This Privacy Policy explains what personal data BoltVeil collects when you use our website, your dashboard, the VPN and the residential proxies, why we collect it, who receives it and what rights you have.
In short: we keep what we need to run your account, take payments, run the rewards program and stop abuse. We do not keep records of the websites you visit, your DNS queries or the content of your traffic through the VPN. Our No-logs Policy lists exactly what we store and what we never store.
1. Who we are
BoltVeil is operated by SSWAP MEDIA LLC, a Wyoming limited liability company, 30 N Gould St Ste N, Sheridan, WY 82801, USA ("we", "us"). We are the controller of the personal data described in this policy. Contact: support@boltveil.com.
2. Data we collect
Your account
- Your name and email address.
- Your password, stored only as a one-way hash that we cannot read.
- Your language, the IP address you signed up from and the country we look up from it. The lookup uses a database kept on the servers that host our website; your IP address is not sent to anyone for it.
- A one-way keyed hash of the network you signed up from (the first three parts of an IPv4 address, or the first half of an IPv6 address). It cannot be turned back into your IP address; we use it only to stop invite rewards between accounts from the same network.
- Your invite code and, if a friend invited you, who invited you.
- If you arrived through a partner's link: the partner's name and the partner's click reference.
- Your two-factor authentication settings, if you turn them on.
Payments
- Card payments are handled by Stripe. We receive the plan, the amounts, the dates, the payment status, the card brand and its last four digits. We never see or store full card numbers.
- Crypto payments are handled by CCPayment. We keep the order, the amount paid, its status and the references the processor returns. Blockchain transactions are public by design.
Rewards
- Every Bolts movement: check-ins, spins, missions, invites, completed offers and redemptions for premium days, with the date and the amount.
- For completed offers, our offerwall partner sends us the offer name, the reward, the payout and a transaction reference, and tells us when an advertiser reverses a completion.
The VPN and the proxies
- The VPN account we create for you at our network partner: a random username that contains neither your name nor your email, a password and WireGuard keys (both stored encrypted), and whether the account is active.
- Configuration events: each time you download a VPN configuration on our website, or one of our apps fetches one to connect, we record the server, the protocol, which app or website was used, the time, the IP address used to reach our website or API, and your account country. We use these events to show your recent connections, run missions and prevent abuse. They say nothing about what you do while connected.
- Your proxy login (the password is stored encrypted) and the total amount of proxy traffic your account has used and has left, as reported by our proxy partner. We do not receive the addresses you visit through the proxy.
Linked devices
- For our browser extension and apps: the device name you choose, when the device last used our API and the IP address it used to reach it. Sign-in tokens are stored only as hashes, and device link codes expire after 10 minutes.
Website, support and security
- While you are signed in: a session record with your IP address and browser details, deleted when you sign out or the session expires.
- Technical logs of requests to our website and API, used to keep them running and secure.
- Messages you send to support.
We do not use advertising or third-party analytics trackers on our website.
3. What we never collect
We do not collect or store the websites you visit through the VPN, your DNS queries, the content of your traffic, or the times you connect to and disconnect from VPN servers. The No-logs Policy gives the details and explains how our network partner fits in.
4. Why we use your data
| Purpose | Data | Legal basis (EU and UK) |
|---|---|---|
| Create your account and provide the VPN and proxies | Account, VPN and proxy data | Performance of our contract with you |
| Take payments, issue receipts and handle refunds | Payment data | Contract; legal obligation for tax records |
| Run the rewards program, credit and reverse Bolts | Rewards ledger, offer data | Contract |
| Prevent fraud and abuse, such as multi-accounting, self-invites, payment fraud and breaches of the Acceptable Use Policy | Signup IP and country, configuration events, rewards ledger, linked devices | Our legitimate interest in protecting the service and its users |
| Credit the partner that sent you, if you arrived through a partner link | Click reference, amount of your first payment, your user number | Our legitimate interest in paying our marketing partners |
| Keep the service secure and working | Session data, technical logs | Legitimate interest |
| Send service emails: verification, receipts, reminders before premium time ends, security notices | Email address | Contract; legitimate interest |
We do not use your data for advertising and we do not sell it.
5. Automated checks
Some abuse checks run automatically. For example, free Bolts are capped each day, invite rewards are only paid when the invited friend pays or completes an offer and never between accounts from the same network, one mailbox can hold only one account, and unusual activity is highlighted for our team. Automated checks can flag free accounts, which pauses premium time earned with Bolts while the account is reviewed. Accounts of paying customers are only flagged, suspended or closed after a person has reviewed them. You can contest any decision by writing to support@boltveil.com.
6. Who receives your data
We share personal data only with the companies that help us run BoltVeil, and only what each one needs:
| Recipient | What they do for us | What they receive |
|---|---|---|
| VPN network partner | Operates the VPN servers under contract with us | Your random VPN username, credentials and keys, and whether your account is active |
| Residential proxy partner | Operates the proxy network | Your proxy login and traffic balance |
| Stripe | Card payments | What you enter at checkout |
| CCPayment | Crypto payments | The order amount and reference |
| Offerwall partner | Shows the offers in the Earn section and reports completed ones | Your BoltVeil user number, not your name or email. The offers load from the partner's own website, so it also sees your IP address and browser details, as any website you visit does |
| Marketing partners | Sent you to BoltVeil through a link | Their own click reference and the amount of your first payment; some partners also receive your BoltVeil user number |
| Hetzner Online GmbH | Hosts our website and database | The data stored on the servers that host our website |
| Email delivery provider | Sends our service emails | Your email address and the content of the email |
We will tell you the names of our current partners on request. When you open an offer, you deal directly with the advertiser, and its own privacy policy applies to what you give it.
We disclose data to authorities only when the law requires it, for example in response to a valid court order, and only data we actually hold. We cannot hand over browsing history that we do not keep.
7. International transfers
We are a US company, our website is hosted by Hetzner, and VPN servers are by their nature located in many countries. When we transfer personal data from the EU or the UK to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.
8. How long we keep data
- Account data, rewards ledger, VPN and proxy credentials and linked devices: while your account exists. When you delete your account in Settings, we delete them from our systems and close your VPN and proxy accounts at our partners (those contain no name or email).
- Configuration events: the IP address is erased after 7 days and the rest of the event after 90 days.
- The IP address you signed up from: 90 days. The country we derived from it and the network hash stay while your account exists.
- Deleted accounts: a one-way keyed hash of the email address, for one year, so that a re-created account does not receive the welcome gift again. It cannot be turned back into your email address.
- Payment records: as long as tax and accounting law requires, usually up to seven years, even after you delete your account.
- Sessions: until you sign out or the session expires.
- Technical logs: 14 days.
- Records of breaches of the Acceptable Use Policy: as long as needed to handle disputes and to stop the same person from returning.
9. Security
All connections to our website and API use TLS. Passwords are hashed; VPN and proxy passwords and WireGuard keys are stored encrypted; app sign-in tokens are stored only as hashes. Two-factor authentication is available for every account. Staff access is limited to the people who need it, and administrative actions are recorded.
10. Cookies
We use only the cookies the service needs:
| Cookie | Purpose | How long |
|---|---|---|
| Session cookie | Keeps you signed in and remembers your language | Until you sign out or it expires |
| XSRF-TOKEN | Protects forms against cross-site request forgery | Same as the session |
| bv_ref | Remembers the invite code from a friend's link | 30 days, removed at signup |
| bv_acq | Remembers which partner link brought you here | 30 days, removed at signup |
| sidebar_state | Remembers whether the dashboard menu is open | 7 days |
We do not use advertising or analytics cookies.
11. Your rights
Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it or send it to you in a portable format, and you can object to or restrict how we use it or withdraw consent you gave. You can delete your account at any time in Settings, and for anything else you can write to support@boltveil.com. We reply within 30 days. People in the EU and the UK can also complain to their data protection authority.
California residents: we do not sell personal information or share it for cross-context behavioural advertising, and we will not treat you differently for using your privacy rights.
12. Children
BoltVeil is not meant for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, tell us and we will delete it.
13. Changes
We will post changes here and update the date at the top of this page. We will announce material changes by email before they apply.