Legal
Privacy Policy
Last updated October 30, 2026
This policy explains how Flowgenn Inc., which owns and operates Balant AI (“Balant”, “we”, “us”), collects, uses, shares and protects information through balantai.com and the Balant AI service (together, the “Service”). Balant prepares month-end and quarter-end close work for companies, accounting firms and funds, and each piece of work waits for the customer’s team to approve it.
Who this covers
Our customers are businesses. When a customer uses the Service, the information it gives us about its own business, clients, partners and bank accounts is “Customer Data”. We handle Customer Data on the customer’s behalf and under our agreement with that customer. If you are a client, partner or employee of one of our customers, that customer decides what is shared with us, and you can contact them directly about your information.
Information we collect
When you visit balantai.com
- Server logs. Our servers record your IP address, browser type, the page requested and the time.
- Cookies. Pages with a form, such as the home page, set one strictly necessary security cookie, “csrftoken”. It holds a random value, not information about you, and lasts up to a year. Google Analytics sets the analytics cookies described below, and the Meta Pixel sets the advertising cookie described below.
- Fonts. The public site loads its typeface from Google Fonts, so Google receives your IP address and browser details when the page loads.
- Analytics. The home page, this policy, our terms and the get started page use Google Analytics to show us how visitors use them. It sets cookies (“_ga” and one starting “_ga_”) that last up to two years, and Google receives your IP address, browser and device details, the pages you view, how you reached them and what you click. We don’t send it the email you type in the sample run form, and it doesn’t run on the signed-in app. This data is kept in Google Analytics for up to 14 months.
- Advertising. The same pages use the Meta Pixel, so we can measure our advertising on Meta’s services, such as Facebook and Instagram, and show ads to people who visited. It sets a cookie (“_fbp”) that lasts about three months, and Meta receives your IP address, browser and device details, the page you view, how you reached it, and whether you submitted the sample run form or booked a call. Meta may connect this to a Meta account you hold. We don’t send it the email you type in the sample run form. If your browser sends a Global Privacy Control signal, the Pixel doesn’t load.
- Your work email. If you enter your work email in the sample run form on the home page, we keep it, with which form you used and when, so we can follow up about your sample run. We then open Calendly’s booking page with it filled in.
- Booking a sample run. If you schedule a sample run, Calendly, the scheduling service we link to, collects the details you enter, such as your name, email and any note for the call, under its own privacy policy, and shares them with us.
When you have an account
- Account details. Your name, work email, role and which entities you can see. Your password is stored only as a one-way hash, which we can’t read back.
- Sign-in and activity records. When you sign in or take an action, we record what happened, when, your IP address and your browser, so your team can see its activity and we can keep accounts secure. A session cookie keeps you signed in.
- Sign-in codes. We email a one-time code to your work email when you sign in.
Customer Data
- Documents you provide, such as bank statements, check logs, deposit reports, past registers, category lists and partnership workbooks. These can include account numbers, transactions, names, addresses and taxpayer identification numbers.
- What the Service produces and records, such as categorized transactions, rules, questions and answers, approvals, sign-offs, registers, reconciliations and filled tax forms.
- Connected accounts. If your team connects QuickBooks Online, we receive the company’s chart of accounts, account balances, the transactions in its bank accounts, its open bills, which vendors are marked for a 1099 and whether a tax ID is on file for them (never the tax ID itself), and which transactions were changed after a month was signed. We send it the entries and bank transactions your team approves, and change the category of a transaction your team approves moving out of an uncategorized account. If your team connects a bank through Plaid, we receive the account’s name, type and last four digits, its posted transactions and, where the bank offers them, its statements. We never see or store your bank sign-in details.
How we use information
- To provide the Service: reading documents, sorting transactions, preparing registers, reconciliations and forms, and showing them to your team for approval.
- To remember your team’s decisions, so later periods are sorted the same way.
- To keep accounts and the Service secure, including sign-in codes, lockouts after repeated failed sign-ins, and activity records.
- To answer questions, provide support and tell you about changes to the Service.
- To arrange the sample runs people ask for, and to follow up about them.
- To meet legal obligations and enforce our agreements.
We don’t sell personal information for money, and we don’t use Customer Data for advertising. What the Meta Pixel sends Meta may count as selling or sharing personal information under some US state privacy laws. To opt out, turn on Global Privacy Control in your browser, and the Pixel won’t load.
Plaid
We use Plaid Inc. (“Plaid”) to connect bank accounts. When your team connects a bank, you sign in to your bank through Plaid’s own screens, and Plaid shares the account information described above with us. Plaid’s handling of your information is governed by the Plaid End User Privacy Policy. By connecting a bank account through the Service, you acknowledge that policy. Your team can disconnect a bank at any time from the Integrations page.
Who we share information with
We share information only with the service providers that help us run the Service, as described here, and only for that purpose. The one exception is Meta, which also uses what it receives for its own purposes, under its own terms:
| Provider | What it does for us |
|---|---|
| Amazon Web Services | Hosts the Service and its data in the United States, and delivers sign-in code emails. |
| OpenAI | Reads documents, such as statements and workbooks, so their contents can be checked and sorted; suggests categories for transactions; drafts the reason behind a month's movements from the categories, payees and amounts in them; and answers your team's questions about their books, which sends each question with the figures and descriptions from the books it needs. |
| Intuit (QuickBooks Online) | Only when your team connects QuickBooks: provides your chart of accounts, account balances, the transactions recorded in your bank accounts there, open bills, vendors’ 1099 settings and which transactions changed after a month was signed; receives the entries, bank transactions and category changes your team approves. |
| Plaid | Only when your team connects a bank: provides account details, transactions and statements. |
| Google Drive | Only when your team connects its Google Drive: receives the workpapers of a month your team asks to file there, in a folder Balant makes. Balant can see only the folders and files it created. |
| Calendly | Only when you ask for a sample run: receives the work email you enter in our sample run form and which form you used, so its booking page opens with your email filled in; schedules the call and passes us the details you enter there. |
| Google Fonts | Serves the typeface on the public website. |
| Google Analytics | Measures how visitors use the public website. |
| Meta (Meta Pixel) | Measures our advertising and shows it to people who visited the public website. |
We may also share information if the law requires it, to protect the rights, property or safety of Balant, our customers or others, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to the information transferred.
How we protect information
Every connection to the Service uses TLS 1.2 or newer, with HSTS enforced. Access to the Service is by invitation only, and each person sees only the entities their team gives them. The credentials that connect QuickBooks Online and banks are stored encrypted. Files you provide are never served at a public address. No method of storage or transmission is completely secure, so we can’t guarantee absolute security.
How long we keep information
We keep Customer Data for as long as the customer’s account is active or as our agreement with the customer requires, and then delete it or return it as that agreement provides, unless the law requires us to keep it longer. Activity records are kept as security records. A work email entered in the sample run form is kept for 180 days, then deleted. Server logs are kept for up to a year for security and troubleshooting, then deleted.
Your choices and rights
You can ask us to access, correct or delete personal information we hold about you by writing to us at the address below. If the information is Customer Data, we will pass your request to the customer it belongs to and help them respond. Depending on where you live, you may have further rights under local law, and we won’t treat you differently for exercising them.
Children
The Service is for businesses and isn’t directed to children under 16. We don’t knowingly collect their information.
Changes to this policy
We’ll post any change here and update the date at the top. If a change is significant, we’ll tell customers before it takes effect.
Contact us
Questions or requests about privacy: contact@flowgenn.com.