Last updated October 23, 2026
This Privacy Policy explains how Bolter ("Bolter", "we", "us"), operated by Improbable Worlds Limited, collects, uses, and shares information when you use the Bolter app and website. Bolter lets you create and chat with agents, which are AI-powered entities. By using Bolter you agree to this policy.
We use your information to provide and operate Bolter: to authenticate you, to power agents and generate their responses, to deliver messages and notifications, to process payments, and to keep the service secure and reliable. This includes monitoring, debugging, and troubleshooting the service, which may involve our staff accessing your content where needed to diagnose and fix problems, under confidentiality obligations and access controls.
If you opt in, we also send you occasional marketing emails about product updates and announcements. This is optional: you can opt in when you create your account or later in Settings, and you can opt out at any time in Settings or using the unsubscribe link in any of these emails. Emails we send to operate your account, such as sign-in codes and invitations, are not marketing emails and do not depend on this choice.
We do not train AI models on your content. We do not use your messages, prompts, uploaded files, call transcripts, data from accounts you connect, or the configuration and outputs of your agents to train AI models, and we do not send any of it to third parties who train on it without first asking your permission. While Bolter is in its alpha and beta phases, we use telemetry and data to help fix errors and improve the service, including the quality, routing, and safety of agents, but not to train models.
The data controller for your personal data is Improbable Worlds Limited. Where the GDPR or similar laws apply, we rely on the following legal bases to process your personal data:
Third-party AI providers. Bolter is an AI product. To generate the replies, summaries, embeddings, images, and search results that agents produce, we transmit your content to third-party AI providers that process it on our behalf solely to return those results to Bolter. The content sent can include your messages, prompts, uploaded files and images, and search queries. These providers are:
We share only the content needed to provide the feature you are using. We use these providers under their commercial and enterprise terms, which do not grant them the right to use your content to train their own models, and we require them to use your content only to provide Bolter features and not for their own purposes. We do not train AI models on your content ourselves, and we will not send your content to a third party that trains on it without first asking your permission. We ask for your explicit consent before sending your data to these providers, and you can withdraw it at any time in Settings under Legal and Privacy. Because agents depend on these providers, withdrawing consent means you can no longer use agent features until you consent again.
Other service providers. We also use trusted providers to run Bolter, including cloud hosting and infrastructure (Google Cloud), email delivery, product analytics, payment processing, and real-time audio and video calls. They process data only to perform services for us and under obligations of confidentiality. We do not sell your personal data.
Marketing email delivery (customer.io). Only if you have opted in to marketing emails, we share your email address, username, account identifier, and the fact that you opted in with customer.io, which sends those emails on our behalf from servers in the European Union. People who have not opted in are not shared with customer.io. When you withdraw consent, in Settings or through the unsubscribe link in any marketing email, we delete your profile there.
We advertise Bolter on Google, Meta, LinkedIn, X, Reddit and ChatGPT (OpenAI). On bolter.chat we use Google Tag Manager to load those platforms' tags, which use cookies to tell each platform when someone visits Bolter or signs up, whether or not they came from one of its ads. This lets us learn which ads work and lets the platforms measure them. The tags are not loaded in the Bolter mobile apps, or on pages whose address carries private information, such as shared links and search results.
When you first arrive from an ad, a campaign link or another website, we also record where you came from: the ad click identifier and campaign tags in the link, the first page you visited and the website that referred you. If you sign up, or join the waiting list, we store this with your account or your request so we can tell which campaigns bring people to Bolter. From our servers we also tell each of those platforms when you verify your email address to sign up, when you finish signing up, when you start a free trial (with the plan's price) and when you create your first agent, whether or not you came from one of its ads: we send your email address in hashed form, the IP address and browser of that request, the ad click identifier if you came from an ad, and the time, so each platform can match it to its ads. If you came from an ad, we also tell the platform whose ad it was when you click Sign up on our home page, or click Sign in or copy the setup line on our connect page (connect.bolter.chat), without your email address. We keep that IP address and browser only until the platform has received it. You can block advertising cookies in your browser settings or with the ad platforms' own controls.
We retain your account information and content for as long as your account is active or as needed to provide and improve the service and meet our legal obligations. Aggregated or de-identified data we derive from telemetry and diagnostics may persist after you delete the underlying content or close your account. Content sent to the third-party AI providers above is processed to generate results for the feature you are using; limited retention may apply on their side for security, abuse prevention, or legal compliance under their terms.
We use technical and organizational measures designed to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
Your information may be processed in countries other than your own, including by the providers described above. Where required, we put appropriate safeguards in place for these transfers.
Bolter is intended for adults aged 18 and over. It is not directed to anyone under 18, and we do not knowingly collect personal information from them. If we learn that we have collected personal information from someone under 18, we will delete it.
We may update this policy from time to time. When we make material changes to how we use or share your data for AI, and before we would ever use your content to train AI models or send it to a third party that trains on it, we will ask for your consent again before continuing.
The data controller for your personal data is Improbable Worlds Limited. Questions about this policy or your data? Contact us at privacy@bolter.chat.