Privacy policy.

Effective 9 September 2026 · Last updated 23 October 2026

1. Who we are

Boulton (“Boulton,” “we,” “us”) operates a business-to-business software platform for outbound client acquisition. Boulton is operated by BayRise Capital Partners LLC d/b/a Boulton AI, a Florida limited liability company.

Contact: privacy@boulton.ai
Mailing address: 16703 Early Riser Ave, Land O Lakes, FL 34638

This policy explains what information we collect, why, how we use it, who we share it with, how long we keep it, and how to stop being contacted or have your information removed.

2. Who this policy covers

Boulton serves business customers. Three groups of people appear in this policy:

• Client users — people at our business customers who log into Boulton.
• Prospects — business contacts our clients choose to reach out to using Boulton.
• Website visitors — anyone visiting our public site.

If you received a message and want it to stop, go straight to our do-not-contact page.

3. Information we collect

3.1 From client users

Name, business email address, business phone, job title, company, login credentials, and activity within the platform (pages viewed, actions taken).

3.2 From clients about their prospects

Our clients load, or direct us to compile, business contact information about the companies and people they want to reach. This is typically: name, job title, business email address, employer, company website, company size, industry, LinkedIn profile URL, and publicly available business information.

We obtain this information from our clients directly, and from commercial business-data providers and public web sources. Clients determine who is targeted. Clients are responsible for their lawful basis to contact those prospects.

3.3 From connected accounts (Google, Calendly)

See Section 5 — this is disclosed separately and in detail.

3.4 Automatically

IP address, browser type, device information, and usage logs, for security and to operate the service.

3.5 Payment information

Payments are processed by Stripe. We do not store card numbers, card brands, or any part of a card number. We store a Stripe customer identifier, a subscription identifier, and subscription status. All payment card data is held by Stripe, not by us.

3.6 From AI apps you connect

You can connect an AI app you use, such as Claude, ChatGPT, Grok or Cursor, to Boulton so it can work in Boulton as you. You connect it either by signing in to Boulton and approving it, or by making a personal API key in Settings › Connectors. When you do, we collect:

• The connection: which app you connected, the access you chose (“Everything you can do” or “Look only”), when you connected it and when it was last used. For a personal API key: its name, its first characters, and when it expires.
• Security credentials, stored only in scrambled (hashed) form: the codes and tokens that let the app work as you. We never store them in readable form and never show them again after they are issued.
• The app’s own details, which it sends when it registers with us: its name, the web addresses it uses to finish sign-in, and optionally the address of its logo.
• What the app does in Boulton: each change it makes and each request it raises, such as asking to send an email or launch a campaign. For each one we record which action it was, in which workspace, when, and what it concerned, as you “via” that app. When you approve a request through the app, we record that you approved it and the words you gave the app as your approval. Our server logs also briefly note each call an app makes and whether it succeeded, for security and troubleshooting.

We do not receive your conversation with the AI app, or anything else in that app. We receive only the requests it sends to Boulton.

4. How we use information

• To provide, operate, secure, and support the platform.
• To send outbound messages at our clients’ direction, from our clients’ own sending accounts.
• To classify, route, and summarize replies our clients receive.
• To enrich and verify business contact data so messages reach valid recipients.
• To let AI apps you connect work in Boulton as you, and to keep a record of what they did and what you approved.
• To bill clients and prevent fraud.
• To meet legal obligations.

We use artificial intelligence and large language model providers to draft message copy, classify replies, and generate campaign strategy. See Sections 5.4 and 7.

We do not sell personal information. We do not use personal information for advertising or ad targeting. We do not use tracking pixels in outbound messages by default.

5. Google user data — access, use, storage, sharing, and Limited Use

This section governs data obtained through Google APIs and takes precedence over any general statement elsewhere in this policy.

5.1 What we access

When a Boulton user chooses to connect their Google Calendar, we request the following OAuth scopes:

We request no Gmail scopes, no Drive scopes, and no Contacts scopes.

5.2 What we do with it

• Read: We query free/busy intervals on the connected calendar to compute available meeting slots to offer a prospect. We do not read the titles, descriptions, or attendees of the user’s existing events.
• Write: We create a calendar event only when a meeting is agreed, and only on the connected user’s own calendar.
• We do not modify or delete events Boulton did not create.

5.3 What we store

We store the OAuth access and refresh tokens, encrypted at rest, so the connection persists between sessions. We store the identifier and start/end time of events Boulton creates. We do not store the contents, attendees, titles, or descriptions of the user’s pre-existing calendar events.

5.4 What we do not do

• We do not use Google user data for advertising of any kind, including retargeting or personalized advertising.
• We do not sell or transfer Google user data to third parties, data brokers, or information resellers.
• We do not use Google user data to train, develop, or improve any generalized or non-personalized artificial intelligence or machine learning model.
• We do not send the contents of your calendar events to our AI providers. Availability — open time slots computed from your calendar’s busy/free information — is provided to the model that drafts the reply, solely so that it can offer meeting times to a prospect.
• We do not allow humans to read Google user data, except: (a) with the user’s explicit prior agreement, for support; (b) where necessary for security purposes such as investigating abuse or a bug; (c) where required by law; or (d) where the data is aggregated and de-identified for internal operations.

5.5 Limited Use affirmation

Boulton’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5.6 Revoking access

A user may disconnect their calendar at any time within Boulton, or revoke Boulton’s access directly at their Google account permissions page. On disconnection or revocation we revoke the token with Google and delete our stored copy. To request deletion of remaining associated data, email privacy@boulton.ai.

5A. When your AI app works in Boulton

What the app can see. An app you connect can read and act on what you can in Boulton, in the workspaces you belong to, and never more. That can include your company’s profile and offers, your campaigns and their results, the replies your prospects send, and business contact information about your prospects. When the app asks Boulton for this information, we send it to the app. From then on, the company that provides the AI app handles it under its own terms and privacy policy, not ours: for example Anthropic (Claude), OpenAI (ChatGPT and Codex), xAI (Grok), Meta (Meta AI), Anysphere (Cursor), Google (Gemini) or Perplexity, depending on the app you chose.

What the app can never do. It cannot connect or disconnect accounts, manage members, change your workspace’s settings switches, change billing or buy credits, or export your data in bulk. Boulton’s own methods and instructions are not shared with it.

What waits for you. Sending email, launching a campaign, placing people in a campaign, deleting records, removing someone from your never-email list, and anything that spends credits are never done on the app’s own decision. The app must ask you first, and the action runs only on your yes. Most AI apps also show their own Allow button before such an action. After an email is sent, a campaign is launched, or records are deleted this way, you get a notification in Boulton.

Stopping it. You can disconnect an app or revoke a key at any time in Settings › Connectors, and it stops working at once. Its access also ends when you leave a workspace, or when a workspace stops allowing AI apps. Access an app gets by signing in lasts one hour at a time and renews for up to 30 days after it was last used. A personal API key lasts 90 days.

6. Prospect information — notice to recipients

If you received a message sent through Boulton and want to know why:

• The message was sent by our client, not by Boulton. Boulton is the software platform our client used.
• Your business contact information was obtained from publicly available business sources or commercial data providers, and the decision to contact you was made by our client.

How to stop being contacted

There are two different things you can ask for, and they are not the same:

Replying to one sender does not remove you from the platform. If you want to be gone entirely, use the second row.

To ask what information we hold about you, or to have it removed, see Section 10.

7. Who we share information with

We share information with service providers who help us run the platform. They are bound to use it only to provide services to us.

Some of these are our providers. Others are accounts our clients own and connect themselves. The distinction matters, so we state it.

7.1 Our service providers

• Hosting and infrastructure: Railway (backend), Vercel (frontend), Neon (database), and a managed job queue.
• Artificial intelligence / model providers: Anthropic, OpenAI. Used to draft message copy, classify replies, extract information from client materials, and generate strategy.
• Contact data sourcing, enrichment and verification: AI Ark, LeadMagic, MillionVerifier, Enrichley.
• Website content: Firecrawl (public company websites — no personal data).
• Sending infrastructure: ScaledMail (domains and mailboxes), Spaceship (domain registration — no personal data).
• Billing: Stripe.
• Transactional email: Resend.
• Error monitoring: Sentry. Configured with personal data collection disabled and event scrubbing enabled.
• Internal operations alerting: Slack.

7.2 Accounts our clients connect themselves

These are our clients’ own accounts, under their own contracts. We act on them at the client’s direction; they are not our subprocessors:

PlusVibe · Instantly · HeyReach (LinkedIn) · GoHighLevel · Notion · Google Calendar · Calendly

7.3 EmailBison — either, depending on the client

EmailBison is used for email sequencing and delivery. Depending on the client, either Boulton provides the account (in which case EmailBison is our service provider) or the client connects their own EmailBison account (in which case it is theirs). Clients can determine which applies to them in their workspace settings.

7.4 AI apps you connect

When you connect an AI app, we send it the information it asks for on your behalf (see 5A). You choose and control those apps; they are not our service providers.

The full list, with the purpose and data category for each provider, is maintained in the Subprocessors section of our Terms of Service, which carries its own last-updated date. Processing locations are available on request.

We may also disclose information where required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets.

8. Data retention

We are specific about this because a stated retention period we did not honor would be worse than saying nothing.

• Contact and company information. Business contact records — name, job title, employer, business email, and similar factual business information — are retained as part of our ongoing business database. We do not delete them on a fixed schedule. This is factual business information that we also source independently from commercial data providers. See Section 10 for how to have your own information removed.
• Client user accounts. Retained for the life of the account.
• Client campaign data (targeting, message content, campaign records). Available to the client for export for 30 days after termination, and retained thereafter except where we are required to delete it.
• Do-not-contact and opt-out records. Retained indefinitely and deliberately — we cannot keep honoring your request not to be contacted unless we remember that you made it. This is the one category we will not delete.
• Google OAuth tokens. Deleted when you disconnect or revoke access.
• Security and audit logs. Retained for operational and security purposes. We do not currently operate a fixed deletion schedule for these.
• AI app connections. We keep the record of a connection (which app, the access you chose, when it was connected and last used) while it is active and for 12 months after it ends, so you and your workspace admins can see what was done through it. A connection ends when you disconnect it, or 30 days after the app last used it. A personal API key is kept for 12 months after it is revoked or expires. An AI app’s registration with us is deleted once it has gone unused for 12 months and no connection uses it. Sign-in codes are deleted within a day of expiring, and expired access and refresh tokens within 30 days of expiring. The record of what an app did in a workspace is kept with that workspace’s other activity records.

Apart from AI app connection records (above), we do not run automated deletion on a schedule. Where you ask us to remove your information, we handle that on request — see Section 10.

9. Security

We encrypt data in transit and encrypt credentials and access tokens at rest. Access to production systems is limited to personnel who need it. We do not currently hold a SOC 2 or ISO 27001 certification. We will describe our current security posture honestly on request.

10. Your rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, or to object to processing. To exercise them, email privacy@boulton.ai, or use our do-not-contact page. We will respond within the time required by applicable law.

You can see every AI app and key connected to your login, and disconnect or revoke any of them, in Settings › Connectors.

If you ask us to remove you, here is exactly what we do:

1. We add you to our platform-wide do-not-contact list, so that no client using Boulton can message you again. This is checked before any message is sent.
2. We delete the personal information we hold about you.
3. We keep the minimum record needed to keep honoring your request — because we cannot refuse to contact you in future if we do not remember that you asked. That record exists only to keep your request working. It is never used to contact you and it is not used for anything else.

One limitation, stated plainly: we obtain business contact information from third-party data providers. A record about you may therefore be supplied to us again in future by one of them. Our do-not-contact list is checked before any message is sent, so you will not be contacted — but we cannot promise that no record about you will ever re-enter our systems.

Where Boulton processes prospect information at a client’s direction, that client is the controller and we are the processor. We will refer your request to them and assist them in responding.

California residents: We do not sell or share personal information as those terms are defined under the CCPA/CPRA.

11. International transfers

We are based in the United States and our service providers are primarily located in the United States. If you are outside the United States, your information will be transferred to and processed in the United States.

12. Children

Boulton is a business tool and is not directed to anyone under 18. We do not knowingly collect information from children.

13. Changes to this policy

If we change how we use Google user data, we will update this policy and prompt affected users to consent before the new use takes effect. For other changes, we will update the date at the top and, where the change is material, notify clients.

14. Contact

BayRise Capital Partners LLC d/b/a Boulton AI
16703 Early Riser Ave
Land O Lakes, FL 34638
privacy@boulton.ai