Privacy Policy • Balzac

Balzac ("we", "us", "our") is operated by Bromance Software SRL, a company incorporated in Belgium. This privacy policy explains how we collect, use, store, share, and protect your personal data when you use our website (hirebalzac.ai), web application (app.hirebalzac.ai), CLI, MCP server, API, and related services (collectively, the "Service").

By using the Service, you agree to the practices described in this policy.

1. Data We Collect

1.1 Account Information

When you create an account, we collect your name, email address, phone number (if provided), company information, and password. If you sign up via a third-party provider (e.g., Google), we receive your name, email address, and profile picture from that provider.

1.2 Payment Information

Payment processing is handled by Stripe. We do not store your credit card numbers. Stripe provides us with a token, your card's last four digits, and billing address for record-keeping.

1.3 Workspace and Content Data

When you use the Service, we collect and store data you provide, including:

Domain names and website URLs you add to workspaces
Keywords, article content, briefings, and suggestions generated by the Service
CMS integration credentials (WordPress, Webflow, Wix, GoHighLevel, webhooks) you configure
Competitor domains and reference links you add

1.4 Google User Data

If you connect your Google Search Console account, Balzac accesses the following Google user data through Google APIs:

Search Console data: Search performance data (queries, clicks, impressions, CTR, average position), indexed pages, and sitemap information for the domains you have verified in Google Search Console.

We access this data solely to provide SEO analytics and keyword research features within the Service. See Section 2.2 for details on how this data is used.

1.5 Usage Data

We automatically collect certain information when you use the Service, including:

Log data (IP address, browser type, pages visited, referring URLs)
Device information (operating system, screen resolution)
Usage information (features used, actions taken)
Cookies and similar technologies (see Section 7)

We use Google Analytics and Google Tag Manager for analytics purposes.

1.6 API and CLI Usage

When you interact with the Service via our API or CLI, we log API requests (endpoints called, timestamps, and response codes) for debugging, rate limiting, and abuse prevention. We do not log request or response bodies beyond what is necessary for the Service to function.

1.7 AI Connectors

When you connect Balzac to an AI app such as Claude or ChatGPT, the app sends Balzac the requests it makes on your behalf, such as which workspace to list or which article to publish, through our MCP server at mcp.hirebalzac.ai. We receive only those requests and their parameters, never your conversation history, memory, or files, and we handle them like any other API request (see 1.6). The MCP server logs which tool was called, when, and the response status. For each connected app we store an OAuth access token, hashed at rest, which is revoked when you disconnect the app from your profile or delete your account. What Balzac returns to the AI app is then handled under that app's privacy policy.

2. How We Use Your Data

2.1 Service Operation

We use your data to:

Provide, maintain, and improve the Service
Improve and personalize user experience
Generate keyword research, article suggestions, and SEO/GEO-optimized content
Publish content to your connected CMS integrations
Process payments and manage your subscription
Communicate with you about our services
Send transactional emails (account confirmations, password resets, billing notifications)
Analyze usage of our services
Provide customer support
Comply with legal obligations

2.2 Google User Data Usage

Google Search Console data is used exclusively to:

Display search performance metrics within your Balzac dashboard
Identify keyword opportunities based on your site's actual search performance
Provide recommendations for content optimization

We do not use Google user data for advertising, marketing to third parties, or any purpose unrelated to providing the Service. We do not use Google user data to train AI or machine learning models.

2.3 Analytics

We use aggregated and anonymized usage data to understand how users interact with the Service, identify bugs, and improve features.

3. Data Sharing

We do not sell your personal data. We share data only in the following circumstances:

3.1 Service Providers

We share data with trusted third-party service providers who assist us in operating the Service:

Stripe — Payment processing
Google Cloud / Google APIs — Search Console data access (when you connect your account)
OpenAI / Anthropic — AI content generation (article text, keyword analysis). We send workspace context (domain, keywords, topic) to generate content. No personally identifiable user information is sent.
Cloudflare — Hosting, CDN, and security

3.2 CMS Integrations

When you publish content through the Service, article content is sent to the CMS platforms you have configured (WordPress, Webflow, Wix, GoHighLevel, or your custom webhook endpoints). This is initiated by you and uses the credentials you provide.

3.3 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your data may be transferred as part of that transaction. We will notify you of any such change.

3.4 Legal Requirements

We may disclose your data if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Balzac, its users, or the public.

3.5 Google User Data Sharing

Google Search Console data is not shared with any third parties. It is used solely within the Balzac Service to provide analytics and recommendations to you, the account holder.

4. Data Storage and Protection

4.1 Infrastructure

Your data is stored on servers located in the European Union. We use Cloudflare for edge security and DDoS protection.

4.2 Security Measures

We implement industry-standard security practices to protect your data:

All data is transmitted over HTTPS/TLS encryption
Passwords are hashed using bcrypt
API keys are hashed at rest
CMS integration credentials are encrypted at rest
Access to production systems is restricted to authorized personnel with multi-factor authentication
We perform regular security reviews

4.3 Google User Data Storage

Google Search Console data retrieved through Google APIs is cached temporarily (up to 24 hours) to improve performance and reduce API calls. It is stored in the same secure infrastructure as other Service data and is subject to the same security measures. We do not store Google user data longer than necessary to provide the Service features.

5. Data Retention and Deletion

5.1 Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specifically:

Account data: Retained while your account is active
Content data (articles, keywords, briefings): Retained while your account is active
Google Search Console data: Cached for up to 24 hours, then refreshed or deleted
Payment records: Retained as required by applicable tax and accounting laws (typically 7 years)
Usage logs: Retained for up to 90 days

5.2 Account Deletion

You can request deletion of your account and associated data at any time by contacting us at [email protected]. After verification of your identity, a written confirmation of the correct deletion will be provided. Upon receiving your request:

Your account and all associated workspaces, articles, keywords, and integrations will be permanently deleted within 28 days
Google Search Console data and OAuth tokens will be immediately revoked and deleted
Backup copies may persist for up to 90 days before being automatically purged
We may retain certain data as required by law (e.g., billing records)

5.3 Google OAuth Revocation

You can revoke Balzac's access to your Google data at any time through your Google Account permissions page. Upon revocation, we will delete all cached Google data within 24 hours.

6. Your Rights

Under the General Data Protection Regulation (GDPR) and applicable Belgian and EU law, you have the right to:

Access your personal data
Rectify inaccurate or incomplete data
Erase your data ("right to be forgotten")
Restrict processing of your data
Port your data to another service
Object to processing of your data
Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

7. Cookies

We use cookies and similar technologies for:

Essential cookies: Session management, authentication
Analytics cookies: Google Analytics to understand usage patterns
Preference cookies: Theme settings (light/dark mode)

You can manage cookie preferences through your browser settings.

8. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of these websites and encourage you to review their privacy policies.

9. Children's Privacy

The Service is not intended for use by individuals under the age of 13 ("Children"). We do not knowingly collect personally identifiable information from children under 13. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us. If we become aware that we have collected personal information from a child under 13 without verification of parental consent, we will take steps to remove that information from our servers.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by email or by posting a notice on our website. The "Last updated" date at the top of this page indicates when this policy was last revised.

11. Google API Services Disclosure

Balzac's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

12. Contact

If you have questions about this privacy policy or our data practices, contact us at:

Bromance Software SRL
VAT: BE1040.904.426
Email: [email protected]
Website: hirebalzac.ai