Privacy Policy
Last updated: September 30, 2026
This Privacy Policy explains how Balances, Inc., a Delaware corporation ("Balances", "we", "us", or "our"), collects, uses, and shares personal information when you use our website at www.balances.ai (the "Website"), our web application at app.balances.ai, our iPhone app, and our other services, including text messaging and integrations with AI assistants (together, the "Service"). It also explains your choices and rights.
Our Role
For information about you as an account holder or website visitor (your name, email, login details, usage, and billing), Balances decides how that information is used and is responsible for it (a "controller" or "business" under privacy laws).
Your accounting records often include information about other people, such as your customers, vendors, contractors, and employees ("Customer Data"). We process Customer Data on your behalf and under your instructions to provide the Service (a "processor" or "service provider"). You are responsible for having the right to put that information into Balances. If you need a data processing agreement, contact us at [email protected].
Information We Collect
Information you give us
Account information: name, email address, password or passkey, business name and address, and phone number if you provide one.
Financial and accounting data: transactions, invoices, bills, receipts, and other documents you upload, create, or email to us; general ledger entries and account balances; tax information you enter; and information about your business's customers, vendors, and employees.
Messages: what you send to the Balances assistant in the app, by email, or by text message, and what you send our support team.
Information from services you connect
When you connect a bank or card through Plaid, we receive account details, balances, and transaction history. Plaid handles your bank credentials directly; Balances never sees or stores them. When you connect other services (see "Services You Choose to Connect" below), we receive the information you authorize them to share.
Bank account and card information is "sensitive personal information" under some US state laws. We use it only to provide the Service you asked for, and not to infer characteristics about you.
Information collected automatically
When you use the Service we collect usage and device information, such as IP address, browser and device type, pages and features used, dates and times, and diagnostic and error data. On our Website, analytics depends on where you are; see the Cookies Policy and "Analytics and Cookies" below.
How you found us
When you create an account, we record how you arrived at our Website during that visit: the referring website (its domain only, for example a search engine), any campaign tags in the link you followed (such as utm_source, utm_medium, utm_campaign, utm_term, utm_content), and the first page you landed on. Our Website keeps these in your browser for that session only and passes them to our app when you sign up. We collect them ourselves, use them only to understand how customers find us, and do not share them with advertising networks.
iPhone app
If you use our iPhone app, it may access your camera and photo library when you choose to capture or attach a receipt, and it uses Face ID only to unlock the app (Face ID data stays on your device and is never sent to us). If you allow notifications, we store a push notification token for your device. The app sends product analytics and crash reports to Mixpanel and Sentry. It does not track you across other companies' apps or websites.
How We Use Information
To provide the Service: import and categorize transactions, keep your books, produce reports, send invoices, answer your questions, and carry out the tasks you ask the assistant to do.
To secure the Service, prevent fraud and abuse, and debug and fix problems.
To communicate with you about your account, including service notices, security alerts, and replies to your messages. Where you have signed up to use Balances by text message, we reply to your texts. We do not send marketing text messages.
To send product updates and marketing email, which you can unsubscribe from at any time.
To understand how the Service is used and to improve it.
To comply with law and enforce our Terms.
AI and Your Data
Balances uses AI models to categorize transactions, read documents, and power the assistant. To do that, the relevant parts of your data are sent to our AI providers, Anthropic and OpenAI, which process it for us under their commercial terms. Those terms do not allow them to use your data to train their models. They may retain inputs and outputs for a limited period for trust and safety purposes.
Your data personalizes suggestions only within your own workspace: for example, learning how you have categorized similar transactions before. One customer's data is never used to make suggestions in another customer's workspace.
AI-generated outputs can be wrong. Review them before relying on them for tax, accounting, financial, or legal decisions.
How We Share Information
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share it only as follows.
Service providers (sub-processors)
These companies process data on our behalf, only to help us run the Service, under contracts that limit their use of it. As of the date above:
Amazon Web Services — file and document storage (United States).
Render — application hosting, databases, and background processing (United States).
Cloudflare — website hosting, content delivery, and network security.
Plaid — bank and credit card connections and transaction import.
Stripe — subscription billing, and online invoice payments where you enable them.
Anthropic — AI model inference for the assistant, categorization, and document reading.
OpenAI — text embeddings of transaction descriptions, used to find similar transactions in your account.
Mailgun — sending email, and receiving receipts and documents you email to Balances.
Linq — delivering messages when you use Balances by text message (SMS, RCS, or iMessage).
Expo — delivering push notifications and app updates to the iPhone app.
Mixpanel — product analytics, and session recording where you have opted in.
Sentry — error monitoring, and session replay where you have opted in.
Honeycomb — performance and reliability monitoring.
LaunchDarkly — feature rollout (receives your account email and identifiers).
Slack — internal notifications to our team (for example, account name and email on signup or deletion).
Cal.com — scheduling calls you book with our team.
We will update this list when we add or replace a provider.
Services you choose to connect
When you connect Balances to another service, we share data with it at your direction, and its own terms and privacy policy govern what it does with that data. This includes your bank through Plaid (see Plaid's End User Privacy Policy), your Stripe account for invoice payments, sign-in with Google, accounting and field-service tools you import from or sync with (such as QuickBooks, JobTread, or Jobber), Zapier and webhooks, and AI assistants you connect to your workspace (such as Claude, ChatGPT, or other tools that use our MCP connector). An AI assistant you connect can read and act on your workspace data within the permissions you grant it.
Gmail
If you connect a Gmail account, our mail service automatically checks your messages to find receipts, invoices, and bills, and only those messages are added to your books. Balances' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Gmail data for advertising, do not sell it, do not use it to train AI models, and do not allow people to read it except with your permission, for security, or to comply with law. You can disconnect Gmail at any time.
Other sharing
Within your workspace, with the people you invite, according to the roles you give them.
With your accountant, bookkeeper, or firm if you give them access.
If required by law, legal process, or to protect the rights, safety, and security of our users, the public, or Balances.
As part of a merger, acquisition, financing, or sale of assets, subject to this policy.
Analytics and Cookies
On our Website, visitors in the United States and in Canada outside Quebec get first-party analytics (Mixpanel page views and interactions) by default and can opt out at any time. Everywhere else, including the EU, EEA, UK, Switzerland, Quebec, and wherever we cannot determine your location, analytics runs only after you opt in. Session recording (Mixpanel and Sentry) runs only after you opt in, everywhere, with on-screen text masked. If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out in every region, and it takes priority over an earlier choice. You can change your choice at any time with the "Cookie Settings" link in our Website footer. Details are in our Cookies Policy.
In the web app, we use Mixpanel for product analytics and honor the same analytics choice you made on our Website. Our servers and the iPhone app also send product usage events to Mixpanel. We do not use advertising networks or ad tracking.
Security
We protect your information with measures including encryption in transit and at rest, access controls, and monitoring. No system is perfectly secure, and we cannot guarantee absolute security. If we learn of a security incident affecting your personal information, we will notify you as required by law.
Where We Process Data
We are based in the United States and store and process data there. If you use the Service from outside the United States, your information will be transferred to the United States. Where the GDPR or UK GDPR applies, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK Addendum, for transfers to our service providers. Contact us for more information.
How Long We Keep Data
We keep your information while your account is active. When you delete your account, it is scheduled for deletion and permanently deleted after a 30-day grace period. During that period you can cancel the deletion and export your data. After it, we delete your data, except where we must keep some of it longer to comply with law, resolve disputes, or enforce our agreements. Deleted data may remain in encrypted backups for a limited time until they are overwritten.
Your Choices and Rights
You can access, correct, export, and delete your information from within the Service (Settings → Data export, and Profile → Delete account), and unsubscribe from marketing email using the link in any such email.
Depending on where you live, you may also have the right to know what personal information we collect and how we use and share it; to access, correct, delete, or receive a portable copy of it; to object to or restrict certain processing; to withdraw consent where we rely on it; and to opt out of the sale or sharing of personal information (we do neither). If you are in the EEA, UK, or Switzerland, you may also complain to your local data protection authority.
To make a request, email [email protected]. We will verify your request and respond within the time required by law. You may use an authorized agent. We will not discriminate against you for exercising your rights. If we deny your request, you may appeal by replying to our response.
If your information is in a Balances workspace that belongs to one of our customers (for example, you are their customer or vendor), please contact that business. We will help them respond.
Legal bases (GDPR / UK GDPR)
Performance of a contract: to create your account and provide the Service you requested.
Legitimate interests: to secure, maintain, and improve the Service (including error monitoring) and to communicate with you about it, where those interests are not overridden by your rights.
Consent: for non-essential analytics and session recording where we ask for it, and for marketing where required. You can withdraw consent at any time.
Legal obligation: where we must keep or disclose data by law.
Children
The Service is for business use by adults. It is not directed to anyone under 18, and we do not knowingly collect information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.
Changes to This Policy
We may update this policy. If we make material changes, we will notify you by email or in the Service before they take effect. The date at the top shows when it was last updated.
Contact Us
Questions about this policy or your information: [email protected]
Balances, Inc.
2261 Market St PMB 85770
San Francisco, CA 94114