BalanseOS privacy policy

Effective date: 10 September 2026

Last updated: 10 September 2026

1. Who we are

BalanseOS is a wellness, life-planning and AI-supported coaching application that helps people plan and create greater balance across four areas of life: mind, body, relationships and purpose. For the purposes of UK data protection law, the data controller responsible for your personal information is BalanseOS Ltd, a company registered in Scotland no. SC848883, 31 Dudley Crescent, Edinburgh, EH6 4QJ. Email: loral@balanseos.com. In this privacy policy, 'BalanseOS', 'Balanse', 'we', 'us' and 'our' refer to this organisation. This policy explains what personal information we collect, why we use it, how it is protected and the choices and rights available to you.

2. Who this policy applies to

This policy applies when you:

Visit the BalanseOS website

Create or use a BalanseOS account

Use our planning, journaling, reflection or AI coaching features

Connect your Google Calendar

Communicate with us

Subscribe to our emails

Purchase or participate in a Balanse service

3. Information we collect

Depending on how you use BalanseOS, we may collect the following information.

Account and profile informationYour name, email address, account identifier, authentication information, profile preferences and subscription status. We use this to create and manage your account, authenticate you, provide the service and communicate with you. We do not store your account password in readable form; authentication is provided by Supabase.

Information you add to BalanseOSGoals, plans, actions and routines; responses to Balanse assessments and check-ins; journal entries and reflections; mood, wellbeing and life-area ratings; coaching preferences; vision statements and personal priorities; information entered into conversations with the AI coach; and feedback about the service. This is used to provide the features you request, personalise your experience and generate relevant planning or coaching responses.

Sensitive informationSome information you voluntarily provide may reveal sensitive information about your physical or mental health, beliefs, relationships or other aspects of your private life. Where UK law treats this as special-category personal data, we process it with your explicit consent when required. You may withdraw that consent, although doing so may limit certain personalised features. Please only provide information you are comfortable processing through the service, and do not include personal information about another person unless you have their permission and a lawful reason to do so.

Google account informationIf you choose to connect a Google account, we may receive your Google account identifier, email address and basic profile information to authenticate the connection and show you which account is connected. We do not access your Gmail messages, Google Drive files, contacts or other Google services unless we clearly request additional permission and you explicitly approve it.

Technical and usage informationIP address, browser and device type, operating system, login and access dates, pages and features used, error reports, security logs, referral information and cookie or similar identifiers. We use this to operate, secure and improve BalanseOS, understand how features are used and investigate errors or misuse. Where analytics cookies or similar non-essential technologies are used, we request consent where required.

CommunicationsIf you contact us, we collect your name, email address and the content of your message to respond, provide support and maintain appropriate business records.

Payment informationIf you purchase a subscription, payments are processed by Stripe. We receive transaction information, subscription status and limited billing details, but we do not receive or store your complete payment-card number. Stripe processes payment information under its own privacy policy.

Marketing informationIf you subscribe to newsletters or promotional communications, we collect your contact details, communication preferences and information about interactions with those communications. You can unsubscribe at any time using the link in an email or by contacting us.

4. Google Calendar information

Connecting Google Calendar is optional. If you choose to connect it, BalanseOS accesses your own Google calendars to bring your existing commitments together with your Balanse plans. Depending on the actions you take, the information accessed may include event titles, descriptions, dates and start and end times, all-day and recurring-event information, locations, video-meeting links, reminders, event status, time-zone information and the technical event identifiers required to synchronise changes.

What we do with itDisplay your events within your Balanse Day, Week and Month; help you plan wellbeing actions, priorities and routines around existing commitments; add an event when you ask us to; edit an event you own when you instruct us to change it; delete an event you own when you explicitly request deletion; and keep user-initiated changes synchronised with Google Calendar.

What we do not doWe do not use this permission to manage your calendar-sharing settings or access calendars you do not own, and we do not create, edit or delete events without an action or instruction from you. Google Calendar information is not used for advertising, sold to third parties, or used to determine eligibility for credit, employment, insurance or other consequential services.

StorageBalanseOS does not store a copy of your Google Calendar events. Events are requested from Google each time you open or refresh a calendar view and are held only in your browser for that session. The only Google information we store is the encrypted authorisation credential that allows the connection to work.

AI coachGoogle Calendar information is not sent to or used by the BalanseOS AI coach. We will only change this if we introduce a clearly explained feature for that purpose and obtain your separate, explicit consent beforehand.

DisconnectingYou can disconnect Google Calendar at any time in Settings, Calendar. Disconnecting stops all future access. You may also revoke BalanseOS access through your Google Account permissions.

Google API Services User Data PolicyBalanseOS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. How and why we use personal information

We process personal information only when we have a lawful basis under applicable data protection law.

Creating and managing your accountAccount and profile information. Lawful basis: performance of our contract with you.

Providing planning, journaling and coaching featuresInformation you add to BalanseOS. Lawful basis: performance of our contract and, where necessary, explicit consent.

Connecting and operating Google CalendarGoogle account and Calendar information. Lawful basis: your consent and performance of the service you requested.

Personalising your Balanse experiencePreferences, plans, ratings and usage. Lawful basis: performance of our contract, legitimate interests, and explicit consent where required.

Providing AI-generated responsesPrompts, coaching conversations and relevant preferences. Lawful basis: performance of our contract and, where necessary, explicit consent.

Processing paymentsAccount, transaction and billing information. Lawful basis: performance of our contract and compliance with legal obligations.

Securing and improving the serviceTechnical, usage and security data. Lawful basis: our legitimate interests in operating a safe, reliable service.

Responding to enquiries and sending service communicationsContact and account information. Lawful basis: performance of a contract or our legitimate interests.

Sending marketingContact details and preferences. Lawful basis: consent, or legitimate interests where permitted by law.

Meeting legal requirementsRelevant account, transaction or communication records. Lawful basis: compliance with legal obligations.

6. AI and automated services

BalanseOS uses AI services to provide personalised coaching, reflection and planning responses. These services include OpenAI for text generation and ElevenLabs for voice generation. When you use these features, relevant prompts, instructions, preferences or content are sent securely to the appropriate provider to generate the response you requested. We do not permit your personal BalanseOS content to be used to train publicly available AI models unless we clearly tell you and obtain any consent required. We may use aggregated or appropriately anonymised information to assess feature performance and improve BalanseOS. We do not use identifiable Google Calendar data for AI training, prompt development or tone analysis. AI-generated content may be incomplete or inaccurate and should not be treated as medical, psychological, legal or financial advice. BalanseOS is a self-guided wellness service and is not a substitute for professional healthcare or emergency support. We do not use solely automated processing to make legal or similarly significant decisions about you.

7. Who we share information with

We do not sell, rent or trade your personal information. We share the minimum information necessary with trusted service providers that help us operate BalanseOS:

SupabaseDatabase hosting, authentication, file storage and backend functions.

CloudflareWebsite hosting, content delivery and security.

LovableApplication build, deployment and the secure connector service used for the Google Calendar connection.

GoogleWhen you sign in with Google or connect and use Google Calendar.

OpenAIAI-generated text and coaching features.

ElevenLabsVoice-generation features.

StripePayments and subscription management.

ResendService, transactional and newsletter emails.

Professional advisersWhere reasonably necessary, for example accountants or legal advisers.

Other disclosuresWe may also disclose information when required by law, regulation or valid legal process; to protect the rights, security or safety of BalanseOS, our users or others; to investigate fraud, security incidents or misuse; or in connection with a merger, acquisition or sale of the business, subject to applicable legal requirements.

Google user dataWe do not transfer Google user data for advertising, data-brokerage or unrelated commercial purposes. Human access to Google user data is prohibited except where you have explicitly requested support involving specific data, where necessary to investigate security or abuse, where required by law, or where the data has been aggregated and anonymised for lawful internal operations.

8. International transfers

Some of our service providers may process information outside the United Kingdom. Where personal information is transferred internationally, we use appropriate safeguards required by UK data protection law. These may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another legally recognised safeguard. You may contact us for more information about the safeguards relevant to your information.

9. How long we keep information

We keep personal information only for as long as necessary for the purposes described in this policy, including legal, accounting, security and dispute-resolution requirements. Our retention periods are:

Account and profile informationWhile your account is active and for up to 30 days after account closure, after which it is deleted from our active systems.

Plans, journal entries, coaching content and ratingsWhile your account is active and until you delete them, then removed from active systems within 30 days.

Google Calendar event informationNot permanently stored. Events are fetched live from Google each time you open or refresh a calendar view and held only in your browser for that session.

Google authorisation credentialsStored encrypted while your Calendar connection remains active, and deleted immediately when you disconnect, revoke access or delete your account.

Support communicationsUp to 24 months from the last message, unless a longer period is needed for a dispute or legal claim.

Transaction and tax recordsSix years, where required for UK accounting or tax purposes.

Security and access logsUp to 12 months.

Marketing informationUntil you unsubscribe or we determine it is no longer current, subject to keeping a suppression record so we can honour your request.

BackupsBackups may retain deleted information for up to 30 further days before being securely overwritten. During that period, backup information is restricted and is not used for ordinary business purposes.

10. Google Calendar disconnection and deletion

You can disconnect Google Calendar in Settings, Calendar, or revoke access through your Google Account.

BalanseOS stops requesting new Google Calendar information immediately.

Stored Google authorisation credentials are deleted and invalidated at the moment you disconnect.

No cached copy of your events is retained, because events are only ever fetched live for display.

Events already created in your Google Calendar remain there unless you delete them in Google Calendar or through BalanseOS before disconnecting.

You can request deletion of your BalanseOS account and associated personal information by emailing loral@balanseos.com. We complete valid deletion requests without undue delay and normally within one month, unless the law permits an extension or requires us to retain particular records.

11. Data security

We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, destruction, disclosure or access. These include encryption in transit, secure database controls, Supabase Row Level Security, restricted administrative access, authentication and access controls, server-side handling of OAuth credentials, encrypted storage of authorisation credentials, monitoring and logging, and procedures for responding to security incidents. No online system can guarantee absolute security. You are responsible for keeping your login credentials secure and should contact us promptly if you believe your account has been compromised. If a personal-data breach creates a risk to people's rights and freedoms, we will notify the Information Commissioner's Office and affected individuals where required by law.

12. Your data-protection rights

Depending on the circumstances, you may have the right to:

Be informed about how we use your information

Request access to your personal information

Ask us to correct inaccurate or incomplete information

Ask us to delete your information

Ask us to restrict how information is used

Object to processing based on legitimate interests or direct marketing

Receive certain information in a portable format

Withdraw consent at any time

Complain to a data-protection regulator

These rights are not absolute and may be subject to legal exceptions. To exercise your rights, contact loral@balanseos.com. We may need to verify your identity before completing a request and normally respond within one month. You will not usually be charged, although we may charge a reasonable fee or refuse a request where permitted by law, including where a request is manifestly unfounded or excessive.

13. Complaints

Please contact us first if you have concerns about how we use your personal information so that we can try to resolve them. You also have the right to complain to the UK Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom. Website: https://ico.org.uk/make-a-complaint/. Telephone: 0303 123 1113.

14. Children's privacy

BalanseOS is intended for people aged 16 and over. We do not knowingly offer the service to, or collect personal information from, children under 16. If you believe that a child under 16 has provided personal information to BalanseOS, contact us at loral@balanseos.com. We will investigate and delete the information where appropriate.

15. Cookies and similar technologies

BalanseOS uses essential cookies and similar technologies to authenticate users, maintain sessions, protect the service and remember settings. We may also use analytics technologies, and we request consent before placing non-essential cookies where required by law. You can review and change your choices at any time using the cookie settings link in the site footer.

16. External links and services

BalanseOS may contain links to external websites or services. We are not responsible for the privacy practices of organisations we do not control, and you should review their privacy notices before providing personal information. Google processes information under Google's own privacy policy when you use your Google Account or Google Calendar.

17. Changes to this policy

We may update this privacy policy to reflect changes to BalanseOS, our suppliers or legal requirements. We will publish the updated policy on this page and change the 'Last updated' date. If a change materially affects how we use your personal information, including Google user data, we will provide an appropriate notice and obtain consent where required before using the information for the new purpose.

18. Contact us

For privacy questions, requests or complaints, contact our Data Protection Officer, Loral Quinn, at loral@balanseos.com, or write to BalanseOS Ltd, 31 Dudley Crescent, Edinburgh, EH6 4QJ, United Kingdom. BalanseOS Ltd is registered in Scotland, company number SC848883.