How BoltAI handles personal data.
This policy explains what personal data BoltAI may process, why we process it, how learning and AI-assisted features use data, how long information may be kept, and the choices and rights available to you.
Account details, learning activity, assessments, feedback, support messages and technical records may be processed when needed to provide the service.
Information submitted to AI-assisted features may be processed to generate feedback, practice, assessment or recommendations. Sensitive information should not be submitted unless a feature explicitly requires and protects it.
Depending on the law that applies, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent where processing relies on consent.
Who is responsible for your personal data?
The data controller for the processing described in this policy is REPLACE WITH LEGAL ENTITY NAME, operating the BoltAI service at boltai.pro.
For organization-managed accounts, the organization that provides your account may be the controller for some learning and workforce data, with BoltAI processing that information on its instructions. BoltAI may remain an independent controller for limited processing such as its own billing, security, abuse prevention and legal compliance. The relevant contract or data-processing agreement governs that relationship.
What this policy covers.
This policy applies to personal data processed through BoltAI's website, accounts, learning experiences, assessments, team features, support channels and related online services.
It does not replace a separate notice that may apply to a specific enterprise deployment, pilot, research activity, recruitment process or third-party service. If another notice applies, we will make that clear where the data is collected.
What personal data may be processed?
The exact data depends on how you use BoltAI. Categories may include:
Account and profile data
Name, email address, account identifiers, role, learning goals, language, organization membership and account preferences.
Learning and assessment data
Enrollments, progress, lesson activity, practice attempts, quiz or open-ended answers, feedback, skill states, assessment results, review activity and certificates where applicable.
AI interaction data
Content you submit to AI-assisted features, such as tutor messages, practice responses, prompts, explanations or oral-assessment transcripts, together with operational metadata needed to provide and monitor the feature.
Team and organization data
Team membership, assignments, cohorts, manager or reviewer roles, learning-path assignments, team-level progress signals and reporting information.
Billing and transaction data
Plan, subscription, invoice, billing contact and payment-status information. Payment-card details may be handled directly by a payment provider rather than stored by BoltAI.
Support and contact data
Your name, email address, topic, message and related correspondence when you contact us.
Technical and security data
IP address where needed, browser or device information, authentication events, service logs, security events, error records and diagnostic data used to keep the service reliable and secure.
Do not place passwords, private API keys, payment-card details, confidential credentials or unnecessary special-category personal data into learning exercises, tutor chats, AI prompts or support messages.
Why we process personal data.
We process personal data only where we have a lawful basis. Depending on the activity, this may include performance of a contract, steps requested before entering into a contract, compliance with legal obligations, legitimate interests, or consent.
| Purpose | Typical data | Typical legal basis |
|---|---|---|
| Provide and administer your account, learning paths, courses, practice and assessments. | Account, profile, learning, assessment and service activity. | Contract / pre-contractual steps. |
| Generate feedback, recommendations and AI-assisted learning experiences. | Learning inputs, practice responses, assessment data and feature context. | Contract; legitimate interests where appropriate; consent where specifically required. |
| Operate team features and provide permitted reporting to organization administrators. | Organization membership, assignments, progress and assessment signals. | Contract and/or processing on an organization's documented instructions. |
| Respond to support, billing and team enquiries. | Contact and correspondence data. | Contract / pre-contractual steps and legitimate interests. |
| Process subscriptions, invoices and accounting records. | Billing, transaction and account data. | Contract and legal obligations. |
| Protect accounts, detect abuse, investigate incidents and maintain service reliability. | Technical, authentication, security and diagnostic data. | Legitimate interests and legal obligations where applicable. |
| Send optional marketing communications. | Email, preferences and campaign interaction data where used. | Consent or another lawful basis permitted by applicable electronic-marketing law. |
How AI-assisted features use information.
BoltAI includes features that may use AI to support tutoring, practice generation, assessment, feedback, recommendations, role-based learning or workflow exercises.
- AI outputs can be wrong, incomplete or inconsistent and should not be treated as infallible.
- Automated systems may help generate feedback, skill states or recommendations, but these features are intended to support learning rather than make decisions with legal or similarly significant effects.
- Where an assessment or workflow requires human review, the relevant review process should remain part of the decision path.
- We may use specialist service providers to process AI requests on our behalf. Those providers must be reflected in our processor and transfer arrangements before production use.
BoltAI learning, assessment and skill outputs are not designed to be the sole basis for hiring, dismissal, promotion, compensation, disciplinary action or other high-impact decisions about a person. Organizations using BoltAI are responsible for ensuring that their own use of results is lawful, proportionate and subject to appropriate human review.
What changes when you use BoltAI through a team?
If your account is provided or managed by an organization, authorized administrators, managers, reviewers or coaches may have access to information that the organization is permitted to see under its agreement and configuration.
This may include enrollment, assigned learning, participation, progress, assessment results, skill states, review status or team-level reports. Access should be limited by role and organization scope.
Your organization may have its own privacy notice explaining how it uses workforce or learner data. Questions about employment-related use of your data should also be directed to that organization where it acts as controller.
Who may receive or process personal data?
We may use service providers that process personal data only as needed to provide or protect the service. Relevant categories may include:
We may also disclose information where required by law, necessary to protect legal rights or security, or as part of a corporate transaction subject to appropriate safeguards.
Before production launch, the actual provider inventory, contractual roles and data locations must be verified against this policy and the organization's record of processing activities.
International data transfers.
Some service providers may process data outside the country in which you are located. Where EU/EEA data is transferred to a country that does not benefit from an applicable adequacy decision, the controller should use an available lawful transfer mechanism, such as the European Commission's Standard Contractual Clauses, together with supplementary measures where appropriate.
You may contact us for information about the transfer safeguards that apply to your data.
How long we keep personal data.
We keep personal data only for as long as needed for the relevant purpose, to maintain legitimate learning or audit integrity, to comply with legal obligations, or to resolve disputes. Different data types have different retention rules.
Retained according to the account or organization lifecycle policy and minimized where appropriate.
May be deleted, redacted or anonymized after the configured retention period while preserving limited evidence needed for learning or audit integrity.
Subject to a shorter configurable retention period where the feature is enabled.
Kept for a bounded period needed to detect abuse, investigate incidents and maintain service reliability.
May be retained longer where needed to preserve credential verification, subject to the applicable account and legal policy.
Deleted data may remain temporarily in protected backups until the relevant backup cycle expires.
Organization-specific deployments may apply different approved retention periods. The live settings and infrastructure lifecycle must match the published policy.
Your data-protection rights.
Depending on the law that applies and the circumstances of the processing, you may have rights to:
Ask whether we process your personal data and request a copy.
Correct personal data that is inaccurate or incomplete.
Request deletion where the applicable legal conditions are met.
Ask us to limit certain processing in specific circumstances.
Receive certain data in a structured, commonly used format where the right applies.
Object to processing based on legitimate interests or to direct marketing.
Withdraw consent at any time where consent is the legal basis, without affecting earlier lawful processing.
Exercise applicable rights relating to solely automated decisions that produce legal or similarly significant effects.
To exercise a privacy right, email privacy@boltai.pro. We may need to verify your identity before acting on a request.
If an organization controls the relevant data, we may direct you to that organization or assist it in responding to your request.
If the controller is established in Spain or Spanish data-protection law applies to the processing, you may also lodge a complaint with the Agencia Española de Protección de Datos (AEPD). If another supervisory authority is competent, you may contact that authority instead.
How we protect information.
We use technical and organizational measures intended to protect personal data against unauthorized access, loss, alteration, misuse or disclosure. Depending on the system, measures may include access controls, organization and role scoping, transport encryption, secret and personal-data filtering, security logging, backups, retention controls and privacy export or erasure workflows.
No online service can guarantee absolute security. If you believe your account or data may have been compromised, contact us promptly and do not send credentials in your message.
Children's data.
BoltAI is designed primarily for professional and workplace learning and is not intentionally directed to children. If a deployment is intended for minors, the relevant organization and BoltAI must establish appropriate age, notice, consent and safeguarding controls before that use begins.
Changes to this policy.
We may update this policy when the product, legal requirements, providers or processing activities change. The date at the top of the policy shows the latest published revision.
If a change materially affects how personal data is used, we will provide an appropriate notice where required.
Questions about privacy?
Email privacy@boltai.pro for privacy-related questions or requests.