Your data, handled with care.

BoldBellows is a trading name of Sunglasses Cent LLC, a Delaware limited liability company (“BoldBellows”, “we”, “us”). We build and maintain business automations for clients around the world. This policy applies to visitors to boldbellows.com, people who contact us or request a quote, and clients who order services.

When we process personal data inside a client’s own systems while delivering a project, we usually act as a processor for that client. Our commitments in that role are set out in the data processing agreement. This policy covers the data we handle for our own purposes.

We do not accept passwords, API keys or card numbers through any form, message or email. Login details and keys go only through your secure customer dashboard at boldbellows.com/customer-dashboard. See security and access practices.

• Respond to messages, questions and requests, including reply emails.
• Quote and deliver the work you ask for, including planning access and testing.
• Take payment and keep records through our payment providers (Stripe and PayPal) and our accounting tools.
• Protect the site and forms from spam, abuse and attacks, using honeypot fields, timing checks, rate limits and signed tokens.
• Improve our pages and guides using aggregate, non-advertising analytics.
• Meet legal obligations, such as tax records and responding to lawful requests.

We do not use personal data to build advertising profiles, we do not sell it, and we do not use client data or project files to train artificial intelligence models.

We share personal data only as needed to operate, and only with providers who are bound to protect it:

• Payment processing: Stripe and PayPal, which collect and process payment details under their own privacy policies.
• Email and hosting: the providers that host this website and deliver our email.
• Live chat and analytics: the providers that run the chat widget and site measurement.
• Project tools: the systems we use to manage client work, which are access-controlled.
• Professional advisers: accountants and lawyers, under confidentiality.
• Authorities: when we are legally required to, or to protect rights and safety.

We do not sell personal information and we do not share it for cross-context behavioral advertising. If a provider changes in a way that affects your data, we will update this page.

Our company is based in the United States and our clients are located worldwide, so personal data may be processed in the United States and in other countries where our providers operate. Where we transfer personal data from the EEA, UK or Switzerland to a country without an adequacy decision, we rely on approved safeguards such as the European Commission’s Standard Contractual Clauses and the UK addendum, and on our providers’ own transfer mechanisms.

We may keep limited information for longer when needed to resolve a dispute, enforce an agreement or meet a legal obligation.

We protect personal data with encrypted connections, access limited to the people who need it, layered protections on our forms, deletion schedules and an incident-response process. Details are on the security and access practices page. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we will notify affected people and regulators where the law requires it.

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data;
• delete your data, unless we must keep it by law;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent you have given;
• not be discriminated against for exercising a privacy right;
• lodge a complaint with your local data protection authority.

To make a request, use the contact form and choose ‘Privacy or data request’. We may ask for details that let us confirm it is you, and we answer within 30 days (45 days where California law allows an extension). If you use an authorized agent, tell us in the request. We will not charge a fee unless a request is clearly excessive.

In the past 12 months we have not sold personal information or shared it for cross-context behavioral advertising, and we do not knowingly sell or share the personal information of anyone under 16. We collect the categories listed in section 2, for the business purposes in section 3. We treat a Global Privacy Control signal as an opt-out request, although there is nothing to opt out of in practice. Residents of California, Colorado, Connecticut, Virginia, Utah and other states with similar laws can use the rights in section 9.

Our services and website are directed to businesses and working professionals. We do not knowingly collect personal data from children under 16. If you believe a child has sent us personal data, tell us through the contact form and we will delete it.

We do not use advertising or cross-site tracking cookies. What the site and its chat widget store in your browser is described in the cookie policy.

We do not make decisions that have legal or similarly significant effects on you by automated means alone. Our forms use automated checks, such as hidden fields, timing, rate limits and token validation, only to block automated abuse. A person reviews every genuine message.

We may update this policy as our services, providers or the law change. The current version is always the one on this page. If a change materially affects how we use personal data you have already given us, we will take reasonable steps to tell you.

For any privacy question, use the contact form and choose ‘Privacy or data request’. If you are not satisfied with our answer, you have the right to complain to your local supervisory authority, such as the Information Commissioner’s Office in the United Kingdom or your national data protection authority in the European Economic Area.