Bolt (StackBlitz) procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | medium | “ Enterprise customers should note that customer data processing is governed by applicable DPAs rather than solely by this Privacy Policy.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ It does not apply to personal data processed by our customers within applications they build or deploy using Bolt, which is governed by applicable customer agreements and data processing addenda (“DPA”), where applicable.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ Bolt is headquartered in the United States, and personal information may be transferred to, processed, and stored in countries outside of your jurisdiction, including the United States.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Where required by law, we rely on appropriate safeguards for such transfers, such as standard contractual clauses approved by relevant authorities or other lawful transfer mechanisms.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ Backups and Residual Copies. Residual copies of personal information and user content may persist in backups, logs, or archival systems for a limited period following deletion or account termination. Such data will not be used for active processing except as necessary for security, fraud prevention, or legal compliance.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Voluntary Account Closure. When an account is voluntarily closed, the account and associated data enter an inactive or expired state. We will delete or anonymize such data within a commercially reasonable period following account closure not to exceed thirty days, subject to backup retention, legal obligations, and security requirements.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ Users may request deletion of personal information by contacting us. Data deletion requests are handled in accordance with internal access controls and data management procedures. Retention periods are determined based on the nature of the data, the purposes for which it is processed, and applicable legal requirements.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ Account Suspension. If an account is suspended (for example, due to non-payment or other account-related issues), associated data may be retained during a limited grace period to allow for potential account reinstatement. During this period, data may be inaccessible until the account is restored to good standing.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We retain personal information and user content for as long as necessary to provide the Services, support active accounts, comply with legal obligations, resolve disputes, and enforce our agreements. Active Accounts. Personal information and user content associated with an account are retained while the account remains active.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Storage: Files are stored in connection with your account and associated projects. Data retention practices for such files are described in the Data Retention section below.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may disclose information if required by law or in connection with a merger, acquisition, or sale of assets.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Subprocessors: File storage and processing may involve trusted subprocessors, including cloud infrastructure providers and AI service providers that support the operation of AI features. A current list of subprocessors may be found here.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Bolt relies on third-party AI service providers to deliver certain AI Features. These providers process AI Inputs solely to provide services to Bolt and are subject to contractual confidentiality and data protection obligations.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We share information with trusted service providers who perform services on our behalf, including hosting, analytics, billing, customer support, and AI processing. These providers are authorized to process information only as necessary to provide services to Bolt.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Bolt does not sell personal information as defined under the CCPA. However, we may share limited identifiers or device information with advertising or analytics partners to support marketing or promotional campaigns. Where required by law, users may opt out of such sharing.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ AI Processing: When you explicitly attach files to an AI prompt, relevant portions of those files may be transmitted to third-party AI service providers solely to generate responses. These providers do not receive ongoing or independent access to your files and retain such inputs only for limited periods.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ This section outlines specific privileges granted to customers who maintain active paid subscriptions to our commercial plans (including StackBlitz Teams or Enterprise Software as a Service (SaaS) plans). These privileges are valid for the duration of the active commercial license and are revoked upon license expiry or termination.” | Captured 2026-06-08Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.