Privacy Policy

1. Who we are and what this policy covers

ProfileBolt is a public-source research service operated by SmartApz (“we”, “us”, “our”). This Privacy Policy explains how we collect, use, share and protect personal information in connection with profilebolt.com and the ProfileBolt service (the “Service”), and the choices and rights available to you.

It covers two groups of people:

• Users and visitors — people who visit our website, create an account, or contact us; and
• People who appear in research results — individuals whose publicly available information is retrieved when a user researches them.

For the purposes of the EU and UK General Data Protection Regulation (“GDPR”), SmartApz is the controller of account data and of the research records stored in the Service. A customer organization that uses ProfileBolt is separately responsible for its own purposes in researching a person and for any use it makes of the results outside the Service.

2. Information we collect from users

• Account and organization data: your name, email address, organization name, role and team membership, and a salted hash of your password. We never store your password itself.
• Consents and acknowledgements: the date you accepted the Terms of Service and Privacy Policy and confirmed the responsible-use certification, and the version you accepted.
• Sign-in sessions: a record of each signed-in session (a hashed session identifier and its expiry) so that sessions can be ended when you log out or change your password.
• Searches and research records: the text you enter in a search, the candidate you choose to research, the source records retrieved for that candidate, the generated summary and match confidence, whether the record was saved, and comments added by your team.
• Usage counts: the number of searches your organization has used in the current period, used to apply plan allowances.
• Messages and requests: what you send us through the contact form, the removal request form or by email, including your name, email address and the details you provide.
• Technical data: standard web-server logs (IP address, date and time, page or resource requested, response status, referring page and browser user-agent) and short-lived, in-memory counters of attempts per IP address and account that we use to prevent abuse.
• Data stored on your device: one essential sign-in cookie and, if you use the Settings page, display preferences saved in your browser’s local storage. See the Cookie Policy.

We do not collect payment card details; paid plans are not yet available. We do not use analytics, advertising or social-media tracking tools on profilebolt.com.

3. Information about people in research results

ProfileBolt does not maintain a public directory of people, does not publish profile pages, and its research results are not visible to search engines or to the public. Information about a person is retrieved from public sources only when a signed-in user searches for them, and a research record is stored only in the workspace of the organization that ran the research.

Depending on what the sources publish, a research record may include: a person’s name and publicly listed aliases or usernames; a short public description or biography (for example a Wikipedia summary); a public profile image link; job title, employer, organization or location as stated by the source; links to public profiles and websites; public identifiers listed by the source (such as an ORCID iD or a Wikidata item); and public activity statistics (for example public code repositories, followers or community reputation). Every item is linked to the source page it came from.

We do not seek to collect sensitive information such as health, religious or political beliefs, sexual orientation, racial or ethnic origin, financial account details, government identification numbers or precise location. A public source may nevertheless mention such information; users may not use the Service to infer or act on it (see the Acceptable Use Policy).

Research records may also list possible social-media profiles (for example on Facebook, Instagram, LinkedIn, TikTok or X) taken from public search-engine results: the title, snippet, link and thumbnail the search engine displays. ProfileBolt does not visit, log in to or scrape those social-media pages. For a profile link that a user pastes or chooses to research, we may read the public link-preview information the page publishes for sharing (title, description and image).

The sources we use are described on the Data sources & accuracy page. We do not purchase personal information from data brokers, do not access non-public or login-only content, and do not bypass access controls.

4. How we use information and our legal bases

We use personal information to:

• provide the Service: run searches, retrieve and display public-source records, keep your organization’s research library, and apply plan allowances (legal basis under GDPR: performance of our contract with you);
• secure the Service, prevent fraud and abuse, enforce our Terms and Acceptable Use Policy, and protect the people who appear in results (legitimate interests, and where applicable legal obligation);
• support the research purposes of our users, such as journalism, due diligence and meeting preparation, which involve retrieving publicly available information about individuals (legitimate interests of our users and of SmartApz, balanced against the rights of the people concerned, including through the opt-out and removal process described below);
• respond to your messages, support requests and privacy requests, and send service emails such as password-reset links (contract, legitimate interests and legal obligation);
• comply with the law, respond to lawful requests from authorities, and establish, exercise or defend legal claims (legal obligation and legitimate interests).

We do not sell personal information, do not “share” it for cross-context behavioural advertising, do not use it for advertising, and do not use it to make decisions that produce legal or similarly significant effects about anyone.

5. How information is shared

• Within your organization: research records, saved profiles and comments are visible to members of the organization that created them.
• Public data sources and search providers: to run a search, the search text you enter (or the selected candidate’s name or identifier, together with any city, employer or school you added) is sent to the public sources and the web search API provider described on the Data sources page. We do not send them your account details.
• Service providers: we use a cloud hosting provider (servers located in the United States) to run the website and database, an email forwarding provider for messages sent to our @profilebolt.com addresses, and an email delivery provider for password-reset, team-invitation and other service emails, and to forward the requests and messages you send us to our support team. They process information only on our behalf and under appropriate contractual terms.
• Legal and safety: we may disclose information when we believe in good faith that it is required by law or legal process, or necessary to protect the rights, property or safety of any person, or to investigate misuse of the Service.
• Business transfers: if SmartApz is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, subject to this policy.

Content loaded from source websites. Some results display images hosted by the original source or by a search engine (for example Wikimedia, GitHub or Google). Your browser loads these directly from that site, which therefore receives your IP address and browser information under its own privacy policy.

6. International transfers

Our servers are located in the United States, and we and our service providers may process information in other countries. These countries may have data-protection laws that differ from those where you live. Where the law requires it, we take steps to ensure that personal information transferred internationally is protected in line with this policy and applicable law.

7. Data retention

• Account data: kept while your account is open. When an account or organization is closed at your request, we delete its account data and research records within 30 days, except where we must keep limited information to comply with the law, resolve disputes or enforce our agreements.
• Research records and comments: kept until the organization deletes them or closes its account. The user who ran a search, or an organization administrator, can delete a record at any time from Saved profiles.
• Sign-in sessions: expire after 7 days or when you log out; changing your password ends all earlier sessions.
• Password-reset links: expire one hour after they are issued and can be used only once.
• Web-server logs: rotated daily and deleted after 14 days. Abuse-prevention counters are held in memory only, for minutes.
• Contact, removal and privacy requests: kept for as long as needed to handle the request and then for up to 24 months to document how it was handled, as some privacy laws require.
• Information about a person who has opted out: deleted from stored research records; we keep only the minimum needed to honour the request.

8. Security

We use reasonable technical and organizational measures designed to protect personal information, including:

• HTTPS (TLS) encryption for all traffic between your browser and profilebolt.com;
• passwords stored only as salted PBKDF2-SHA256 hashes with 210,000 iterations;
• signed, HttpOnly session cookies backed by server-side session records that can be revoked, and ended automatically when a password changes;
• rate limiting and a challenge question on sign-in, signup, password-reset and public forms;
• access to research records limited to the organization that created them, enforced on every request;
• a database that accepts connections only from the application server itself and is not reachable from the internet.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe you have found a security issue, please email info@profilebolt.com. If a breach affecting your personal information occurs, we will notify you and the authorities where the law requires.

9. Your choices and rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, to opt out of the sale or sharing of personal information, and to appeal our decision on a request. People who appear in research results can ask us to remove or correct information about them at any time, wherever they live.

The Your privacy rights & opt-out page explains these rights in detail, including how to make a request, how we verify it and how quickly we respond. You can make a request through the removal request form or by emailing privacy@profilebolt.com.

10. Additional information for the EEA, UK and Switzerland

If the GDPR or the UK GDPR applies, you have the right to: access your personal information; have it corrected; have it erased; restrict its processing; object to processing based on legitimate interests (including the processing of information about people in research results); receive your information in a portable format; and withdraw consent where processing is based on consent. We respond within one month, which may be extended by up to two further months for complex requests, in which case we will tell you why.

Where we process information about people in research results, we rely on legitimate interests. That information was not obtained from the people concerned; it comes from the public sources listed on our Data sources page. You have the right to object at any time, and we will stop processing your information unless we have compelling legitimate grounds or need it for legal claims.

You also have the right to lodge a complaint with your local data-protection supervisory authority (in the UK, the Information Commissioner’s Office). We would appreciate the chance to address your concern first at privacy@profilebolt.com.

11. Additional information for California and other U.S. states

This section supplements this policy for residents of California under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), and for residents of other U.S. states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Utah, Texas and Oregon).

Categories collected in the last 12 months: identifiers (such as name, email address, IP address and online usernames); professional or employment-related information published in public sources; internet or other electronic network activity (server logs and searches you run); and inferences in the limited form of a match confidence score that estimates whether records refer to the same person. We do not collect sensitive personal information for the purpose of inferring characteristics about anyone.

Sources: you directly; your device and browser; and publicly available sources described on the Data sources page. Purposes: those described in “How we use information”. Disclosures for a business purpose: to service providers (hosting and email) and to members of the user’s own organization, as described above.

No sale or sharing. We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16. We treat a Global Privacy Control signal as a valid request to opt out of sale and sharing.

Your rights: the right to know what personal information we collect, use and disclose; to access and receive a copy; to delete; to correct; to opt out of sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. Residents of some states also have the right to appeal a denied request. See Your privacy rights for how to exercise these rights and our response times.

12. Additional information for Israel

If the Israeli Protection of Privacy Law, 5741-1981, and its regulations apply to you, you have the right to review information about you held in our database and to ask that it be corrected or deleted if it is inaccurate, incomplete, unclear or out of date. Requests can be sent to privacy@profilebolt.com.

13. Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal information from children. Users may not use ProfileBolt to research minors. If you believe a child’s information is in our Service, or that a child has created an account, please contact privacy@profilebolt.com or use the removal request form, and we will delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top shows when it last changed. If we make material changes, we will notify users by email or by a notice in the Service before the changes take effect.

15. Contact us

ProfileBolt is operated by SmartApz. For privacy questions or requests, email privacy@profilebolt.com. People who appear in results can also use the removal request form. For other questions, email info@profilebolt.com or use the contact form.