Privacy Policy

1. Introduction

This Privacy Policy explains what data we collect when you use the service, how we use and store it, and what your rights are. This policy is drafted in accordance with the Protection of Privacy Law, 5741-1981, including Amendment 13 thereto, and the regulations enacted under it.

Database controller and privacy contact: balansi.co.il, email: support@balansi.co.il. Privacy and rights-related inquiries will be answered within a reasonable time and no later than 30 days.

Providing information — voluntary: you are under no legal obligation to provide us with personal information; providing it depends on your will and consent. However, without basic account data (an email address) we cannot provide the service, and without financial data you choose to enter we cannot display summaries, budgets, and insights. Not using a particular feature (for example, payslip reading) does not prevent you from using the rest of the service.

This policy was drafted in Hebrew, and the Hebrew version is the sole binding version. The Russian and English translations are provided for your convenience only; in the event of any contradiction or inconsistency — the Hebrew version shall prevail.

2. What data is collected

Account data: email address, display name, and preferred interface language. If you registered via Google, we receive basic identifying details from your Google account.

Financial data you enter: transactions, balances, categories, budgets, and goals.

Payslip data: when you choose to use the payslip-reading feature, we store only a limited numeric summary (see Section 6). The payslip image itself is not stored in our systems.

Profile details and preferences: date of birth and profile picture (if provided); financial-profile details you filled in voluntarily (such as monthly income range, number of dependents, life stage, savings goals, and preferred risk level) used to personalize insights; as well as accessibility, language, and display settings.

Chat history: the content of the messages you write to the AI assistant and the responses received are stored in your account to allow conversations to continue, subject to a retention quota under which old conversations are deleted. You can delete conversations at any time, and we recommend not entering sensitive identifying details in the chat that are not needed.

Technical data: when you use the service, data required for its operation and security is collected automatically — including IP address, browser and device data, access logs, and an in-account activity log — used solely for security, abuse prevention, and troubleshooting, and retained for a limited period. When you upload a screenshot, a digital fingerprint (hash) of the file is stored — without the image itself — to prevent duplicate ingestion, along with the identified source of the screenshot (such as the bank app's name).

3. No bank connection

The service does not connect to your bank accounts or credit cards and does not pull data from financial institutions. All data is entered by you — manually or by reading a screenshot that you upload. This is a deliberate choice intended to protect your privacy.

4. How data is used

We use the data to operate the service and present it to you: to calculate summaries, manage budgets and goals, and generate insights.

We do not sell your data. As of today, we do not use third-party analytics tools for advertising purposes, and we do not perform advertising tracking.

Operational messages: we send operational emails only — such as email verification, password reset, and essential account notifications — via an external email-delivery provider acting as a data processor on our behalf (see Section 5). We do not send advertising material by email without prior express, separate, and documented consent.

5. Artificial intelligence, infrastructure providers, and processing outside Israel

Some features analyze your data using artificial-intelligence services whose servers are located outside Israel as well (including in the United States). As part of this, the following are sent for processing: (a) processed numeric financial summaries, together with the category names you defined — to produce insights, forecasts, and reports; (b) messages you write in the AI chat; (c) images you choose to upload for automatic reading — transaction screenshots and payslip images. The images are sent for one-time processing solely to extract the data, and are not stored in our systems after processing. Please note: screenshots and payslips may include identifying details (such as a name, national ID number, or bank account details); we recommend redacting details that are not needed before uploading.

The primary AI provider is Google (Gemini), and in certain configurations OpenAI. We use these providers' paid API services, under whose terms the provider undertakes not to use the submitted content to train its models and processes the data for us and for the provision of the service only; the provider may retain requests for a limited period for security and policy-enforcement purposes, in accordance with its terms.

Some analyses and insights are generated automatically in the course of using the service (for example, when the dashboard loads). These outputs are informational recommendations only: the service does not make automated decisions about you that have legal effect or a similarly material impact. You may contact us to request that AI processing of your data be limited.

Storage and infrastructure: the service is hosted on cloud infrastructure of international providers — Vercel (application hosting and operation), Neon (database storage), and Resend (delivery of operational emails) — and therefore your data, including the financial data you enter, is stored and processed on servers outside Israel, mainly in the United States and the European Union. We engage these providers under data-processing agreements binding them to confidentiality, information security, and processing for us only, in accordance with the Privacy Protection Regulations (Transfer of Data to Databases Abroad), 5761-2001.

By checking the consent box, you give express consent to the storage and processing of your data outside Israel as described above. You may withdraw your consent at any time by contacting us or by requesting the deletion of your account; withdrawing consent may prevent the continued provision of the service.

6. Payslips (Amendment 13)

The payslip image is never stored in our systems at any stage — it is sent for one-time processing by the artificial-intelligence service to extract the data (as described in Section 5), and after processing it is not retained by us.

We store only a numeric summary according to an allow-list: such as gross salary, insured salary ("shachar mevutach"), net pay, tax deductions, pension contribution percentages, and tax credit points. We do not store the payslip image, the national ID number, the employee's or employer's name, or bank account details.

Storing the summary is conditional on your explicit and separate consent. Summaries are retained for no more than 24 months, and can be deleted manually at any time.

7. Data retention

We retain your data for as long as your account is active and as required to operate the service. Payslip summaries are retained for no more than 24 months and are deleted as part of routine cleanup processes; chat history is subject to a retention quota under which old conversations are deleted.

Upon deletion of your account, we will delete or anonymize your data, except for information we are required to retain by law. An account-deletion request may be submitted at any time, as set out in Section 9.

8. Information security

We implement security measures in accordance with the Privacy Protection Regulations (Data Security), 5777-2017, at the security level applicable to the database, including transport encryption, encryption of data at rest with our infrastructure providers, access and permission controls, and security-event logging. Your financial data is classified as data of special sensitivity, and we treat it accordingly.

Although we invest effort in security, no system is entirely immune, and we cannot guarantee absolute security.

9. Your rights

Subject to law, you have the right to access your data, to request its correction, and to request its deletion.

A full export of your data, in JSON format, is available at any time directly from the account settings in the app. Full account deletion is also available directly in the app: a household owner can delete the entire household, including all accounts linked to it, while a household member can delete only their own personal account. Deletion is immediate and irreversible.

Alongside these self-service options, you may always contact us with a request at the address in Section 13 — including for actions not available via self-service. Such requests will be handled within a reasonable time and no later than 30 days, in accordance with Sections 13–14 of the Protection of Privacy Law.

You may also withdraw any consent you have given at any time (as stated in Section 5). If you are dissatisfied with how your data is handled, you may contact us as well as the Privacy Protection Authority.

10. Cookies and local storage

We use several essential cookies to manage and secure the login session (including a session cookie, a CSRF security cookie, and temporary cookies during the Google sign-in flow), a cookie that stores your chosen interface language, and browser local storage to save preferences (such as accessibility settings and display mode).

As of today, we do not use advertising cookies or third-party tracking.

11. Minors

The service is not intended for use by minors under the age of 18, and registration requires confirming that you are 18 or older. We do not knowingly collect information from minors.

12. Changes to the policy

We may update this policy from time to time. A material change will take effect for you only after we present a prominent notice within the application and obtain your renewed express consent. Non-material changes (such as wording corrections and clarifications) take effect upon their publication and update of the "last updated" date.

13. Contact

For any question or request regarding your privacy and your data, you may contact us at support@balansi.co.il.