Balance Labs ("we") operates an AI stock research workspace at balancelabs.app. This policy explains what we collect and why. Plain language first, details after.
What we collect
Account data — email address and authentication identifiers when you sign up (stored via Supabase authentication).
Usage analytics — aggregated, non-identifying usage events (page views, feature clicks) via Google Analytics 4 and Ahrefs Analytics. These load only after you accept analytics cookies; declined visitors are not analytics-tracked.
Payment data — handled entirely by Stripe. We never see or store full card numbers; we retain only subscription status and payment references.
Content you create — chats, watchlists, saved screens, strategies and settings you store in the workspace.
Support messages — anything you email us at hello@balancelabs.app.
Why (legal bases)
To provide the service you signed up for (contract).
To keep the service secure and prevent abuse (legitimate interest).
Analytics only with your consent (consent — you can decline or withdraw anytime via the cookie banner or by clearing the bl_consent local storage key).
Retention
Account and content data are kept while your account is active. Analytics data follows Google Analytics default retention (14 months). Delete requests remove account data within 30 days, except records we must keep for billing/tax (payment references).
Who receives data
Supabase — accounts and workspace data storage (EU/US regions per Supabase project settings).
Stripe — payment processing.
Vercel — hosting and edge delivery.
Google (GA4) and Ahrefs — analytics, only with consent.
We do not sell personal data, and we run no advertising cookies.
Your rights
Access, correction, export, deletion, and withdrawal of consent. Email hello@balancelabs.app and we respond within 30 days. We follow GDPR principles for EU/EEA visitors and Thailand PDPA for Thai users; you may use whichever rights apply to you.
Children & security
The service is not directed to anyone under 18. Data in transit is encrypted (HTTPS); secrets are server-side only and never shipped to the browser.