Privacy notice

The single visible action on the site is the "Request a tailored demo" form, which appears in the footer of every page. When you submit the form we collect:

• Your email address — what you type into the form.
• Submission metadata — the timestamp, your IP address, and your browser's User-Agent string. The IP is captured server-side at submission and is used for rate-limiting and abuse prevention; it is not used for tracking and is not shared with advertising or analytics platforms.
• Source label — which page on the site the form was submitted from. The field exists so the operator can tell which page, blog post, or campaign produced the demo request.

We use Plausible Analytics (opens in a new tab) for privacy-respecting page-view counts. Plausible does not set cookies, does not assign you a persistent visitor identifier, and does not see the email you submit. It counts page views, the referrer, your screen size, and your country (resolved server-side from IP and immediately discarded).

Alongside page views, the script records a small set of interaction events automatically. Each is a count with the element or destination that triggered it, and none carries an identity or the contents of any field you type:

• Demo-request submissions. A success event when a demo request goes through, and, because the form is validated in our own code rather than by the browser, an automatic form-submission event on every submit attempt including ones that fail validation.
• Outbound link clicks.Recorded with the destination URL. The “Log in” and “Request a demo” calls to action point at app.balau.ai, a different hostname, so clicking one is counted as an outbound click.
• File downloads and scroll depth with time spent on the page.

• To respond to your demo request — typically a short email from us to set up a conversation.
• To rate-limit and detect abuse of the form. Submissions that look automated (the honeypot field is filled, the same IP submits at high frequency, etc.) are dropped or flagged.
• To understand which inbound channels are working — at the aggregate level, via Plausible. We do not build behavioral profiles or track you across the web.

We do not sell your information, share it with advertisers, or pass it to any third party other than the sub-processors named below. We do not train AI models on anything submitted through this site.

When you connect your Google Calendar to Balau AI, you grant us read-only access to your calendar (the calendar.readonly permission). This section explains what we access, how we use it, who we share it with, and how to revoke access. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements.

What we access. With your permission, we read your Google Calendar events — event titles and descriptions, start and end times, recurrence, and the attendees on each event. We access this on a read-only basis. We do not request or receive write access; Balau AI cannot create, edit, or delete anything in your Google Calendar. We do not access your Gmail, Google Drive, Contacts, or any other Google data, and we do not access any calendar other than your own.

How we use it. We use your calendar events to maintain a record of your client meetings inside your firm's CRM and to generate AI-assisted meeting summaries, suggested facts, and action items for your review. These AI outputs are proposals you confirm — nothing is applied automatically. We persist only events that relate to one of your firm's clients; calendar events that do not involve a client (for example, your personal or internal-only appointments) are discarded as they are processed and are not stored.

How we share it. We do not sell your Google data and we do not use it for advertising of any kind. To generate the AI-assisted features above, relevant event content is sent to our AI sub-processor (Anthropic) after we redact personal identifiers; that sub-processor is contractually bound not to train on the data and to retain none of it. Aside from that processing step and our cloud-infrastructure providers, we do not transfer your Google data to third parties, except where necessary for security, to comply with law, or in connection with a merger, acquisition, or sale of assets as permitted by the Google API Services User Data Policy.

How we store it and how long. Calendar-derived records are encrypted at rest and isolated to your firm. Because Balau AI serves firms in regulated, relationship-driven industries, your firm (as the data controller) may be required to retain communication records for a multi-year regulatory period; we retain them per your firm's instructions and applicable books-and-records rules.

How to revoke access and delete the data. You can disconnect Google Calendar at any time from Settings → Integrations in Balau AI. Disconnecting revokes Balau AI's access at Google and permanently deletes the stored access credentials. You can also revoke Balau AI's access directly from your Google Account at myaccount.google.com/permissions (opens in a new tab). You may request deletion of the calendar-derived records through your firm's administrator or by contacting privacy@balau.ai.

Limited Use affirmation

Balau AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements. Specifically:

• We limit our use of Google Calendar data to providing and improving the meeting-record and AI-assistance features that are prominent in Balau AI's user interface.
• We do not transfer Google Calendar data to others except as necessary to provide or improve those user-facing features (with your consent), for security purposes, to comply with applicable law, or as part of a merger, acquisition, or sale of assets.
• We do not use or transfer Google Calendar data for serving advertising — including personalized, retargeted, or interest-based advertising — and we do not sell Google Calendar data to third parties such as advertising platforms, data brokers, or information resellers.
• We do not allow humans to read Google Calendar data unless: (a) you give affirmative consent to view specific events; (b) it is necessary for security purposes (for example, investigating abuse); (c) it is necessary to comply with applicable law; or (d) the data has been aggregated and anonymized and is used to improve the service.

Under GDPR / UK-GDPR we rely on two lawful bases:

• Consent (Article 6(1)(a)) for storing and acting on the email address you submit through the form. Submitting the form constitutes the consent; you can withdraw it at any time by emailing privacy@balau.ai.
• Legitimate interests (Article 6(1)(f)) for processing submission metadata (timestamp, IP, User-Agent) to rate-limit the form and detect abuse, and for the aggregate page-view counts produced by Plausible. These uses are narrow in scope and non-identifying or short-lived in practice; we have assessed that they do not override your rights or freedoms.

• Demo requests are stored in Balau AI's Google Workspace, with access limited to authorized internal personnel. Google Workspace processes this data on our behalf under the Google Workspace Data Processing Addendum.
• Analytics are processed by Plausible Insights OÜ (Estonia). Plausible operates as a GDPR-by-default analytics provider; data is hosted in the EU.

Demo-request submissions are retained until you ask us to delete them, or for 24 months from submission, whichever comes first. The submission metadata fields (timestamp, IP, User-Agent, source label) are retained on the same schedule as the demo request itself.

If you ask us to delete your entry we do so within 30 days of receiving the request. Aggregate analytics counts are retained on Plausible's standard retention schedule and contain no personal identifier.

You can ask us to access, correct, or delete the information you submitted through the form by emailing privacy@balau.ai. We aim to respond within 30 days. We may verify the request by sending a confirmation email to the address you originally submitted.

If you are an EU/UK resident your rights under GDPR / UK-GDPR (access, rectification, erasure, restriction, objection, portability, withdrawal of consent where applicable) apply. If you are a California resident your rights under CCPA / CPRA (right to know, delete, correct, limit use of sensitive personal information, opt out of sale; we do not sell information) apply. Send any rights request to the same email above.

EU/UK residents also have the right to lodge a complaint with their national data protection authority (for example, the UK Information Commissioner's Office or the French CNIL) if you believe we have handled your data incorrectly.

This site is not directed at children under 16, and we do not knowingly collect personal data from minors. If you believe a child has submitted information through the form, please contact privacy@balau.ai and we will delete it.

We do not make automated decisions with legal or similarly significant effects (within the meaning of GDPR Article 22) about you based on the data submitted through this form. The form is a simple intake — a person reads it and replies.

We do not set cookies on this site. The Plausible analytics we use is cookie-free by design and does not assign you a persistent visitor identifier; that is why this site has no cookie banner.

• Google Cloud / Google Workspace — hosting (Google Cloud) and demo-request storage (Google Workspace). US-region infrastructure under the Google Cloud DPA (opens in a new tab) + Standard Contractual Clauses module 2.
• Plausible Analytics (Plausible Insights OÜ, Estonia) — page-view counts, no cookies, no persistent visitor identifier, no PII. EU-region infrastructure under the Plausible DPA (opens in a new tab).

The product surface (a separate domain) has a broader sub-processor inventory. Customers receive that list as part of their onboarding contract.

The site is served over HTTPS only. Submissions go through server-side rate limits and a honeypot field against simple bots. Stored demo-request data is restricted to authorized internal personnel via Google Workspace permissions.

The product surface (a separate domain) carries a broader compliance posture. Customers receive that posture as part of their onboarding contract.

We are a US company. Hosting and demo-request storage are US-region; Plausible analytics is EU-region. If you are an EU/UK resident your data is transferred to the US under the Standard Contractual Clauses (controller-to-processor, module 2) included in the Google Workspace and Google Cloud DPAs.

We may update this notice as the marketing site evolves (a new analytics tool, a new form field, a new sub-processor). The "Last updated" date at the top of the page reflects the most recent change. Material changes will be flagged at the top of the page for at least 30 days.

• Privacy inquiries: privacy@balau.ai
• Security issues: security@balau.ai
• General: hello@balau.ai