ShareBolt Logo ShareBolt
Launch Console
Legal · Privacy · Data Rights

Privacy Policy

How ShareBolt collects, uses, and protects your data — and your rights under GDPR and CCPA.

Effective Date: June 2026  ·  Company: ShareBolt  ·  Contact: sharebolt-hello@boreme.in

This Privacy Policy describes how ShareBolt ("we", "us", or "our") collects, uses, discloses, and safeguards information when you visit sharebolt.boreme.in or use our file sharing platform and related services (collectively, the "Service"). Please read this policy carefully. If you disagree with its terms, please discontinue use of the Service.

1. Information We Collect

1.1 Information You Provide Directly

  • Account data: Email address, display name, and password hash when you create an account.
  • Payment data: Subscription plan selection and billing details processed by Razorpay (see Section 5). We do not store full card numbers, CVVs, or bank account numbers.
  • Communications: Messages you send us via contact forms or email for support, sales, or security disclosures.

1.2 Information Collected Automatically

  • Usage data: Pages visited, features used, transfer metadata (file size bucket, timestamp, transfer ID), and session duration.
  • Device data: Browser type and version, operating system, IP address (truncated to /24 subnet for analytics), and referring URL.
  • Authentication logs: Sign-in timestamps and authentication provider (Google, Apple, email/password) stored in Firebase Auth.

1.3 File Content

ShareBolt is a zero-knowledge platform. Files you transfer are encrypted on your device using AES-256-GCM before upload. ShareBolt servers receive and store only ciphertext — we are architecturally incapable of reading the content of your files. Encryption keys are derived locally from your session and never transmitted to our servers. When you use Bring Your Own Storage (BYOS), encrypted ciphertext is written directly to your cloud bucket; ShareBolt never stores it at all.

2. How We Use Your Information

  • To create and manage your account and authenticate your identity.
  • To process subscription payments and manage your plan via Razorpay.
  • To provide, maintain, and improve the Service, including detecting and preventing abuse.
  • To generate immutable audit logs for your transfers (required for SOC2/HIPAA/GDPR compliance features).
  • To send transactional emails (account confirmation, payment receipts, security alerts). We do not send marketing emails without your explicit opt-in consent.
  • To respond to your support, sales, or security disclosure enquiries.
  • To comply with applicable law, legal process, or enforceable governmental requests.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or UK, we process your personal data under the following legal bases:

  • Contract performance: Processing necessary to provide the Service you have subscribed to (account management, payment processing, file transfer facilitation).
  • Legitimate interests: Security monitoring, fraud prevention, abuse detection, and service improvement — where these interests are not overridden by your rights.
  • Legal obligation: Where we are required to retain or disclose data by applicable law.
  • Consent: For optional marketing communications, where you have given explicit consent. You may withdraw consent at any time.

4. Cookies and Tracking Technologies

We use a minimal set of cookies strictly necessary for the Service to function:

  • Session cookies: Firebase Auth session tokens to keep you logged in. These expire when you sign out or after 30 days of inactivity.
  • Preference cookies: Stores your UI theme preference (dark/light mode). No personal data.

We do not use third-party advertising cookies, cross-site tracking pixels, or behavioural analytics tools (e.g. Google Analytics, Meta Pixel). If we add analytics in the future, this policy will be updated and your consent sought where required.

5. Third-Party Service Providers

5.1 Firebase (Google LLC)

We use Firebase Authentication and Firestore (provided by Google LLC) for user identity management and account data storage. Firebase Auth stores your email address, authentication method, and session tokens. Firestore stores your account profile (plan type, transfer quota usage, preferences). Data is stored in Google's infrastructure under Google's Firebase Data Processing Terms. Google acts as a data processor on our behalf.

5.2 Razorpay

Subscription billing is processed by Razorpay Software Private Limited, a PCI-DSS Level 1 certified payment gateway. When you subscribe to a paid plan, you are redirected to Razorpay's secure checkout environment. Razorpay collects and processes your payment details; ShareBolt receives only a subscription status token and masked payment method summary. Razorpay's Privacy Policy governs their processing of your payment data.

5.3 Stripe

For customers paying in USD, subscription billing is processed by Stripe, Inc., a PCI-DSS Level 1 certified global payment processor. Stripe collects and processes your payment details under their Privacy Policy. ShareBolt receives only a subscription status confirmation and masked payment method summary.

5.4 Cloud Storage Providers (BYOS)

If you connect your own storage (AWS S3, Cloudflare R2, Azure Blob Storage, or Google Cloud Storage), ShareBolt acts as a key-exchange coordinator. Encrypted ciphertext is written to your storage bucket directly. ShareBolt does not have access to your cloud provider credentials beyond the scoped presigned URL it generates per transfer. Your cloud provider's data processing terms apply to storage of the ciphertext.

6. Data Sharing and Disclosure

We do not sell your personal data. We do not share your personal data with third parties for their own marketing purposes. We may disclose information:

  • To our service providers (Firebase, Razorpay) as described above, who are contractually bound to process data only on our behalf.
  • If required by law, regulation, court order, or lawful request by a public authority. Because ShareBolt cannot decrypt your file content (zero-knowledge architecture), a legal demand for file content would yield only encrypted ciphertext.
  • In connection with a merger, acquisition, or sale of all or substantially all of our assets — in which case we will notify affected users before data is transferred and becomes subject to a different privacy policy.
  • To protect the rights, property, or safety of ShareBolt, our users, or the public as required or permitted by law.

7. Your Rights

7.1 GDPR Rights (EEA / UK Users)

If you are in the EEA or UK, you have the following rights under the General Data Protection Regulation (GDPR):

  • Right of access: Request a copy of the personal data we hold about you.
  • Right to rectification: Request correction of inaccurate personal data.
  • Right to erasure ("right to be forgotten"): Request deletion of your personal data, subject to legal retention obligations.
  • Right to data portability: Receive your personal data in a structured, machine-readable format.
  • Right to restrict processing: Request that we limit how we use your personal data.
  • Right to object: Object to processing based on legitimate interests.
  • Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email sharebolt-hello@boreme.in with the subject "GDPR Rights Request". We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

7.2 CCPA Rights (California Users)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following rights:

  • Right to know: Request disclosure of personal information collected, used, disclosed, or sold in the past 12 months.
  • Right to delete: Request deletion of personal information we have collected, subject to certain exceptions.
  • Right to opt out of sale: We do not sell personal information. No opt-out mechanism is required, but you may still contact us to confirm this.
  • Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, email sharebolt-hello@boreme.in with the subject "CCPA Rights Request".

8. Data Retention

  • Account data: Retained for the duration of your account and for 90 days after account deletion to allow recovery and resolve disputes.
  • Transfer audit logs: Retained for 7 years on paid plans (required for SOC2/HIPAA audit trails). Free tier logs are retained for 90 days.
  • Payment records: Razorpay retains payment records per their legal obligations. ShareBolt retains subscription status records for 7 years for tax and accounting compliance.
  • Support communications: Retained for 3 years from the date of the last communication.

9. International Data Transfers

ShareBolt's infrastructure is operated globally, including within the European Union, United States, and India. If we transfer your personal data outside your country of residence, we ensure appropriate safeguards are in place including Standard Contractual Clauses (SCCs) for EEA/UK transfers and Data Processing Agreements with all sub-processors. If you require data residency in a specific geographic region, the Enterprise Citadel plan supports configurable edge routing to restrict data processing to your chosen jurisdiction.

10. Children's Privacy

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without verifiable parental consent, we will take steps to delete that information promptly. If you believe we have inadvertently collected such information, please contact sharebolt-hello@boreme.in.

11. Security

We implement technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include: client-side AES-256-GCM encryption (zero-knowledge architecture), TLS 1.3 in transit, Firebase Auth industry-standard identity controls, and regular security audits. However, no method of transmission over the Internet or method of electronic storage is 100% secure. We encourage you to use a strong, unique password and enable additional authentication factors.

HIPAA

ShareBolt's zero-knowledge architecture means that files transferred through the Service are encrypted client-side before transmission; ShareBolt servers never receive plaintext file content. Enterprise customers subject to HIPAA may request a Business Associate Agreement (BAA) by contacting sharebolt-hello@boreme.in. Execution of a BAA is required before using ShareBolt to transfer Protected Health Information (PHI).

Data Processing Agreement (DPA)

Enterprise customers and customers subject to the GDPR may request a Data Processing Agreement (DPA) that satisfies Article 28 GDPR requirements. Contact sharebolt-hello@boreme.in to request a DPA. Standard Contractual Clauses (SCCs) are available for international data transfers from the European Economic Area.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the Service and, where required by law, by email to your registered address. The "Effective Date" at the top of this page indicates when this policy was last revised. Continued use of the Service after the effective date of a revised policy constitutes your acceptance of the revised terms.

13. Contact Us

For any privacy-related questions, requests, or concerns, please contact:

We aim to respond to all privacy-related enquiries within 5 business days.