Privacy Policy

1. Scope and your choices

This Policy applies to personal information handled through the Services. It does not apply to third-party products, websites, or services that have their own privacy policies, even if they integrate with Susanna.

Where consent is the legal basis for processing, you may withdraw it at any time. Withdrawing consent does not affect processing already completed. Some information is required to provide the Services; if you do not provide it, a feature or the Services may be unavailable.

2. Information we collect

Account and profile information

Name, email address, optional profile picture, account identifiers, preferences, and authentication information received from Apple, Google, or another sign-in provider. We do not receive your third-party account password.

Content you provide or create

Voice and meeting recordings, voice notes, transcripts, AI and coaching conversations, prompts, notes, uploaded documents and images, tasks, action items, and related metadata. This content may include information about you and other people.

Connected-service information

If you choose to connect a calendar or another service, we may receive information you authorize, such as event titles, times, attendees, and descriptions. You can disconnect integrations through the relevant settings, but information already imported may remain until deleted under this Policy.

Device, log, and usage information

Device model, operating system, browser type, app version, IP address, language, time zone, identifiers, dates and times of access, features used, session duration, interactions, performance data, crash reports, diagnostics, and security logs.

Subscription and support information

Subscription status, plan, transaction identifiers, and purchase history. Apple or Google processes in-app payments; we do not receive or store complete payment-card details. We also collect communications and information you send to customer support.

Sensitive information

Your recordings, notes, transcripts, or prompts may reveal sensitive information, including health, biometric-adjacent voice data, religious or philosophical beliefs, racial or ethnic origin, sexual orientation, union membership, precise location, or information about other people. Please include sensitive information only when necessary. We process it to provide requested features and as otherwise described here.

3. Sources of information

We collect information directly from you; automatically from your device and use of the Services; from people who include you in content they submit; from connected services you authorize; and from providers that support authentication, subscriptions, analytics, security, customer support, cloud hosting, transcription, and AI functionality.

4. How we use information

• Provide, operate, maintain, and synchronize the Services.
• Record and transcribe audio; generate notes, summaries, tasks, action items, answers, and coaching.
• Personalize features and remember your settings.
• Authenticate accounts and process subscription entitlements.
• Respond to support requests and communicate about service or policy updates.
• Analyze performance, troubleshoot errors, and improve reliability and usability.
• Protect users and the Services, detect misuse or fraud, enforce our terms, and establish or defend legal claims.
• Comply with law, valid legal process, and regulatory obligations.

For users in the EEA, United Kingdom, and Switzerland, our legal bases may include performance of a contract, consent, compliance with legal obligations, and our legitimate interests in operating, securing, and improving the Services, balanced against your rights.

5. How AI processes your data

Depending on the feature you request, AI systems may process recordings, transcripts, notes, documents, images, prompts, calendar context, tasks, action items, and conversation history to transcribe speech, summarize meetings, generate notes, extract tasks, suggest follow-ups, answer questions, and provide coaching.

AI output is probabilistic and may be inaccurate or incomplete. Do not rely on Susanna as a substitute for professional medical, legal, financial, mental-health, or other expert advice. Avoid submitting information you are not authorized to share.

AI and cloud providers we use

Susanna uses OpenAI for AI-powered language features, ElevenLabs for voice and speech functionality, and Google Cloud for cloud infrastructure and related services. These providers may process recordings, transcripts, prompts, notes, and other content only as needed to provide the feature you request, maintain security, and comply with applicable law. We do not sell your personal information to these providers.

6. Recording, microphone, and other permissions

Susanna accesses your microphone only after you grant device permission and uses it for features such as meeting and voice-note recording, transcription, voice commands, and coaching. You may revoke permission in your device settings. If you grant access to photos, files, calendars, notifications, or other device features, we use that access to provide the feature you selected.

7. How we disclose information

We do not sell personal information for money. We may disclose information as follows:

• Service providers. To cloud hosting, AI and transcription, authentication, analytics, customer support, communications, security, and payment or subscription providers that perform services for us.
• At your direction. To people, integrations, or services you choose, including when you share a note, invite a collaborator, export content, or connect an account.
• Legal and safety reasons. If reasonably necessary to comply with law or valid legal process; protect rights, safety, and security; investigate fraud or abuse; or enforce agreements.
• Business transactions. In connection with a financing, merger, acquisition, reorganization, bankruptcy, sale of assets, or due diligence, subject to appropriate confidentiality protections.
• With permission. For another purpose disclosed to you when we obtain your consent.

We may use or disclose information that has been aggregated or de-identified so it cannot reasonably be linked to you. We do not attempt to reidentify de-identified information except to verify that de-identification works or as permitted by law.

8. Retention, deletion, and account closure

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including providing the Services, maintaining security and backups, complying with law, resolving disputes, and enforcing agreements. Retention varies by the type of information, the feature used, your settings, and legal requirements.

You may delete supported content or request account deletion. After deletion, information is removed from active systems within a reasonable period and may remain temporarily in encrypted backups or where retention is required for security, fraud prevention, legal compliance, or dispute resolution. We may retain de-identified information that cannot reasonably identify you.

9. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, such as access controls, encryption in transit where appropriate, monitoring, and vendor review. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. You are responsible for protecting your account credentials and notifying us if you suspect unauthorized access.

10. Your privacy rights

Depending on where you live, you may have the right to request access, correction, deletion, or portability of personal information; restrict or object to processing; withdraw consent; opt out of certain targeted advertising, sale, sharing, or profiling; and appeal a denied request.

To submit a request, email hello@balmtechnologies.com. We may need to verify your identity and request details before responding. An authorized agent may submit a request where allowed by law, subject to verification. We will not discriminate against you for exercising a privacy right.

You may also complain to your local data-protection authority. EEA and UK users may contact the supervisory authority where they live or work or where an alleged violation occurred.

11. U.S. state privacy notice

This section supplements the rest of this Policy for residents of states with applicable comprehensive privacy laws. In the preceding 12 months, we may have collected and disclosed the categories below for the business purposes described in this Policy.

We do not sell personal information for money. We also do not knowingly sell or share personal information for cross-context behavioral advertising. We do not use or disclose sensitive personal information to infer characteristics about you except as permitted by law. If our practices change, we will provide any required opt-out method and update this Policy.

California residents may request the categories or specific pieces of personal information we collected, sources, purposes, categories of recipients, correction, and deletion. California’s “Shine the Light” law may also permit requests about certain disclosures for third parties’ direct marketing; we do not disclose personal information to third parties for their own direct-marketing purposes.

12. Children’s privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information directly from children under 13. If you believe a child under 13 has provided personal information, contact us so we can investigate and delete it as required. Users must also meet any higher minimum age required in their country or obtain valid parental or guardian authorization where the Services expressly permit it.

13. International data transfers

Balm Technologies and its providers may process information in the United States and other countries whose data-protection laws may differ from those where you live. Where required, we use recognized safeguards for transfers, such as adequacy decisions or standard contractual clauses, and supplementary measures where appropriate.

14. Changes to this Policy

We may update this Policy to reflect changes to the Services, our practices, or the law. We will post the updated version with a revised effective date and provide additional notice when required. Your continued use after the effective date is subject to the updated Policy, but we will obtain consent where applicable law requires it.