Privacy Policy

BoltKit is an AI-powered content scheduling tool operated by SVE (“we”, “us”, “our”), a company registered in the United Kingdom. Our service is available at boltkit.co.uk.

If you have any questions about this policy, contact us at hello@boltkit.co.uk.

We collect only what is necessary to provide the service:

• Account information — your email address when you register.
• Social account credentials — OAuth access tokens for Facebook Pages and Instagram Business accounts you connect. Tokens are encrypted at rest using AES-256-GCM before storage.
• Page and profile data — Facebook Page ID, Page name, Instagram username, and profile picture URL, retrieved at connection time to identify your accounts.
• Post content — image URLs, captions, hashtags, and scheduled publish times that you create or upload within BoltKit.
• Publish logs — records of publishing attempts (success or failure) including timestamps and any error messages returned by Meta's API.
• Usage data — standard server logs (IP address, browser, pages visited). We do not use third-party analytics trackers.

Your data is used solely to operate BoltKit:

• Authenticating you to Facebook and Instagram via Meta's OAuth API.
• Publishing posts to your connected accounts on the schedule you set.
• Displaying your scheduled and published content within the app.
• Sending service emails (account confirmation, error alerts).

We do not use your content or social account data for advertising, profiling, or any purpose other than operating the service on your behalf.

Data is stored in Supabase, a cloud database provider with servers in the European Union. Social account access tokens are encrypted with AES-256-GCM using a secret key held only in our server environment — they are never stored in plain text.

Access to production data is restricted to authorised personnel only. We use HTTPS for all data in transit.

BoltKit interacts with the following third-party services to operate:

• Meta (Facebook / Instagram) — we use the Meta Graph API to publish posts and retrieve account information on your behalf. Your use of these platforms is subject to Meta's own Privacy Policy.
• Supabase — our database and file storage provider.
• Vercel — our hosting and serverless infrastructure provider.
• Stripe — payment processing. We do not store card details; Stripe handles all payment data.

We do not sell, rent, or share your personal data or social account credentials with any other third parties.

BoltKit uses permissions granted through Facebook Login to access your Facebook Pages and Instagram Business accounts. Specifically:

• instagram_content_publish — to publish photos and videos to Instagram on your behalf.
• pages_read_engagement — to validate your Page connection and retrieve a Page Access Token for publishing.
• pages_show_list — to display the list of Facebook Pages you manage during the connection flow.
• instagram_basic — to read your Instagram account ID and username.

We do not access your personal Facebook profile, your followers, direct messages, or any data beyond what is required for scheduling and publishing.

Data obtained through Meta APIs is not transferred to or shared with advertising networks, data brokers, or any third parties for purposes unrelated to BoltKit's core functionality.

• Access tokens — retained while your account is active. Deleted immediately when you disconnect an account or delete your BoltKit account.
• Scheduled posts — retained until you delete them or close your account.
• Publish logs — retained for 90 days, then automatically deleted.
• Account data — retained until you request deletion.

Under UK GDPR and the Data Protection Act 2018, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (“right to be forgotten”).
• Withdraw consent at any time (by disconnecting your accounts or deleting your BoltKit account).
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, email hello@boltkit.co.uk.

BoltKit uses only essential session cookies required for authentication. We do not use advertising cookies or third-party tracking cookies.

We may update this policy from time to time. We will notify you of material changes by email or via an in-app notice. Continued use of BoltKit after changes take effect constitutes acceptance of the updated policy.