Privacy Policy

Bolton Vance LLC is a limited liability company registered in Delaware, United States. This policy explains how we handle personal data on boltonvance.com and across the services we deliver: web applications, local SEO, WhatsApp chatbots, AI voice agents, cloud infrastructure, and payment, POS, and CRM integrations.

For any privacy question, or to exercise a right described in this policy, write to support@boltonvance.com or to Bolton Vance LLC, Noundhana, Sherkot, District Bijnor, Uttar Pradesh 246747, India.

This distinction matters, because different rules apply to each role.

• For our own relationship with you — your enquiry, your account, your invoices, our support conversations — we are the data controller. This policy governs that data.
• For data that flows through a system we build and operate for you — your customers' WhatsApp messages, call recordings, bookings, CRM records, order data — you are the controller and we act as a processor on your documented instructions.

Where we act as your processor, you are responsible for having a lawful basis for that processing, for issuing the required privacy notice to your own customers, and for responding to their data rights requests. We will assist you with those requests, and we will not use your customers' data for our own purposes.

Some of this you give us directly when you enquire or become a client; the rest is generated automatically when you use the website.

• Identity and contact data: your name, business name, email address, phone or WhatsApp number, and country
• Project data: the requirements, briefs, credentials, brand assets, copy, and images you share so we can build what you asked for
• Correspondence: emails, WhatsApp messages, and support tickets exchanged with us, kept as a record of what was agreed
• Billing data: invoice history, plan, billing country, transaction status, and the card brand and last four digits returned by our payment processor
• Technical data collected automatically when you visit the website: IP address, browser and device type, operating system, pages viewed, referring URL, and timestamps, recorded in standard server logs

We do not receive or store your full card number, expiry date, CVV, or PIN. Those are entered directly into our payment processor's secure form and never reach our systems.

We do not intentionally collect special category data such as health, biometric, religious, or political information, and we ask that you do not send it to us unless it is genuinely required for a project and we have agreed the safeguards in advance.

• To respond to your enquiry and prepare a quote — because you asked us to take steps before entering a contract
• To deliver, host, maintain, and support the services you engaged us for — performance of our contract with you
• To take payment, issue invoices, chase unpaid invoices, and keep accounting records — performance of our contract and compliance with a legal obligation
• To secure our systems, prevent fraud and abuse, and investigate incidents — our legitimate interest in running a safe service
• To improve our services and understand which parts of the site are used — our legitimate interest, applied in a way that does not override your rights
• To send service updates about your account — performance of our contract. Marketing messages are sent only where you have opted in, and every one carries an unsubscribe link

We have never sold, rented, or traded personal data, and we do not. Your business data, client lists, and CRM inputs are not shared with data brokers, advertising exchanges, or list vendors under any circumstances.

Under the California Consumer Privacy Act, we do not sell or share personal information as those terms are defined, and we do not use it for cross-context behavioural advertising.

We share personal data only where it is needed to run the service, and only with providers bound by their own contractual and security obligations:

• Payment processing: our payment processor handles card data and transaction records
• Cloud infrastructure and hosting: Amazon Web Services, and any other cloud provider named in your project scope
• Messaging and communications platforms: the WhatsApp Business Platform and any telephony provider used for voice agents you have asked us to run
• Tools you ask us to integrate: your CRM, POS, scheduling, or accounting software, at your instruction
• Professional advisers: accountants and legal advisers, bound by professional confidentiality
• Authorities: where we are legally required to disclose, or where it is necessary to establish or defend a legal claim

If our business is ever restructured, merged, or acquired, personal data may transfer as part of that transaction. You would be notified, and the receiving party would remain bound by this policy until it is properly replaced.

Bolton Vance LLC is registered in the United States, our team operates from India, and our infrastructure runs in cloud regions selected for each project. Your data will therefore be transferred to and processed in countries other than the one you are in.

Where data is transferred out of the European Economic Area, the United Kingdom, or another region with transfer restrictions, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses with the providers involved. Ask us and we will tell you which providers hold data for your specific engagement.

• Data in transit is encrypted using TLS across our websites, applications, and APIs
• Data at rest in our AWS storage and database layers is encrypted using AES-256
• Access is granted on a need-to-know basis, and removed when a person no longer needs it
• Production credentials and API keys are held in a secrets manager, never in source code or shared documents
• Backups are taken on a schedule and are subject to the same access controls as live data

No system can be guaranteed completely secure. If a breach occurs that is likely to affect your rights, we will notify you and the relevant supervisory authority without undue delay and within the timeframes the applicable law requires.

• Account, project, and correspondence data: for as long as your account is active, and afterwards only as long as needed to resolve disputes or enforce agreements
• Billing and tax records: retained for the period required by applicable accounting and tax law, typically several years after the final transaction
• Suspended accounts: where an account is suspended for non-payment and remains unsettled, client data and configurations are permanently purged 30 days after suspension
• Server logs: retained for a short operational period for security and troubleshooting, then deleted
• Backups: cycled out on their normal schedule, so deleted data may persist in a backup briefly before it is overwritten

Depending on where you live, you may have some or all of the following rights over your personal data:

• Access — to be told what we hold and to receive a copy
• Rectification — to have inaccurate or incomplete data corrected
• Erasure — to have data deleted where we no longer have a reason to keep it
• Portability — to receive data you gave us in a structured, machine-readable format
• Restriction and objection — to limit or object to processing based on our legitimate interests
• Withdrawal of consent — at any time, where processing is based on consent, without affecting what was lawful before
• Non-discrimination — we will not degrade your service or change your price because you exercised a right

To exercise any of these, email support@boltonvance.com. We may ask for information to verify your identity before we act, so that we do not disclose data to the wrong person. We respond within 30 days, and will tell you if we need longer and why.

If you are in the EEA or the UK and you are not satisfied with our response, you have the right to complain to your local data protection supervisory authority. We would appreciate the chance to resolve it with you first.

Our website uses only the cookies necessary for it to function and remain secure. We do not currently set advertising or cross-site tracking cookies.

If we add analytics or measurement tools in future, this policy and a cookie notice will be updated before those cookies are set, and where consent is legally required it will be requested first.

Where a system we build for you sets cookies on your own website, you are responsible for the notice and consent presented to your visitors. We will implement the mechanism you ask for.

Our services are sold to businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact support@boltonvance.com and we will delete it.

We update this policy when our services, our providers, or the law change. The effective date at the top of the page always reflects the current version.

Where a change materially affects how we use your personal data, we will notify active clients by email before it takes effect.

Privacy questions and data rights requests: support@boltonvance.com. Billing-related data questions: billing@boltonvance.com. Phone and WhatsApp: +91 79834 46931.

Postal correspondence: Bolton Vance LLC, Noundhana, Sherkot, District Bijnor, Uttar Pradesh 246747, India.