Balsù AI

Balsù AI

Privacy Policy

See also our Terms of Service and Data Processing Agreement.

Last Updated: October 1, 2026

Balsù AI ("Balsù AI", "we", "us" and "our") is a company registered in the Republic of Lithuania. This notice explains how we handle personal data when you use the Balsù AI meeting platform at balsu.ai (the "Platform"), visit our website, or appear in a meeting a customer records with the Platform.

In this notice, "personal data", "processing", "controller", and "processor" have the meanings in the General Data Protection Regulation ((EU) 2016/679) ("GDPR").

1. Our roles

Balsù AI is:

  • the controller for personal data of account holders, people who request access, website visitors, and people who contact us about billing, support, analytics, or marketing; and
  • the processor for meeting content our customers submit or record (recordings, transcripts, summaries, and related participant data). The customer decides why that data is processed. That processing is covered by our Data Processing Agreement.

2. What we collect

What we collect depends on how you interact with us.

  • Account and access requests: name, email address, login credentials, plan, and the record that you accepted the Terms of Service.
  • Meetings: participant names, audio and video recordings, transcripts, AI-generated summaries, speaker labels, and meeting metadata (date, duration, and title).
  • Google Calendar, if you connect it: see below.
  • Support and billing: the content of messages you send us, and payment details held by our payment provider when you pay online.
  • Website and product use: IP address, browser and device data, and cookie data described below. Analytics data is collected only after you accept analytics cookies.

Meeting data is provided by the customer who uses the Platform, or captured when that customer sends our recording bot into a meeting.

Google Calendar

If you choose to connect your Google Calendar, we request read-only access via Google's OAuth API, using the single https://www.googleapis.com/auth/calendar.events.readonly scope. We request no other Google scopes. We use that access to list events on your primary calendar within a bounded window of upcoming and recently past events, and to register change notifications so the Platform stays up to date. We do not create, edit, or delete events on your Google Calendar. For each event in that window we store:

  • the date, time, title, and status of the event;
  • the conferencing link, when Google Meet, Zoom, or Microsoft Teams is detected. We inspect structured conferencing data and, when necessary, the location and description fields, and we store only the join link; and
  • the attendee list (names and email addresses, where Google provides them), used solely to help identify meeting participants for speaker mapping.

We use this data to show your meetings, let you turn recording on or off when a supported link is present, and schedule the bot. We do not use Google Calendar data for advertising. Calendar data shown in the Platform is kept only as long as needed to show upcoming and recent meetings, and is replaced or deleted on each sync. You can disconnect in Platform settings or from your Google Account permissions. Disconnecting stops future reads. It does not delete transcripts or summaries already created.

Balsù AI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. How we use personal data

Where we are the controller, we use personal data to:

  • create and secure your account and provide the Platform;
  • produce transcripts and summaries so you can review meetings;
  • answer support requests and keep financial records;
  • send product messages that are similar to a service you already use, where the law allows that without consent, and other marketing only with consent;
  • keep the Platform secure and understand how it is used; and
  • comply with law.

AI outputs are drafts for human review. We do not make decisions that produce legal effects or similarly significant effects about a person solely by automated means (GDPR Article 22). Do not treat an AI summary as the sole basis for a decision that has a legal or similarly significant effect on a person.

We do not use the content of meeting recordings or transcripts to train AI models, and we do not share that content with third parties for their own purposes. We may use aggregated or de-identified usage data to operate and improve the Platform.

4. Legal bases

For people in the EEA, we rely on:

  • Contract (Article 6(1)(b)) to provide the Platform you or your organisation asked for, including the recording bot, transcripts, summaries, and your account.
  • Legitimate interests (Article 6(1)(f)) for security, fraud prevention, aggregated analytics, and messages about similar products to existing customers. You can object, including to those messages, at privacy@balsu.ai.
  • Legal obligation (Article 6(1)(c)) for financial records and lawful requests from authorities.
  • Consent (Article 6(1)(a)) for analytics cookies and for marketing to people who are not existing customers. You can withdraw consent in cookie settings, by disconnecting an integration, or by emailing us. Withdrawal does not affect processing that was already lawful.

Recordings and transcripts may incidentally include special-category data (GDPR Article 9), such as health information a participant mentions. We do not ask for that data. Customers, as controllers of the meetings they record, are responsible for any extra legal basis and safeguards.

5. Who we share data with

We share personal data with service providers who process it for us:

  • hosting and database (Supabase, Vercel);
  • the meeting bot (Recall.ai) and speech-to-text (Soniox);
  • AI processing for summaries, embeddings, and answers (OpenAI);
  • email delivery (Resend) and, if you connect it, Slack;
  • analytics after you accept cookies (PostHog, hosted in the EU; Google Tag Manager and Google Analytics);
  • payment processors, when you pay online; and
  • professional advisers, and authorities when the law requires it.

We do not sell personal data. A current list of sub-processors is published at balsu.ai/sub-processors. We will tell customers at least fourteen (14) days before we add or replace a sub-processor, as described in the Data Processing Agreement.

If we sell or transfer the business, personal data may transfer with it. We would tell account holders before that happens where the law requires notice.

6. Security

Traffic between your browser and our servers uses TLS. Files stored for the Services are encrypted at rest with AES-256. Database row-level security isolates each customer's rows. Google OAuth tokens are encrypted at rest and are not sent to the browser.

Access to recordings uses time-limited links. Those links expire within 24 hours. Recordings are never published at a permanent public address. The meetings storage bucket is private.

If a personal data breach is likely to risk your rights and freedoms, we notify the supervisory authority within 72 hours of becoming aware of it, where the GDPR requires that, and we tell affected people without undue delay where the breach is likely to result in a high risk.

7. International transfers

Some providers process personal data in the United States or another country outside the EEA. PostHog product analytics is hosted in the EU. Where we transfer personal data from the EEA to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses (Decision 2021/914) and, where the provider is certified, the EU-US Data Privacy Framework. You can ask for a copy of the relevant safeguard at privacy@balsu.ai.

8. Cookies

Essential cookies run the Platform. Analytics cookies load only if you choose Accept. You can change that choice at any time via .

  • balsu_consent — stores Accept or Essential only, for 180 days.
  • Supabase authentication cookies (names beginning with sb-) — keep you signed in for the session.
  • tz — your timezone for the calendar, for 1 year.
  • calendar-view — list or week view, for 1 year.
  • sidebar-collapsed — dashboard layout, for 1 year.
  • Analytics cookies from Google Tag Manager, Google Analytics, and PostHog — only after you accept, for the periods those providers set.

Light or dark appearance is stored in your browser's local storage, not in a cookie. Blocking essential cookies may stop sign-in.

9. How long we keep data

Recordings, transcripts, and summaries are kept while the account is active. You can delete them at any time. On the Free plan, meeting history older than 14 days is not shown in the product and is not used for search. That is an access window, not a deletion. The content stays until you delete it or the account is closed. Current plan limits are published at balsu.ai/pricing.

Google Calendar event data shown in the Platform is kept only as needed for current and recent meetings and is refreshed or deleted on each sync.

On account closure we make your content available for export for 90 days, then delete it, except where the law requires us to keep it (for example financial records). Disconnecting Google stops further calendar reads immediately.

10. Your rights

If you are in the EEA or UK, you can ask us to access, correct, erase, or restrict personal data, to object to processing, and to receive data you provided in a portable format. We may verify your identity. We do not charge a fee unless a request is manifestly unfounded or excessive.

If you appear in a recorded meeting, contact the account holder who recorded it first. They are the controller. If you cannot reach them, email privacy@balsu.ai and we will help where we can.

Marketing is sent to existing customers on the basis of legitimate interests, and to anyone else only with consent. You can opt out at any time at privacy@balsu.ai.

You can complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, VDAI), L. Sapiegos g. 17, LT-10312 Vilnius, vdai.lrv.lt, or to the authority where you live. Please contact us first so we can try to resolve it.

If you are a California resident, you may request to know, delete, or correct personal information, and to opt out of sale or sharing. We do not sell or share personal information for cross-context behavioural advertising. Email privacy@balsu.ai.

11. Children

The Platform is not for anyone under 18. We do not knowingly collect personal data from children. If you believe we have, email privacy@balsu.ai and we will delete it.

12. Changes

We will post changes on this page and, where appropriate, email account holders. The date at the top is the date of the latest change.

13. Contact

Balsù AI
Republic of Lithuania
Privacy: privacy@balsu.ai
Support: hello@balsu.ai

Balsù AI · balsu.ai · privacy@balsu.ai