Privacy Policy

Overview

This Privacy Policy explains how Balu collects, uses, discloses, and protects personal information when you visit our websites, use the client portal, communicate with us, or use our services.

Balu is designed for hospitality businesses. Our customers are responsible for having the right notices and permissions for guest data they send to Balu.

Information we collect

• Account and contact information, such as name, email address, business name, login details, and support communications.
• Business and property information, such as property details, approved knowledge entries, availability data, pricing rules, and operational settings.
• Guest conversation data that our customers choose to process through Balu, including messages, names, phone numbers, social media handles, reservation details, and lead information.
• Billing and transaction information processed through payment providers such as Stripe. Balu does not store full card numbers.
• Usage, device, and log information, such as IP address, browser, timestamps, pages viewed, error logs, and security events.
• Cookies and similar technologies needed to keep the site secure, remember preferences, and operate the portal. With your permission on the marketing site, Meta advertising measurement may also use first-party identifiers and receive device, page, and campaign-attribution information.

How we use information

• Provide, secure, maintain, and improve the services.
• Generate AI drafts, replies, summaries, classifications, routing decisions, analytics, and operational context.
• Authenticate users and protect accounts from fraud, abuse, and unauthorized access.
• Process payments, invoices, subscription management, taxes, and billing support.
• Provide customer support and respond to questions.
• Measure marketing performance and understand which campaigns lead to genuine interest, when you allow advertising measurement.
• Comply with legal, tax, accounting, security, and regulatory obligations.

How we share information

We may share information with service providers that help us operate Balu, such as hosting providers, databases, security tools, AI infrastructure providers, communication providers, payment processors, and professional advisors.

When you explicitly allow advertising measurement, we may send website event, device, IP address, browser, campaign-attribution data, and one-way SHA-256 hashes of submitted email, phone, or internal contact identifiers to Meta through the Meta Pixel and Conversions API to measure Leads and Schedules. We never send raw form-entered contact details to Meta. These hashes remain personal data and are removed from Balu's conversion records when an applicable erasure request is completed.

If you pay through Stripe, information needed to process payment may be shared with Stripe. Stripe's privacy practices are described at stripe.com/privacy.

We may disclose information when required by law, legal process, or to protect rights, safety, security, and the integrity of our services.

Mobile and text messaging data

When you opt in to receive text messages directly from Balu, we collect your mobile number, consent record, and message-related data. We use this information to send Balu account, onboarding, requested-support, and service notifications; honor STOP and HELP requests; prevent abuse; and meet legal obligations. Reply STOP to unsubscribe or HELP for help.

Balu does not sell or rent mobile information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All information-sharing categories above exclude text messaging originator opt-in data and consent; this information will not be shared with third parties except vendors that operate the messaging program on Balu's instructions or disclosures required by law.

Those messaging vendors may process this information only to deliver the program, honor your choices, secure the service, or comply with law. They may not use it for their own purposes.

This section applies only to Balu's own text messaging program. Text messages sent by Balu customers to their guests are governed by each customer's separate privacy notice and consent process.

AI processing

Balu may send relevant snippets of approved knowledge, property configuration, availability data, and conversation context to AI providers to generate or evaluate responses. Customers should avoid submitting sensitive personal information unless it is necessary for the service.

Retention

By default, Balu de-identifies ordinary conversation content 12 months after the conversation's last message, or after creation if it never had a message. Inactive conversations are archived automatically; archiving a conversation does not itself delete it.

Message-provider payloads, conversation attachments, and voice transcripts normally expire after 30 days. Balu does not record call audio. Operational call metadata, audit records, billing records, consent evidence, security records, and structured transaction records may follow different documented schedules.

A customer may select a supported shorter or longer conversation-retention period. An active legal hold or another documented legal obligation may pause deletion of the minimum records needed for that purpose. Balu preserves de-identified operational metrics after personal conversation content is removed.

Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of personal information. To make a privacy request, email privacy@balu.cx.

You can accept, decline, or revisit Meta measurement using Cookie preferences in the site footer. We also honor supported Global Privacy Control signals by keeping Meta measurement disabled.

We do not sell personal information for money. If applicable privacy law treats certain advertising or analytics sharing as a sale or sharing, you may use Cookie preferences or contact us to opt out.

Children

Balu is not directed to children under 13, and we do not knowingly collect personal information directly from children under 13.

Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. No system can be guaranteed to be completely secure.

Contact

Privacy questions can be sent to privacy@balu.cx.