Privacy Policy
Effective October 16, 2026.
This Privacy Policy explains how Boldo collects, uses, shares and protects personal data when a visitor or prospect browses the Boldo website, requests a demo or gets in touch with Boldo, when a Customer signs a contract with Boldo, and when Users use the Boldo platform.
This policy covers the personal data that Boldo processes as a controller. Boldo also processes data as a processor on behalf of the Customer: that processing is governed by a separate data processing agreement (DPA), available at trust.boldo.io.
1. Controller
Personal data is processed under the responsibility of BOLDO SAS. Boldo undertakes to process Users' personal data in accordance with applicable data protection law, in particular the General Data Protection Regulation (EU) 2016/679 of April 27, 2016 ("GDPR") and the French Data Protection Act No. 78-17 of January 6, 1978, as amended, together with any national and European provisions supplementing them (the "Regulations").
Capitalized terms are defined in Boldo's Terms of Service.
2. Purposes and legal bases
Personal data is processed for the following purposes:
- Managing User accounts and securing the Service;
- User support, audits, maintenance and improvement of the Service;
- Audience and usage measurement and statistics, to improve the website and the Service;
- Contract administration, invoicing and payment;
- Managing the business relationship with prospects and Customers and sending communications about the Service (handling demo and contact requests, sending information from Boldo, including commercial information such as service updates, newsletters, new offers, quotes and news).
This processing is based on (i) the performance of the contract, or of pre-contractual steps, with the Customer; (ii) Boldo's legitimate interests in honoring its contractual commitments to the Customer when processing Users' data, contacting prospects and Customers for sales and marketing purposes, improving its website and Service, and protecting its information systems; (iii) consent, for audience measurement and the cookies that require it; and (iv) legal obligations, in particular for accounting and tax record keeping or in response to requests from authorized third parties.
Users' personal data and Customer information are not used to train or improve the AI model or system that Boldo provides for the AI Features.
3. Categories of data and sources
To achieve these purposes, the following data is processed:
- Identification data, business contact details and professional information of Users, of the Customer's representative or of the Customer's employees involved in contracting (first and last name, email address, job title, company, phone number for Customers);
- Data relating to demos, website forms and information requests (tender generator, certification request, IT challenge, information provided when booking a demo or when a prospect gets in touch, and the content of exchanges with Boldo);
- Billing and payment data, depending on the payment method chosen by the Customer;
- Data relating to support requests;
- Usage data for the AI Features, including through External Tools: request volumes, and the AI model or system and provider used;
- Technical data (login credentials, IP address, device information, pages viewed, date and time of access, information about the use of the Service or interactions with the platform, metadata and logs relating to the Service, in particular to the AI Features, External Tools and the MCP (Model Context Protocol) interface);
- Proof of acceptance of the Terms of Service: date, version accepted and IP address at the time of acceptance.
The content of exchanges with the AI Features (messages, results, tool calls) is data that Boldo processes on behalf of the Customer: it is governed by the DPA, not by this Policy.
This data is provided by prospects, the Customer or its representative and Users, collected indirectly through cookies or other trackers on the Service, or derived from Users' use of the Service or of External Tools. Collection is limited to what is necessary for the purposes described above.
When a User's account is created by an administrator of their organization (invitation) or from their employer's directory (SSO sign-in), their first name, last name and email address are provided to us by that organization, not by the User. The User is informed of this in the invitation email or in the first email Boldo sends them.
4. Cookies and trackers
The boldo.io website and the app.boldo.io application use cookies and similar technologies. A consent banner lets you manage your preferences. The application's Google Ads tag loads according to the consent given on the website.
Strictly necessary cookies (always active)
| Name | Domain | Purpose | Duration |
|---|---|---|---|
cc_cookie | boldo.io | Stores your consent preferences | 6 months |
NEXT_LOCALE | www.boldo.io | Remembers the language you chose | 1 year |
| Session cookie | app.boldo.io | Keeps you signed in to the application | 7 days by default, adjustable by your organization |
The sign-up form on app.boldo.io uses Cloudflare Turnstile to block bots. This service processes, in particular, your IP address and technical characteristics of your browser.
Functional cookies (subject to consent)
| Name | Domain | Purpose | Duration |
|---|---|---|---|
boldo_visitor_id | www.boldo.io | Unique visitor identifier used to remember your preferences | 13 months |
Advertising and analytics cookies (subject to consent)
These cookies are set by Google (Google Ireland Limited) on Boldo's behalf. They are only written once you accept them.
| Name | Domain | Purpose | Duration |
|---|---|---|---|
_ga, _ga_* | boldo.io | Google Analytics: measures visits and page usage | 2 years |
_gcl_au | boldo.io | Google Ads: links a sign-up or form submission to one of our ads | 3 months |
_gcl_aw | boldo.io | Google Ads: identifies the ad you clicked, written only if you arrive from an ad | 90 days |
test_cookie | doubleclick.net | Google: checks that your browser accepts cookies | 15 minutes |
Audience measurement (subject to consent)
We measure website traffic with Umami, a cookieless tool that we host ourselves in France. It places no tracker on your device and does not identify you. These statistics are kept for up to 25 months. Umami only loads once you agree to it in the "Audience measurement" category of the banner.
Proof of your choices is kept for 3 years. You can change your preferences at any time by clicking "Manage cookies" at the bottom of every page. Until you accept, no advertising or analytics cookie is set, no data is sent to Google and no audience measurement takes place.
5. Data subjects and recipients
The data subjects are website visitors, prospects, the Customer (the purchaser of the Boldo Service, whether or not they have a user account) or, where the Customer is a legal entity, its representative, and the individuals under the Customer's responsibility who are involved in contracting or administering the contract, or who have a user account and access to the Service through the Customer's subscription or a free trial ("Users"). People who request or hold a Boldo certification are also data subjects.
To achieve the purposes described above, Boldo may share personal data, in accordance with the Regulations, with the following recipients:
- Boldo's internal sales, marketing, finance and IT teams;
- Processors or partners providing IT services (hosting);
- Processors providing security and bot protection services;
- Processors or recipients providing an AI model or system or an API, such as the AI assistants or agents provided by the Customer for the AI Features;
- Audience measurement and advertising providers;
- Where applicable, processors or partners providing online payment, accounting and invoicing services;
- Processors or partners providing email delivery, customer relationship management, prospecting and electronic signature services;
- Where relevant, legal advisers, statutory auditors, potential acquirers or investors in the context of mergers and acquisitions.
Finally, to meet its legal and regulatory obligations, Boldo may also share personal data with public bodies, judicial or administrative authorities and supervisory authorities.
Some of Boldo's partners may also collect information about Users in order to provide Boldo's services (for example, our online payment providers may collect your payment information and card number). For more information, please refer to their own privacy or data protection policies when you use these options.
6. Retention periods
| Data | Retention period |
|---|---|
| User account and proof of acceptance of the terms | Term of the contract, then 2 years |
| AI Features usage data | Up to 1 year; usage statistics are then kept without identifying the user |
| Support requests | 3 years after their last activity |
| Emails and notifications sent by the Service | Up to 1 year |
| Technical and sign-in logs | Up to 1 year |
| Audit logs and activity history | Up to 3 years |
| Sales and administrative data on prospects and the Customer or its representative, requests submitted through the website | 3 years after the end of the business relationship or the last contact |
| Certification requests | 1 year after they are processed; an issued certification remains viewable for as long as it can be verified |
| Billing data | 10 years (legal obligation) |
Erased data is removed from backups within 37 days at most. Content stored on the platform on the Customer's behalf is governed by the DPA, which sets its own retention periods.
7. Transfers outside the European Union
Data submitted by Users on the Service platform or generated through the use of the Service is not transferred outside the European Economic Area (EEA). Should a transfer outside the EEA become necessary, it would only be to comply with a specific requirement of EU or Member State law to which Boldo is subject, and it would rely on a valid transfer mechanism under Chapter V of the GDPR (an adequacy decision or the European Commission's standard contractual clauses).
Transfers outside the EEA may occur when a User chooses to use External Tools, such as connecting their own key to an AI provider, pointing to an endpoint hosted by the Customer outside the EEA, or connecting an external assistant located outside the EEA through MCP. That processing is then carried out under the responsibility of the Customer or of the provider of the External Tool.
For data relating to the website, sign-up, contract and business administration, payment and invoicing, recipients are mainly located in the European Union but may also be located outside it, in particular in the United States (Cloudflare, Inc., which protects the sign-up form). In that case, where the country does not benefit from a European Commission adequacy decision, we take the security measures and legal safeguards needed to ensure the security and integrity of the transferred personal data and an adequate level of protection under Chapter V of the GDPR, in particular through standard contractual clauses or the EU-U.S. Data Privacy Framework.
8. Your rights
If your personal data is processed, you have the right to access, rectify, erase and port your personal data, as well as the right to restrict and to object to its processing.
When you ask for your data to be erased, your account and the data that concerns only you are deleted: sign-in data, conversations with the AI assistant, personal workspace, notifications, emails and support requests. What you contributed to your organization's data (records, comments, history) is kept without your name or email address, and logs are kept without your email address, IP address or browser. Invoices are retained to meet legal obligations.
For any question or to exercise your rights, you can contact the controller at:
BOLDO SAS, 20 bis rue Louis-Philippe, 92200 Neuilly-sur-Seine, France
If you receive no reply within one month, or if you are not satisfied with the reply, you can also lodge a complaint with the CNIL, the French data protection authority.