Privacy Statement
Last Updated: October 20, 2026
This Privacy Statement outlines how BOLT XLR collects, uses, and protects the data generated within our restoration management platform, including our web application and our iOS and Android mobile apps. Because BOLT XLR handles sensitive financial, location, and operational data, we keep each company's information separate and handle it securely.
1 Information We Collect
We collect information necessary to provide restoration cost-tracking and job management services.
| Category | Specific Data Points |
|---|---|
| User Identity | Name, email, a unique user ID, and the permissions assigned to your role. |
| Operational Data | Job details, moisture readings, psychrometric data, task lists, and equipment status. |
| Financial Data | Labor rates (hourly/salary), subcontractor contract values, material costs, and total job revenue. |
| Geospatial Data | Optional GPS coordinates recorded by the mobile apps when you clock in or out, start or stop a mileage trip, or upload a photo or video. |
| Client Data | Names, addresses, and contact information of your restoration customers. |
| Files | Documentation, photos, and attachments (automatically scanned for viruses). |
| Signatures | When a job document is signed, we record the signer's name and email address, the time, and the IP address and browser type used to sign. |
| Voice Dictation | Optional. If you use the microphone to dictate into an AI feature, we capture a short audio recording of what you say, used only to transcribe your words into text. Recording starts when you tap the microphone and stops when you tap it again; we never record in the background. |
| Mobile App Data | With your permission: camera captures and photo-library selections you attach to jobs, the microphone when you record a job video, a one-time GPS fix recorded when you clock in or out, start or stop a mileage trip, or upload a photo or video (mileage itself comes from the odometer readings you enter, never a tracked route), and a device token if you enable push notifications. The mobile apps never track your location in the background. |
| Error and Diagnostic Data | When the web or mobile app hits an error or crashes, we collect a technical report: the error, the app version, and your device or browser type and operating system. In the web app, we also record a replay of the screens and clicks for a sample of sessions and around errors, with all text, typed input, images, and media hidden before anything leaves your browser. The mobile apps never record your screen. Reports are labeled with your company workspace and may carry an internal user ID. We do not attach your name or email address to these reports. |
2 How We Use Your Data
BOLT XLR processes data to support end-to-end cost tracking on your jobs:
- Cost Calculation: Using time tracking records and payroll info to determine labor burden.
- Project Documentation: Aggregating moisture readings and equipment logs into "Job Print" reports.
- Accounting Integration: Formatting labor and job data for export to QuickBooks or other CSV-compatible systems.
- AI Assistance: Answering the questions you ask AI features such as Ask BOLT, using your company's own records.
- Security and Maintenance: Monitoring system logs and performing virus scans on uploaded files.
3 How We Keep Your Data Separate
Your company's information is kept apart from every other company's, and access inside your own account is controlled by you:
- Your Own Database: Each company's data lives in its own separate database. Your job costs and financial records are never mixed in with another company's.
- Role-Based Access: You decide who sees what. Sensitive information such as job costs and payroll is visible only to the roles you choose to grant it to.
- Sign-In and Passwords: Sign-in is handled by an industry-standard identity provider. We never store your password.
4 Third-Party Data Sharing
We do not sell your data. We share information only with the third parties needed to run the service:
- Firebase (Google): For authentication, identity services, and push notification delivery (Firebase Cloud Messaging).
- Stripe: For subscription billing and account management.
- Resend: Delivers the emails BOLT XLR sends. It receives the recipient's email address and the content of the message, including any attachments. If you sign up for product updates on our website, your email address is stored in Resend as a marketing contact until you unsubscribe.
- Intuit (QuickBooks Online): Only if you connect QuickBooks Online. The invoices, bills, expenses, time entries, and related names you sync are sent to your QuickBooks company.
- Google Gemini (AI): Powers AI features such as Ask BOLT in the web and mobile apps. When you use an AI feature, your question, the conversation, and the company records needed to answer it (such as job, client, crew, and financial details) are sent to Google's Gemini AI service to generate the response. If you use voice dictation, the audio you record is also sent to Google's Gemini AI service, which transcribes it into text; the recording is used only for that transcription. Nothing is sent to the AI service unless you use an AI feature, and the mobile apps ask for your permission first.
- Sentry: Receives the error and crash reports, and the masked web replays, described above so we can find and fix problems. We use this data only to keep the service working, never for advertising or tracking.
- Google Analytics: Counts visits to this website and which pages and buttons are used. We do not send it your name, email, or company.
- Google Fonts: The web app loads its typeface from Google Fonts, so your browser contacts Google, which sees your IP address, when the app loads.
- Google Cloud: Your data is hosted on Google Cloud infrastructure located in the United States.
5 Security Measures
- Encryption: All data is encrypted in transit via TLS and at rest within our databases.
- Virus Protection: Every file uploaded to BOLT XLR is automatically scanned for viruses, so a bad file cannot spread to your team.
- Permission Checks: Your permissions are checked on every request, so people only ever see what their role allows.
6 Data Retention and Deletion
When your BOLT XLR subscription ends, your administrators receive an email link to download a full export of your company's data, including job and financial records and uploaded files. The link works for 30 days. After that window your company's database and files are deleted, and the encrypted backups we keep for disaster recovery expire within a further 30 days.
Individual user accounts are provisioned and managed by your company's BOLT XLR administrator. To request deletion of your user account and the personal data associated with it, contact your administrator or email us at support@boltxlr.com (or use the support form). We honor verified deletion requests within 30 days, subject to records we are legally required to retain.
Your use of BOLT XLR is governed by our Terms of Service.