What we collect, and what we never do.

Who we are

GateBolt is operated by Super Layzer Limited, which is the data controller for the information described here.

What GateBolt collects

Account

Your name and email. If you sign in with GitHub, the profile GitHub returns.

Sessions

An IP address and browser user-agent string, stored against the session.

Agent runs

Per run: the repository and branch, the task the agent was given, the agent's vendor, name, model and version, who launched it, and an API key reference.

File metadata

Paths, the action taken on each (added, modified, deleted, renamed), line counts, and the reconciliation verdict.

Code

Besides file paths and line counts, Code sends the task, the branch, the repository's name, the model's name, and the machine's name on its key.

Stopped edits

Per stopped edit: the file path and the reason.

Gateway sessions

Per session: the key used, which tools ran, file paths, sizes, timing, cost, the declared plan, the Claude Code version, and the account and device ids Claude Code sends.

What it never collects

• ✓Code never sends file contents. The CLI derives everything from git locally and posts only metadata.
• ✓Gateway stores no prompt or reply text. A declared plan is stored in full, including its commands.
• ✓Analytics, tracking pixels or third-party scripts. There are none in the product.
• ✓Your data sold or shared for advertising.

Why we hold it

To show you what your agents changed, to score declared scope against the real diff, and to keep a tamper-evident record you can hand to someone else. The record is the product; there is no secondary use.

How long we keep it

During the beta, ledger events and change records are kept until you delete your workspace. When plan retention takes effect — 7 days on the Free plan — we will tell you beforehand, so you have time to export what you need. Enterprise retention is set by your agreement. Deleting your workspace deletes its records outright, and you can export them as JSON or CSV from any branch page in Code at any time. The same history limits apply to Gateway sessions.

Records that outlive an account

A tamper-evident record has to survive the credential that wrote it, so revoking an API key or deleting a user does not remove the change records they produced. Those records retain the launching user's identifier. If you need that personal data erased rather than the whole workspace deleted, email us and we will handle it directly.

Sub-processors

GateBolt runs on third-party hosting and database infrastructure, and uses GitHub for optional sign-in. The hosted gateway runs on third-party infrastructure as well. A current list is available on request.

Your rights

You can request a copy of your data, ask for it to be corrected, or ask for it to be deleted. Email hello@gatebolt.com and a person — not a ticketing system — will answer.

Changes

If this policy changes in a way that affects what we collect, we will say so here and update the date at the top.