This policy explains how Bolt Business Limited (“Automate Leads”, “we”) handles personal data. We are registered with the Information Commissioner’s Office under number ZC277230. Contact our privacy lead at bolt70business@gmail.com or 14 Museum Place, Cardiff, Wales, CF10 3BH.
Two kinds of data
1. Our customers (the businesses that subscribe)
For account holders, we are the controller. We collect your name, email, phone numbers, business details and address, billing details (handled by Stripe — we never see full card numbers), verification details for your phone number, and how you use the service.
If you log in with Google, Google gives us your name, your email address and an ID for your Google account. We don’t see your Google password. If you connect Google Calendar, we also read and write the calendar details needed to make bookings.
2. People who call our customers
When someone calls a business using Automate Leads, that business is the controller and we are its processor. We process callers’ phone numbers, what they say on the call (transcripts), any details they give (name, address, postcode, booking details), messages we send them with their consent, and call recordings only where the business has switched recording on. If you called a business and want to exercise your rights, contact that business — or contact us and we will pass your request on.
Why we use personal data (lawful bases)
| Purpose | Lawful basis |
|---|---|
| Providing the service, accounts, billing | Contract |
| Verifying businesses for UK phone numbers | Legal obligation (Ofcom rules) |
| Security, fraud prevention, audit logs | Legitimate interests |
| Service emails (receipts, alerts, renewal notices) | Contract / legitimate interests |
| Texts and WhatsApp messages to callers | The caller’s consent, collected and recorded during the call (service messages responding to a caller’s own enquiry rely on legitimate interests and always honour STOP) |
| Call recording (if enabled by the business) | The business’s legitimate interests, with callers told at the start of every recorded call |
Who we share data with
- Twilio — phone numbers, calls, texts and WhatsApp messages.
- OpenAI — real-time speech and language processing for calls, call summaries and transcription. Under OpenAI’s API terms, API data is not used to train their models by default.
- Stripe — payments and invoices.
- Google / Square — only if a business connects its calendar or booking system.
- Hosting, database and email providers (Fly.io, Supabase and Resend).
Some providers process data outside the UK; we rely on UK adequacy regulations or the International Data Transfer Addendum.
How long we keep it
- Call transcripts: 90 days by default (each business can change this).
- Call recordings: 30 days by default, only if recording is enabled.
- Message logs: 12 months by default.
- Caller records: deleted after 2 years without contact by default.
- Opt-out records (STOP): kept so we never message that number again.
- Account and billing records: 6 years after your subscription ends, for tax purposes.
Your rights
You can ask for access to, correction or erasure of your data, ask us to restrict or stop processing, or object to processing, and request a copy in a portable format. Contact bolt70business@gmail.com. You can also complain to the Information Commissioner’s Office at ico.org.uk or 0303 123 1113.
Cookies
We use only strictly necessary cookies: a session cookie to keep you signed in and a short-lived cookie during signup. We don’t use advertising or analytics cookies, so there is no cookie banner.
Security
Data is encrypted in transit; passwords are hashed with Argon2id; calendar access tokens are encrypted at rest; access is role-based and every business’s data is separated. Report security concerns to bolt70business@gmail.com.