Privacy Policy

What data we process

We process the following categories of data, depending on how you use the service:

• Account email — used for authentication via Supabase Auth (sign-in with an email OTP code) and for essential service communications.
• Beta signup email — if you leave your email in the website form, we use it only to manage the waitlist and invite you to the beta.
• Project and article content — keywords, briefs, drafts, articles and editorial settings you create in the app. They are yours: we process them only to provide the service.
• Integration credentials — credentials you connect (for example WordPress) are stored encrypted in a dedicated vault and used exclusively to perform the actions you request.
• Google Search Console OAuth tokens — if you connect GSC, we store access tokens to read your site's search data. You can revoke access at any time from your Google account or the project settings.
• Minimal technical data — security and operational logs (for example server errors) needed to keep the service reliable and secure.

Legal bases and purposes

• Performance of a contract (Art. 6.1.b GDPR) — account, content, integrations and tokens are needed to provide Boltize to you.
• Consent (Art. 6.1.a GDPR) — you join the beta waitlist only by voluntarily leaving your email; you can withdraw consent at any time.
• Legitimate interest (Art. 6.1.f GDPR) — service security, abuse prevention and technical logs.

We do not sell your data, we do not profile you, and we do not use your content for purposes other than providing the service.

AI providers

To generate and revise articles, Boltize sends the content you choose to process (keywords, briefs, drafts, sources) to third-party AI providers acting as data processors: Anthropic, OpenAI and Google, depending on your project configuration.

If you connect your own API keys, subscriptions or local models, processing happens with the provider and terms you chose: in that case the provider's own terms and privacy notices also apply. With local models, content does not leave your device for inference.

We do not use your content to train models.

Cookies

Boltize uses only technical session and authentication cookies (Supabase Auth), required to keep you signed in to the app. We use no analytics, marketing or profiling cookies, and no third-party tracking technologies. That is why there is no cookie banner: there is nothing to accept or reject.

Where data is stored

Data is hosted on Supabase (database and authentication) and Vercel (application hosting) infrastructure. Some providers may process data outside the European Union: in those cases the transfer is covered by GDPR safeguards such as Standard Contractual Clauses (SCC).

Retention

• Account data and content — kept while your account is active; on closure they are deleted or anonymized within a reasonable period.
• Beta waitlist emails — kept for the duration of the beta program or until you ask for deletion.
• Integration tokens and credentials — deleted when you disconnect the integration or close your account.
• Technical logs — kept for a limited period, for security and diagnostics only.

Your rights

Under Articles 15-22 GDPR you have the right of access, rectification, erasure, restriction, portability and objection to the processing of your data.

• Portability — you can export your articles and content directly from the app (Markdown/HTML).
• Erasure — while a self-service flow is being built, you can request deletion of your account and data by writing to hello@boltize.app: we will process the request without undue delay.
• Complaint — you also have the right to lodge a complaint with your supervisory authority (in Italy, the Garante per la protezione dei dati personali).

Changes to this notice

We may update this notice, for example as the service evolves. The current version will always be published on this page with its last-updated date; for material changes we will notify you by email or in the app.

Contact

For any question about this notice or your data: hello@boltize.app.