Privacy Policy

What data we process

We process the following categories of data, depending on how you use the service:

• Account email — used for authentication via Supabase Auth (sign-in with an email OTP code) and for essential service communications.
• Beta access — email, language, invitation status, campaign source or name, and invitation-use time. The shared campaign code is compared as a hash and is not stored.
• Project and article content — keywords, briefs, drafts, articles and editorial settings you create in the app. They are yours: we process them only to provide the service.
• Integration credentials — credentials you connect (for example WordPress) are stored encrypted in a dedicated vault and used exclusively to perform the actions you request.
• Google Search Console OAuth tokens — if you connect GSC, we store access tokens to read your site's search data. You can revoke access at any time from your Google account or the project settings.
• First-party beta measurement — limited journey events such as authentication completed, project created, draft completed or article exported, together with app version, outcome, duration and bounded technical identifiers. These events do not contain article text, prompts, keywords, credentials or analysed-site content.
• Beta feedback — the description you choose to send and the app version. Project, article, workflow, request and error identifiers are included only if you explicitly enable diagnostics.
• Minimal technical data — security and operational logs, user and request identifiers, app version and error codes needed to keep the service reliable and secure. IP address and user agent may be processed transiently by hosting and security providers.

Legal bases and purposes

• Performance of a contract (Art. 6.1.b GDPR) — account, content, integrations and tokens are needed to provide Boltize to you.
• Consent (Art. 6.1.a GDPR) — requesting beta access and optionally sending diagnostics are your choices; you can withdraw consent at any time.
• Legitimate interest (Art. 6.1.f GDPR) — security, abuse prevention, error diagnosis and minimal beta-journey measurement to verify reliability and usability.

We do not sell your data, profile you for advertising, or place article content or prompts in beta events or diagnostic logs.

Beta measurement and feedback

Beta measurement is first-party, authenticated and restricted to a closed event taxonomy. It helps us understand where a journey completes or fails and which app version is involved; it is not used to build advertising profiles.

Submitting feedback is voluntary. Diagnostics are off by default and are attached only after your explicit choice. Do not include passwords, API keys or other sensitive data in the free-text description.

AI providers

To generate and revise articles, Boltize sends the content you choose to process (keywords, briefs, drafts, sources) to third-party AI providers acting as data processors: Anthropic, OpenAI and Google, depending on your project configuration.

If you connect your own API keys, subscriptions or local models, processing happens with the provider and terms you chose: in that case the provider's own terms and privacy notices also apply. With local models, content does not leave your device for inference.

We do not use your content to train models.

Cookies

Boltize uses only technical session and authentication cookies (Supabase Auth), required to keep you signed in to the app. We use no analytics, marketing or profiling cookies, and no third-party tracking technologies. Minimal beta measurement happens server-side after authentication and uses no additional cookies. Therefore no cookie banner is shown.

Where data is stored

Data is hosted on Supabase (database and authentication) and Vercel (application hosting) infrastructure. Technical errors may be sent to Sentry for diagnosis and correlation. Some providers may process data outside the European Union: in those cases the transfer is covered by GDPR safeguards such as Standard Contractual Clauses (SCC).

Retention

• Account data and content — kept while your account is active; on closure they are deleted or anonymized within a reasonable period.
• Beta access data — kept for the duration of the beta program or until you ask for deletion.
• Integration tokens and credentials — deleted when you disconnect the integration or close your account.
• Beta events and resolved feedback — deleted within 90 days; unresolved feedback is deleted within 12 months.
• Technical and diagnostic logs — kept for the limited period configured with the provider and never longer than necessary for security and diagnosis.

Your rights

Under Articles 15-22 GDPR you have the right of access, rectification, erasure, restriction, portability and objection to the processing of your data.

• Portability — you can export your articles and content directly from the app (Markdown/HTML).
• Erasure — while a self-service flow is being built, you can request deletion of your account and data by writing to hello@boltize.app: we will process the request without undue delay.
• Complaint — you also have the right to lodge a complaint with your supervisory authority (in Italy, the Garante per la protezione dei dati personali).

Changes to this notice

We may update this notice, for example as the service evolves. The current version will always be published on this page with its last-updated date; for material changes we will notify you by email or in the app.

Contact

For any question about this notice or your data: hello@boltize.app.