Privacy policy.
Effective 9 September 2026 · Last updated 28 October 2026
1. Who we are
Boulton (“Boulton,” “we,” “us”) operates a business-to-business software platform for outbound client acquisition. Boulton is operated by BayRise Capital Partners LLC d/b/a Boulton AI, a Florida limited liability company.
Contact: privacy@boulton.ai
Person in charge of personal information: Privacy Officer,
privacy@boulton.ai
Mailing address: 16703 Early Riser Ave, Land O Lakes, FL 34638
This policy explains what information we collect, why, how we use it, who we share it with, how long we keep it, and how to stop being contacted or have your information removed.
2. Who this policy covers
Boulton serves business customers. Three groups of people appear in this policy:
- Client users — people at our business customers who log into Boulton.
- Prospects — business contacts our clients choose to reach out to using Boulton.
- Website visitors — anyone visiting our public site.
If you received a message and want it to stop, go straight to our do-not-contact page.
3. Information we collect
3.1 From client users
Name, business email address, business phone, job title, company, login credentials, a profile photo if you add one, voice input if you use dictation, and activity within the platform (pages viewed, actions taken).
3.2 About prospects
Business contact and company information about the companies and people our clients want to reach. This is typically: name, job title, business email address, employer, company website, company size, industry, LinkedIn profile URL, LinkedIn profile information and public posts, and other publicly available business information. It also includes the messages sent to prospects and the replies they send, including any attachments.
We obtain this information from our clients (including information other clients have provided to Boulton), from commercial business-data providers, and from public web sources. Clients determine who is targeted. Clients are responsible for their lawful basis to contact those prospects.
3.3 From accounts you connect
When you connect a calendar, a sending platform, a CRM, or a LinkedIn account, we receive the information needed to act on that account at your direction. For Google, see Section 5. We act on a connected LinkedIn account through a LinkedIn connectivity provider.
3.4 Automatically
IP address, browser type, device information, and usage logs, for security and to operate the service.
3.5 Payment information
Payments are processed by our payment processor, which holds your card details. We do not store full card numbers. We keep billing records such as customer and subscription identifiers and subscription status.
3.6 From AI apps you connect
If you connect an AI app to Boulton, we collect details of the connection, the credentials that let it act as you (stored in hashed form), and a record of the actions it takes and the approvals you give through it. We do not receive your conversations with the AI app.
4. How we use information
- To provide, operate, secure, and support the platform.
- To send outbound messages at our clients’ direction, from our clients’ own sending accounts.
- To classify, route, and summarize replies our clients receive.
- To find, enrich, and verify business contact data so messages reach valid recipients.
- To let AI apps you connect work in Boulton as you.
- To bill clients and prevent fraud.
- To meet legal obligations.
We use artificial-intelligence model providers to help deliver the service, for example to draft messages, read and classify replies, research companies and people, and transcribe dictation.
5. Google user data — access, use, storage, sharing, and Limited Use
This section governs data obtained through Google APIs and takes precedence over any general statement elsewhere in this policy.
5.1 What we access
When a Boulton user chooses to connect their Google Calendar, we request the following OAuth scopes:
| Scope | What it permits | Why Boulton requests it |
|---|---|---|
https://www.googleapis.com/auth/calendar.freebusy | Read busy/free intervals | To determine when the user is free, so the platform can offer a prospect real open times. |
https://www.googleapis.com/auth/calendar.events | Create and manage calendar events | To create the meeting event on the user’s calendar when a prospect books a time. |
https://www.googleapis.com/auth/calendar.readonly | Read calendars and events | To identify which calendars the account holds, and the user’s primary calendar and time zone, at the point of connection. |
We request no Gmail scopes, no Drive scopes, and no Contacts scopes.
5.2 What we do with it
- Read: We query free/busy intervals on the connected calendar to compute available meeting slots to offer a prospect. We do not read the titles, descriptions, or attendees of the user’s existing events.
- Write: We create a calendar event only when a meeting is booked, on the calendar the user chooses.
- We do not modify or delete events Boulton did not create.
5.3 What we store
We store the OAuth tokens needed to keep the connection, stored securely, and the details of events Boulton creates. We do not store the contents, attendees, titles, or descriptions of the user’s other calendar events.
5.4 What we do not do
- We do not use Google user data for advertising of any kind, including retargeting or personalized advertising.
- We do not sell or transfer Google user data to third parties, data brokers, or information resellers.
- We do not use Google user data to train, develop, or improve any generalized or non-personalized artificial intelligence or machine learning model.
- We do not send the contents of your calendar events to our AI providers. Availability — open time slots computed from your calendar’s busy/free information — is provided to the model that drafts the reply, solely so that it can offer meeting times to a prospect.
- We do not allow humans to read Google user data, except: (a) with the user’s explicit prior agreement, for support; (b) where necessary for security purposes such as investigating abuse or a bug; (c) where required by law; or (d) where the data is aggregated and de-identified for internal operations.
5.5 Limited Use affirmation
Boulton’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5.6 Revoking access
A user may disconnect their calendar in Boulton at any time, or revoke Boulton’s access at their Google account permissions page. When a user disconnects in Boulton, we revoke access with Google and delete the stored tokens. To request deletion of remaining associated data, email privacy@boulton.ai.
5A. When your AI app works in Boulton
An AI app you connect can access and act on the Boulton data you can access. Information Boulton sends to the app is handled by the app’s provider under its own terms and privacy policy, not ours. Some actions may ask for your approval first, and you can disconnect an app or revoke a key at any time in Settings.
6. Prospect information — notice to recipients
If you received a message sent through Boulton and want to know why:
- The message was sent by our client, not by Boulton. Boulton is the software platform our client used.
- Your business contact information was obtained from publicly available business sources, commercial data providers, or Boulton’s clients, and the decision to contact you was made by our client.
How to stop being contacted
There are two different things you can ask for, and they are not the same:
| What you want | How | What happens |
|---|---|---|
| Stop hearing from this one sender | Reply to the message and say so | We record your request in that company’s Boulton workspace, which stops its automated outreach to you through Boulton. Other Boulton clients may still contact you. |
| Stop hearing from anyone using Boulton | Our do-not-contact page | We add you to our platform-wide do-not-contact list, which Boulton checks when its clients add people to email campaigns and before automated replies are sent. |
Replying to one sender does not remove you from the platform. If you want to be gone entirely, use the second row.
To ask what information we hold about you, or to have it removed, see Section 10.
7. Who we share information with
We share information with service providers that help us run Boulton. They may use it only to provide services to us. They fall into these categories:
- Cloud hosting, databases, and background job processing
- Artificial-intelligence model providers
- Business-data, email-finding, and email-verification providers
- Web data and search providers
- Email-sending, mailbox, domain, and deliverability infrastructure
- LinkedIn connectivity
- Payment processing
- Transactional email
- Error monitoring
- Internal operational alerting
Our clients can request our current list of service providers.
Accounts you connect yourself — such as a sending platform, CRM, calendar, LinkedIn account, or AI app — are your own accounts under your own contracts. We act on them at your direction, and we send them the information needed to do so.
We may also disclose information where required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets.
8. Data retention
We keep personal information for as long as we need it for the purposes in this policy: to provide the service, keep the records our clients rely on, meet legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. After that, we delete or de-identify it. Business contact information in our database is kept while it remains useful to the service.
Do-not-contact and opt-out records are kept indefinitely, because we cannot keep honoring your request not to be contacted unless we remember that you made it.
9. Security
We use reasonable administrative, technical, and physical safeguards to protect personal information. No system is completely secure.
10. Your rights
Depending on where you live, you may have rights to access, correct, delete, or port your personal information, or to object to processing. To exercise them, email privacy@boulton.ai, or use our do-not-contact page. We will respond within the time required by applicable law.
If you ask us to remove you, we add you to our platform-wide do-not-contact list and delete or de-identify your personal information where the law requires, keeping only the minimum record needed to honor your request. That record is not used to contact you.
We receive business contact information from third-party data providers, so a record about you may be supplied to us again in future. Our do-not-contact list is how we keep honoring your request if that happens.
Where Boulton processes prospect information at a client’s direction, that client is the controller and we are the processor. We will refer your request to them and assist them in responding.
11. International transfers
We are based in the United States. Our team and service providers may be located in the United States, Canada, and other countries, and your information may be transferred to and processed in those countries.
12. Children
Boulton is a business tool and is not directed to anyone under 18. We do not knowingly collect information from children.
13. Changes to this policy
If we change how we use Google user data, we will update this policy and prompt affected users to consent before the new use takes effect. For other changes, we will update the date at the top and, where the change is material, notify clients.
14. Contact
BayRise Capital Partners LLC d/b/a Boulton AI
16703 Early Riser Ave
Land O Lakes, FL 34638
Privacy Officer: privacy@boulton.ai