follow-up automation, and review management (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website or use our Service.

This Privacy Policy applies to two categories of individuals:

• Clients: businesses and authorized users that subscribe to the Service.
• End Users: individuals who interact with our AI voice agents (callers) or AI chat agents on Client websites, or who otherwise have their personal information processed through the Service on behalf of a Client.

For End User data, the subscribing Client is the data controller and BoltDesk AI acts as the data processor (or "service provider" under U.S. state privacy laws). Our processing of End User data is governed by the Client's instructions and our Data Processing Agreement, available on request to help@boltdesk.ai.

For Client account data, website visitor data, and the limited information BoltDesk collects for its own business operations (billing, marketing, support), BoltDesk AI is the data controller.

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

Mailing Address: BoltDesk LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA.

2. Industries We Do Not Serve

BoltDesk AI is not designed for and does not knowingly serve:

• HIPAA "covered entities" (healthcare providers, health plans, healthcare clearinghouses) or their business associates handling Protected Health Information (PHI). We do not enter into Business Associate Agreements (BAAs).
• Financial institutions subject to the Gramm-Leach-Bliley Act in connection with consumer financial information processing.
• Consumer reporting agencies subject to the Fair Credit Reporting Act (FCRA).
• Educational institutions subject to FERPA in connection with student records.
• Any business whose use of the Service would require us to enter into a BAA, be subject to PCI-DSS Level 1 obligations beyond standard tokenized payment processing, or be designated a high-risk AI deployer under regulated decision-making frameworks.

Clients warrant in our Terms of Service that they will not transmit PHI, FCRA-regulated consumer reports, FERPA-protected student records, or comparable regulated data through the Service.

If you are uncertain whether your business falls within these categories, contact help@boltdesk.ai before subscribing.

3. Information We Collect

3.1 From Clients

We collect: business name, contact name(s), email address, phone number, physical address, website URL, and industry; payment details processed through a third-party payment processor (we do not store full card numbers); calendar and scheduling data from connected calendar systems; Client-uploaded contact lists for review-request and follow-up purposes; and platform usage data (logins, features used, dashboard interactions, IP address, device/browser info).

3.2 From End Users

When an End User interacts with an AI voice agent or AI chat agent powered by BoltDesk AI, we collect on behalf of the Client: the End User's phone number, call duration, date/time, and the number called; call recordings and transcripts, where recording is enabled (see Section 7); chat messages; any name, contact details, scheduling information, or other content voluntarily provided during the interaction; appointment information; and limited device/browser information for chat interactions.

3.3 Voice Recording and Voice-Based Processing

In the course of recording and processing calls, our service providers temporarily generate or use voice-based features including transcription, speaker labeling within a single call, and voice synthesis output. BoltDesk does not collect, extract, generate, or store voiceprints or other biometric identifiers from call audio, and does not perform cross-call speaker identification or caller matching.

BoltDesk does not collect, extract, generate, or store voiceprints or other biometric identifiers from call audio, and does not perform cross-call speaker identification or caller matching. That includes identifiers covered by the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), Washington's biometric law, and comparable laws.

Where applicable law treats voice recordings themselves as biometric information, we handle them subject to the notice and consent requirements of those laws (see Section 8).

3.4 Automatically Collected on Our Website

IP address, browser type, operating system, device type, and cookie data on boltdesk.ai. See Section 10.

4. How We Use Information

4.1 Client Information

We use Client information to: provide and operate the Service; authenticate users and protect accounts; process payments and manage subscriptions; provide customer support and account communications; send transactional and service notifications; analyze and improve the Service (using Client-account-level usage data, not End User content); communicate with Clients about new features, training, and offerings (with the ability to opt out of marketing communications); comply with legal obligations; and prevent fraud and misuse.

4.2 End User Information

We process End User information only on documented instructions from the relevant Client to: enable AI-powered call and chat handling; qualify leads and capture intake data; book appointments; send appointment confirmations, reminders, follow-up communications, and review requests on the Client's behalf; provide call recordings, transcripts, summaries, and analytics to the Client; and comply with legal obligations.

4.3 No Use for Our Own Marketing

We do not use End User personal information for our own marketing, do not target advertising to End Users based on End User data, and do not sell End User personal information.

4.4 AI Model Training and Service Improvement

We do not train our own foundational AI models on End User personal information. Our primary platform provider has confirmed it does not use customer data to train or fine-tune foundation models and contractually prohibits its AI model providers from doing so.

AI features are optional. Clients configure what the receptionist is allowed to say and do. A current summary of our service-provider AI-data practices is available on request.

5. How We Share Information

We do not sell personal information.

Some state privacy laws, including the California Consumer Privacy Act and CPRA, treat certain analytics and advertising cookies and pixels as a "sale" or "share" of personal information, or as targeted advertising, even when no money is exchanged. BoltDesk does not currently load third-party advertising or analytics tags on boltdesk.ai. If we enable them, they load only when your browser has not sent a Global Privacy Control signal and you have not opted out. We honor Global Privacy Control as an opt-out of sale or sharing and of targeted advertising. Within the Service itself (call recordings, transcripts, lead data, and similar records), we do not sell or share End User personal information.

We disclose information only as follows:

• To the relevant Client. End User data is disclosed to the Client whose phone number, website, or campaign the End User contacted. The Client is the data controller for that data.
• To service providers and subprocessors. We use third-party providers under written contracts that limit their use of personal information to providing services to us. A current list is in the Data Processing Agreement at boltdesk.ai/dpa. Platform subprocessors are listed at gohighlevel.com/sub-processors. Our own list currently includes: HighLevel Inc. (automation platform, telephony orchestration, AI features); LeadConnector / Twilio (telephony and call recording storage); AI voice and conversational providers as engaged for specific AI features; LLM providers as engaged for specific AI features; Stripe (payment processing for Client billing only); Google, Microsoft, and Apple calendar APIs; our cloud hosting providers; and our transactional email provider. Meta and Google may be used as advertising and analytics partners on the public marketing site. Not all subprocessors are used for every Client; AI-specific subprocessors are engaged only when the Client uses corresponding AI features. We will provide reasonable advance notice of material additions to our subprocessor list (at least 30 days where commercially feasible) and accept reasonable Client objections under the Data Processing Agreement.
• For legal compliance. Where required by law, regulation, legal process, governmental request, or to enforce our agreements or protect our rights, property, or safety.
• In a business transaction. In connection with a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction, subject to the acquirer agreeing to honor this Privacy Policy or providing equivalent protections.

6. International Data Transfers

The Service is hosted in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States. Where required by law, we rely on appropriate transfer mechanisms (such as the EU-U.S. Data Privacy Framework certification of our service providers, Standard Contractual Clauses, or your consent) for international transfers.

7. Call Recording and Wiretap Compliance

Calls handled by our AI voice agents may be recorded and transcribed for quality assurance, service delivery, and the Client's lawful business purposes. Our system includes a default-on call recording disclosure message that plays at the beginning of each call. Clients may not disable this disclosure without contacting BoltDesk AI and providing written confirmation that an alternative compliant disclosure is in place.

Federal law and the laws of the following U.S. states currently require all parties to a call to consent to recording: California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, and Washington. State law definitions and exceptions vary; some states (including Connecticut and Massachusetts) treat in-person and telephonic recordings differently. Clients are responsible for ensuring their use of recording features complies with all applicable federal, state, and local laws in every jurisdiction where calls may originate or terminate. BoltDesk AI does not provide legal advice on jurisdiction-specific recording requirements.

8. Biometric and Voice Recording Notice

We provide this notice in light of biometric privacy laws including the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), and Washington's biometric law:

• BoltDesk does not collect, extract, generate, or store voiceprints or other biometric identifiers from call audio, and does not perform cross-call speaker identification or caller matching.
• Retention of call recordings is described in Section 11.
• If our practices ever change such that biometric identifiers are collected, we will provide the written notice and obtain the written consent required by applicable law before any such collection occurs, and we will require Clients to obtain and document such consent from End Users in their jurisdictions.

9. Text Messages and Email

BoltDesk does not offer texting. The Service does not send SMS, MMS, or other text messages to callers or customers, and it does not text callers back.

By providing an email address to a Client through the Service, an End User may receive appointment confirmations, reminders, follow-ups, and review requests by email from the Client. Each automated email includes an unsubscribe link. Unsubscribe requests are honored promptly.

Clients are responsible for compliance with the Telephone Consumer Protection Act (TCPA) for calls, and with the CAN-SPAM Act and other applicable laws for email. BoltDesk does not send texts and does not register A2P 10DLC campaigns.

10. Cookies and Similar Technologies

We may use cookies and similar technologies on boltdesk.ai to run the site, remember preferences, and store a sale or sharing opt-out. We do not display a cookie consent banner. We do not use advertising cookies or pixels inside the product that handles call recordings, transcripts, and lead data.

We do not currently load third-party analytics or advertising scripts. Any script of that kind that we add later is loaded through a single gate, and only when this browser has not sent Global Privacy Control and has not opted out of sale, sharing, and targeted advertising. See the Do Not Sell or Share section below.

Do Not Sell or Share My Personal Information

BoltDesk does not sell personal information. We do not sell or share end-user call recordings, transcripts, or lead data for cross-context behavioral advertising or targeted advertising.

We honor the Global Privacy Control (GPC) signal as a valid opt-out of the sale or sharing of personal information and of targeted advertising under the California Consumer Privacy Act (CCPA/CPRA) and similar state laws. If your browser sends GPC, including through navigator.globalPrivacyControl or the Sec-GPC: 1 header, we treat that browser as opted out and we do not load advertising or analytics tags.

You can also opt out for the browser you are using on our Your Privacy Choices page, or with the control below. We store that choice in local storage and a cookie on that browser. You can email help@boltdesk.ai with the subject line “Do Not Sell or Share” if you want to make the request another way.

California residents also have the rights listed in Section 15, including the right to know, delete, and correct personal information, and the right to limit use of sensitive personal information. We will not discriminate against you for exercising these rights.

11. Data Retention

• Client account information: retained for the duration of the subscription and up to 12 months after closure for record-keeping, dispute resolution, and legal compliance.
• Call recordings: Call recordings are stored by our telephony subprocessor (Twilio) and fetched on demand. They are not stored separately by the platform. On account closure, the associated telephony account is closed after approximately 14 days, and recordings remain retrievable for up to approximately 40 more days, after which they are no longer retrievable. This is not a configurable retention period.
• Transcripts and chat logs: Retained for the duration of the Client's subscription and deleted within 90 days of Client account closure, subject to the Client's instructions and the underlying platform provider's deletion processes.
• Lead and contact records: Retained for the duration of the subscription and deleted within 90 days of Client account closure, subject to the Client's instructions and the underlying platform provider's deletion processes.
• Payment and billing records: retained as required by tax, accounting, and financial regulations (typically seven years).
• Aggregated/deidentified data: may be retained indefinitely for analytics purposes provided it cannot reasonably be re-identified.

Expedited deletion requests. Where Clients request expedited deletion (for example, to comply with state privacy law response deadlines), we will delete the categories of data within our direct control (account information, contact records, transcripts, chat logs) within 30 days. Call recordings follow the telephony timeline above and are not available on a configurable retention schedule.

12. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit (TLS), encryption at rest where supported by our service providers, access controls and least-privilege provisioning, multi-factor authentication for our administrative accounts, periodic security reviews, and contractual security requirements with subprocessors. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

13. Data Breach Notification

If we become aware of a security incident affecting Client or End User personal information, we will notify the affected Client without undue delay and in any event within 72 hours of confirmation, with the information reasonably available at that time, and will cooperate with the Client to meet the Client's legal notification obligations to End Users and regulators. Where an upstream provider notifies us later than 72 hours, we will notify Clients as soon as we are notified.

Clients agree to provide accurate and current contact information for incident notifications.

14. Children's Privacy

The Service is not directed to children. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will delete that information promptly. Clients agree not to use the Service in connection with services directed to children.

15. Your Privacy Rights

Subject to verification and applicable law, you may have the right to access, correct, delete, restrict or object to processing of, and obtain a portable copy of, the personal information we hold about you, and the right not to be discriminated against for exercising your rights. To exercise rights, contact help@boltdesk.ai or use any in-product mechanism we provide. We will respond within the timeframe required by applicable law (generally 30 to 45 days). If you are an End User, please contact the relevant Client first; we will assist the Client in responding.

15.1 California (CCPA/CPRA)

California residents have the rights described in this section, plus:

• The right to know the categories and specific pieces of personal information collected, the purposes, the categories of sources, and the categories of third parties with whom information is disclosed.
• The right to delete personal information, subject to exceptions.
• The right to correct inaccurate personal information.
• The right to opt out of the "sale" or "sharing" of personal information and to opt out of targeted advertising. Use Your Privacy Choices, the Do Not Sell or Share section above, email help@boltdesk.ai, or a Global Privacy Control signal. We honor Global Privacy Control as that opt-out. We do not sell personal information. Within the Service, we do not sell or share end-user personal information.
• The right to limit the use and disclosure of sensitive personal information, including audio recordings.
• The right to non-discrimination for exercising rights.
• The right to designate an authorized agent to make requests on your behalf, with appropriate verification.

We honor Global Privacy Control as an opt-out of sale, sharing, and targeted advertising.

15.2 Other U.S. States

Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Jersey, Tennessee, Minnesota, Maryland, New Hampshire, Nebraska, Indiana, Kentucky, Rhode Island, and any others as those laws come into force — have rights similar to those described above, as well as the right to appeal any denial of a request. Appeals may be submitted to help@boltdesk.ai.

15.3 EEA, UK, and Switzerland

Where the GDPR or comparable laws apply, the lawful bases for our processing are: performance of a contract; legitimate interests (operating and securing the Service); compliance with legal obligations; and, where required, consent. You have the right to lodge a complaint with your local supervisory authority.

16. Industry-Specific Acknowledgments

If you are a Client in a regulated industry, additional limitations apply:

• Law firms: You are responsible for compliance with attorney advertising rules, state bar ethics requirements, conflict-of-interest screening, and Model Rule of Professional Conduct 1.6 (or your state analog) regarding confidentiality of client information. The Service is not designed to receive privileged communications, and we make no representation that AI-handled calls preserve attorney-client privilege.
• Healthcare: Not permitted as a Client (see Section 2).
• Consumer credit / debt collection: Use of the Service for activities regulated by the FDCPA or for consumer credit decisioning requires a separate written agreement with us.

17. Third-Party Links

Our Service and website may contain links to third-party sites. We are not responsible for the privacy practices of third parties.

18. Changes to this Privacy Policy

We may update this Privacy Policy. We will post the revised policy with a new "Last Updated" date and, for material changes affecting Clients, notify Clients by email at least 30 days before the changes take effect. Continued use after the effective date constitutes acceptance.

19. Contact Us

BoltDesk LLC
Mailing Address: 30 N Gould St, STE R, Sheridan, WY 82801, USA
Email: help@boltdesk.ai
Website: boltdesk.ai