Privacy Policy

1. Who we are

This policy explains how Baleen handles personal data on this website and in the platform. For data your company stores inside its workspace (its customers, travellers, contacts), your company is the controller and we act as processor on its instructions.

2. What we collect on this site

The contact and signup forms collect what you type: name, work email, company, and your message. We also record the technical minimum needed to protect the forms (IP address, browser identifier). Analytics run only if you consent via the cookie banner — declining changes nothing about how the site works.

3. What we collect in the platform

Account data (name, email, role), billing data (plan, invoices, payment status — card numbers stay with the payment provider), and operational logs needed to run and secure the service. Where AI-assisted features are used, the relevant text is processed to produce the draft; redaction policies can strip identifying details first.

4. Why, and on what legal basis

We process data to perform our contract with your company (running the service, billing), to pursue legitimate interests (security, abuse prevention, improving the service), to meet legal obligations (tax, accounting), and — for analytics cookies — only with your consent.

5. Sharing

We share data with the sub-processors that make the service work: hosting, e-mail delivery, payment providers, and (when used) AI model providers. Each is bound by contract to process data only for us. We do not sell personal data. We disclose data to authorities only where the law requires it.

6. Retention

Workspace data lives for the subscription plus a thirty-day export window, then is deleted. Invoices and records we must keep by law are retained for the statutory period. Lead and contact messages are kept as long as the conversation is live and deleted on request.

7. Your rights

Depending on your jurisdiction you may request access, correction, deletion, restriction, portability, or object to processing, and you may complain to a supervisory authority. Write to the contact address in the imprint; we answer within the statutory deadline.

8. Security

Data is encrypted in transit, access is role-based and logged, payment pages are hosted by the payment provider, and workspaces are isolated from one another. No system is perfectly secure; we notify affected customers of incidents as the law requires.