Privacy Policy

Last updated: 10 August 2026

This Privacy Policy describes how BoltSuite, a Wyoming company (“BoltSuite,” “we,” “us,” or “our”), handles personal data in connection with PunchCardScan, a software-as-a-service platform available at punchcardscan.com and through the PunchCardScan app (the “Service”). The Service is intended for U.S.-based business customers. This policy should be read together with our Terms of Service and Data Processing Agreement.

1. Introduction & Overview

1.1 Policy Introduction. This Privacy Policy explains how BoltSuite, a Wyoming company (“BoltSuite,” “we,” “us,” or “our”), collects, uses, shares, and protects personal data in connection with the PunchCardScan service (the “Service”), available at punchcardscan.com and through the PunchCardScan app. It applies to account holders and authorized users of the Service (each, “you”).

1.2 Effective Date. This Privacy Policy is effective as of the date in the title above.

1.3 Scope of the Policy. This policy covers the PunchCardScan website, app, and related services. It does not cover third-party websites or services we do not control, even if linked from the Service.

1.4 How to Contact Us. Questions about this policy may be directed to privacy@punchcardscan.com or to our mailing address in Section 13 of this Privacy Policy.

2. Information We Collect

2.1 Information You Provide Directly. When you register, you provide your name, work email, company name, and billing information. You may also provide information through customer support requests or surveys.

2.2 Automatically Collected Data. We automatically collect log data, device and browser information, and IP address when you use the Service, for security, troubleshooting, and operational purposes.

2.3 Cookies & Tracking Technologies. We may use cookies, local storage, and similar technologies as described in our Cookie Policy.

2.4 Location Data. We may infer general, non-precise location from your IP address for security and fraud-prevention purposes. We do not collect GPS or precise device location.

2.5 Communications Data. We collect the content of support messages and other communications you send us through the Service.

2.6 Social Media Data. If you sign in using a third-party account, we receive the basic profile information necessary to create and authenticate your account.

2.7 User Content (Timesheet Data). We collect the timesheet card images you upload and the names, dates, hours, and (if entered) pay rates that our AI reads from them (“Timesheet Data”). Timesheet Data relates to your employees; your business is the controller of this data and BoltSuite acts as processor, as described in our Data Processing Agreement.

3. How We Use Your Information

3.1 To Provide and Operate the Service. We use your information to create and manage your account, scan and digitize timesheets, calculate hours, and provide customer support.

3.2 To Personalize Your Experience. We use account and usage information to remember your preferences and display relevant features within the Service.

3.3 To Communicate with You. We send transactional emails, service notifications, and account-related updates.

3.4 Marketing & Promotional Communications. With your consent where required, we may send newsletters or product updates. You can opt out at any time using the unsubscribe link or by contacting us.

3.5 Analytics & Performance Improvement. We use aggregated usage data to understand how the Service is used and to improve its features and performance.

3.6 Security & Fraud Prevention. We use account and device information to detect and prevent unauthorized access, fraud, and abuse of the Service.

3.7 Legal Compliance & Obligations. We use and disclose information as necessary to comply with applicable laws, regulations, subpoenas, or government requests.

3.8 Research & Development. We may use de-identified or aggregated data to improve our AI scanning accuracy and develop new features. We do not use your Timesheet Data to train third-party AI models beyond what is necessary to provide the scanning feature, consistent with our Data Processing Agreement.

3.9 Payment Processing. We use billing information to process subscription payments, generate invoices, and prevent payment fraud, through our third-party payment processors.

4. How We Share Your Information

4.1 Service Providers & Vendors. We share data with service providers (subprocessors) who help us operate the Service, including our AI provider, hosting provider, and billing platform, as listed in our Data Processing Agreement.

4.2 Business Partners. We do not currently share personal data with third-party business partners for their own marketing purposes.

4.3 Advertising & Analytics Partners. We may use analytics providers to understand Service usage, as described in our Cookie Policy. We do not use advertising trackers within the paid Service.

4.4 Legal Disclosures. We may disclose information where required by law, court order, or governmental request, or to protect the rights, property, or safety of BoltSuite, our customers, or others.

4.5 Business Transfers. If we are involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to this policy.

4.6 With Your Consent. We may share information with third parties when you direct or authorize us to do so.

4.7 Aggregated / De-Identified Data. We may share aggregated or de-identified data that cannot reasonably identify you or your employees for research, benchmarking, or analytics purposes.

4.8 Affiliated Companies. We may share information within BoltSuite's corporate family for the purposes described in this policy, subject to the same protections.

4.9 No Sale of Personal Data. BoltSuite does not sell personal data and has not sold personal data in the preceding twelve (12) months.

5. Cookies & Tracking

5.1 Types of Cookies Used. We use essential cookies required for the Service to function, and, where enabled, functional and analytics cookies, as described in our Cookie Policy.

5.2 Cookie Consent & Preferences. Where required by law, we present a cookie banner allowing you to accept, reject, or customize non-essential cookies.

5.3 Third-Party Cookies. Certain optional cookies are set by third-party analytics providers, as identified in our Cookie Policy.

5.4 Global Privacy Control. We honor applicable Global Privacy Control (GPC) signals. Where required by applicable law, a valid GPC signal will be treated as a request to opt out of the sale or sharing of your personal information or other applicable targeted advertising activities.

5.5 Cookie Duration & Expiry. Cookies we use are either session cookies, which expire when you close your browser, or persistent cookies, which remain for the durations listed in our Cookie Policy.

5.6 How to Opt Out of Cookies. You may manage or disable non-essential cookies through our cookie banner, your browser settings, or applicable third-party opt-out tools, as described in our Cookie Policy.

6. Data Retention

6.1 How Long We Keep Your Data. We retain account data while your account is active, and Timesheet Data until you delete it or close your account, as described in our Data Processing Agreement.

6.2 Criteria for Determining Retention. Retention periods are based on the purpose for which data was collected, our contractual and legal obligations, and legitimate business needs.

6.3 Data Deletion Upon Account Closure. Upon cancellation, your account enters read-only mode and data is retained for the period described in our Data Processing Agreement, after which it may be deleted. You may permanently delete your workspace data at any time.

6.4 Backup & Archival Data. Deleted data may persist temporarily in encrypted backups before being permanently purged in the ordinary course of our backup cycle.

6.5 Legal Hold Exceptions. We may retain data longer than our standard periods where necessary to comply with legal, tax, or regulatory obligations, or to resolve disputes.

7. Data Security

7.1 Security Measures Overview. We maintain administrative, technical, and physical safeguards designed to protect personal data, consistent with our Data Processing Agreement.

7.2 Encryption in Transit & at Rest. We use TLS/SSL encryption for data in transit and encrypt sensitive data at rest.

7.3 Access Controls & Authentication. We use role-based access controls, hashed password storage, and offer optional multi-factor authentication or passkeys to protect account access.

7.4 Data Breach Notification. In the event of a security incident affecting your personal data, we will notify you without undue delay and in accordance with applicable law.

7.5 No Absolute Security Disclaimer. No method of transmission or storage is completely secure. While we work to protect your data, we cannot guarantee absolute security.

8. Your Rights & Choices

8.1 Right to Access. You may request a copy of the personal data we hold about you.

8.2 Right to Correct / Rectify. You may request correction of inaccurate or incomplete personal data.

8.3 Right to Delete / Erasure. You may request deletion of your personal data, subject to legal retention requirements.

8.4 Right to Data Portability. You may request your personal data in a structured, commonly used, machine-readable format.

8.5 Right to Restrict Processing. You may request that we limit how we use your personal data in certain circumstances.

8.6 Right to Object to Processing. You may object to processing based on legitimate interests or for direct marketing purposes.

8.7 Right to Withdraw Consent. Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

8.8 Opt Out of Marketing. You may unsubscribe from marketing emails at any time using the link provided or by contacting us.

8.9 Opt-Out of Data Sale/Sharing. We use third-party advertising services, such as Google AdSense, which may be considered a "sale" or "sharing" of personal information under California law because these services use cookies and similar technologies to serve interest-based ads. You have the right to opt out of this sale/sharing by using the "Do Not Sell or Share My Personal Information" link in the Home page footer.

8.10 How to Submit a Request. Submit privacy requests to privacy@punchcardscan.com. We may need to verify your identity before fulfilling a request.

8.11 Response Timeframe. We will respond to verified requests within thirty (30) days, or as otherwise required by applicable law.

9. GDPR & International Compliance

9.1 Legal Basis for Processing. Where the GDPR or UK GDPR applies, we process personal data based on contract performance, legitimate interests, legal obligation, or consent, as applicable.

9.2 Data Controller Information. For Account Data, BoltSuite is the data controller. For Timesheet Data, your business is the data controller and BoltSuite acts as processor, as described in our Data Processing Agreement.

9.3 Data Protection Officer (DPO). Privacy inquiries, including requests to reach our Data Protection Officer where one is appointed, may be directed to privacy@punchcardscan.com.

9.4 International Data Transfers. Where personal data originating in the European Economic Area, the United Kingdom, or Switzerland is transferred to the United States, we rely on the Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, as described in our Data Processing Agreement.

9.5 Right to Lodge a Complaint. If you are located in the EEA or UK, you have the right to lodge a complaint with your local data protection supervisory authority.

9.6 Automated Decision-Making. Our AI reads and digitizes timesheet data but does not make decisions that produce legal or similarly significant effects about individuals without human review; you are responsible for reviewing and confirming AI-generated output before use.

10. CCPA / US State Privacy Laws

10.1 CCPA Rights Disclosure. California residents have rights under the CCPA/CPRA, including the rights described in Section 8 above.

10.2 Categories of Personal Info Collected. We collect identifiers (name, email, IP address), commercial information (billing and subscription details), internet activity (usage and device data), and, where applicable to Timesheet Data, employment-related information, as described in Section 2.

10.3 Business Purposes for Collection. We collect this information for the business purposes described in Section 3, including providing the Service, security, and billing.

10.4 Do Not Sell or Share (Opt-Out). We use third-party advertising services, such as Google AdSense, which may be considered a "sale" or "sharing" of personal information under California law because these services use cookies and similar technologies to serve interest-based ads. You have the right to opt out of this sale/sharing by using the "Do Not Sell or Share My Personal Information" link in the Home page footer.

10.5 Non-Discrimination Clause. We will not deny goods or services, charge different prices, or provide a different level of service because you exercised your privacy rights.

10.6 Virginia VCDPA / Colorado CPA. Residents of Virginia and Colorado have similar rights to access, correct, delete, and port their personal data, and may appeal a denied request by contacting us as described in Section 8.

10.7 Connecticut / Utah Privacy Rights. Residents of Connecticut, Utah, and other states with comparable privacy laws may exercise the applicable rights described in Section 8 by contacting privacy@punchcardscan.com.

11. Third-Party Services & Links

11.1 Third-Party Links Disclaimer. The Service may contain links to third-party websites. We are not responsible for the privacy practices of those third parties, and encourage you to review their policies.

11.2 Analytics Providers. We may use analytics tools such as Google Analytics to understand how the Service is used, as described in our Cookie Policy.

11.3 Payment Processors. Payments are processed by Stripe and PayPal, which have their own privacy policies governing the payment information they collect.

11.4 Cloud & Infrastructure Providers. We use cloud hosting providers to store Service data, as described in our Data Processing Agreement.

12. Policy Changes & Updates

12.1 Right to Update the Policy. We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law.

12.2 Notification of Material Changes. We will notify you of material changes by email or in-app notice at least fourteen (14) days before they take effect.

12.3 Continued Use as Acceptance. Your continued use of the Service after the effective date of an updated policy constitutes acceptance of the changes.

13. General / Miscellaneous

13.1 Entire Privacy Agreement. This Privacy Policy supersedes all prior privacy statements regarding the Service.

13.2 Conflict with Terms of Service. If there is a conflict between this Privacy Policy and our Terms of Service regarding the handling of personal data, this Privacy Policy governs.

13.3 Severability. If any provision of this policy is held invalid or unenforceable, the remaining provisions remain in full force and effect.

13.4 Governing Law. This Privacy Policy is governed by the laws of the State of Oregon, without regard to conflict-of-law principles.

13.5 Contact / Complaints Process. Questions or complaints about this policy may be directed to privacy@punchcardscan.com

or addressed to:

[mailing address — to be completed]