What we collect, why, and how to get it deleted.

1. Who this covers

This policy applies to business owners and their team members who sign up for BalanceSheets, to people who receive a shared report link, and to visitors of our website. We serve customers in Canada and the United States.

2. What we collect

Account information

• Google account details. When you sign in with Google we receive your name, email address, and profile picture. We use these to create and secure your account and to send you account emails. We do not get your Google password.
• Business profile. The business name, industry, and similar details you enter during setup.

Accounting data from QuickBooks Online

• When you connect QuickBooks, you authorize Intuit accounting access. We read your chart of accounts, profit and loss, balance sheet, invoices, bills, customers, vendors, and transactions so we can build your statements, forecast, health score, and valuation.
• BalanceSheets does not create, change, or delete entries in your QuickBooks company.
• Intuit's own privacy terms govern Intuit's handling of your data. Our use of information received from Intuit APIs follows Intuit's developer requirements.

Bank data through Plaid

• If you connect a bank account, you log in to your bank inside Plaid's secure window. We never see your bank username or password.
• Plaid gives us account names, balances, and transactions. We use these to make your cash forecast accurate and to show where cash is actually sitting.
• Plaid's handling of your data is described in the Plaid End User Privacy Policy.

Payment information

Subscriptions are billed through Stripe. Stripe collects and stores your card details; we only keep a reference to your Stripe customer and the status of your subscription.

Usage and technical data

• Product analytics. Which pages you visit and which features you use, so we can see what is working. We use PostHog for this. We do not send your financial figures to analytics.
• Error reports. If something crashes, Sentry records the error and the technical context so we can fix it.
• Questions you ask in chat. When you ask a question about your numbers, the question and the relevant figures from your books are sent to our AI provider to produce an answer. Our provider does not use this data to train its models under our agreement with them.
• Log data. IP address, browser type, and timestamps, kept for security and troubleshooting.

3. Why we use it

• To run the service: build your statements, forecast, health score, valuation, and reports.
• To answer questions you ask about your business in chat.
• To send you account emails, monthly reports, and alerts you have turned on.
• To bill your subscription and prevent fraud or abuse.
• To understand which features are used and improve the product.
• To meet legal obligations and respond to lawful requests.

We never sell your data. We do not share your financial data with advertisers, data brokers, or lenders. Your numbers are used to run your account and for nothing else.

4. Who we share it with

We use the following service providers to run BalanceSheets. Each one only receives what it needs for the purpose listed.

We may also disclose data if the law requires it, to protect the rights or safety of our users, or as part of a sale or merger of the business (we would tell you first). If you share a report link, whoever has that link can see the report.

5. Where your data lives

Our servers and providers are in the United States. If you are in Canada, your data is transferred to and stored in the United States, where it may be subject to US law. By using BalanceSheets you consent to this transfer.

6. How long we keep it

• While your account is active: we keep your account, accounting, and bank data so the service works.
• When you disconnect QuickBooks or a bank: we stop pulling new data right away and delete the stored access token. Previously synced financial data stays in your account until you delete it or your account is deleted.
• When you ask us to delete your account: we delete your account and all synced financial data within 30 days, except records we must keep for tax, billing, or legal reasons (for example invoices from Stripe), which we keep for up to 7 years.
• Backups: deleted data may persist in encrypted backups for up to 30 days after deletion.

7. Your choices and rights

• Disconnect anytime. Remove QuickBooks or any bank from Settings, or revoke our access from your Intuit account or through Plaid.
• Delete your data. Email hello@balancesheets.com from the address on your account and ask. We will confirm when it is done.
• Get a copy. Ask and we will send you an export of your account data.
• Correct it. Your financial data comes from QuickBooks and your bank; fix it there and we will pick up the change on the next sync. Profile details can be changed in Settings.
• Marketing emails. We only send product and account emails. Every non-essential email has an unsubscribe link.

Residents of Canada have rights under PIPEDA, and residents of certain US states have rights under state privacy laws. We honor these for everyone, regardless of where you live.

8. Cookies

We use a session cookie to keep you signed in and a small number of analytics cookies to understand how the site is used. We do not use advertising cookies. You can block cookies in your browser; signing in will not work without the session cookie.

9. Security

Access tokens for QuickBooks and Plaid are encrypted with AES-256-GCM before they are stored. Data is encrypted in transit with TLS. Details are on our security page. No system is perfectly secure; if we learn of a breach affecting your data we will tell you promptly.

10. Children

BalanceSheets is for businesses. We do not knowingly collect data from anyone under 18.

11. Changes

If we change this policy in a way that matters, we will email account holders and update the date at the top. Continued use after the change means you accept it.

12. Contact

BalanceSheets, operated by Shail Silver, Ontario, Canada. Email hello@balancesheets.com with any question or request about your data.

Effective October 29, 2026.