What this policy covers
This policy describes how Blupp Infotech Private Limited handles information when you use BalanceSheet's website, app, CLI, and MCP connection service. It also explains the current limits of data removal.
Information we process
- Account information: your email address, profile name, account identifiers, and verification status. Passwords you submit pass through the service to Loomup for authentication. Verification and password-reset links also contain tokens.
- Financial records: titles, dates, amounts, currencies, categories, notes, and the workspace they belong to. Optional payment details include method labels and the last four digits of a card. These fields do not connect to your bank or process payments.
- Documents: files you upload, their contents, names, types, sizes, and the records they are attached to. Notes and documents may contain personal information you choose to include.
- Collaboration: workspace names, memberships, roles, invitation email addresses and status, and identifiers and timestamps associated with creation or changes.
- Sessions and connections: authentication cookies, access and refresh tokens, authorized client details and permissions, and connection expiry information. The CLI stores session credentials locally on your device; the connection service stores sessions needed to access the app.
- Operational information: request and error information used to run and troubleshoot the service. Hosting and service providers also process technical connection information, such as IP addresses and request metadata, to deliver their services. If you email us, we receive your address and the contents of your message.
How information is used
We use this information to create and authenticate accounts, store and display records and documents, calculate totals, apply workspace permissions, support authorized connections, send verification, recovery and invitation emails, and operate and troubleshoot the service. Information you send to our contact email is used to address your message.
We do not sell your personal information or use it for advertising or training our own AI models. We do not operate additional product-analytics or advertising integrations. These statements describe our own practices, not the independent practices of providers or clients you choose to connect.
Providers, workspace access, and connected clients
Cloudflare hosts the website and application services, including connection-session infrastructure. Loomup provides authentication, application data and document storage, and managed email delivery. These providers process information to deliver those functions. We do not promise that all processing or storage takes place in India.
Your personal workspace is not shared with other workspace members. Company workspace members can access information according to their roles. This access control does not mean the operator or infrastructure providers are technically unable to process the stored data.
Authorizing a CLI or AI/MCP client gives it read access to data available to your account. Granting write access also permits changes allowed by your workspace role. Data returned to a connected client is subject to that client's handling, retention, and any AI-provider policies. Ending a connection does not remove copies already received by the client.
Cookies and local storage
The app uses cookies to maintain your signed-in session. The connection authorization screen uses a cookie to protect form submissions. The browser also uses local storage to coordinate sign-out between tabs. These mechanisms support authentication and app operation; they are not advertising cookies.
Retention and removal
Account information and workspace data are stored to provide the service. Removing a record or attachment hides it from the app but does not permanently erase the underlying stored data or files. Archived categories and payment methods also remain stored.
There is currently no automatic purge schedule for removed records or files and no self-service account deletion. We do not specify a fixed retention period for all account data, records, files, or provider logs. Signing out or revoking a client connection is not account deletion.
Security and your choices
The app uses HTTPS, authenticated document access, and workspace permission checks. These measures do not guarantee that information can never be lost, accessed without authorization, or disclosed. Protect your account credentials, review workspace access and client permissions, and only upload information you are authorized to store.
You can edit records when your workspace role permits it. Workspace owners can manage team access. You can send privacy questions and requests, including requests about access, correction, or deletion, to mohit@blupp.co. The contact address does not change the current removal and retention behavior described above. Your rights under applicable law are unaffected by this description.
Policy updates
Changes to this policy will be published here with an updated date. For questions, contact mohit@blupp.co.