1. About Balysta

Balysta is an AI platform in test phase. The platform uses Artificial Intelligence (AI) to extract and structure data from Brazilian balance sheets (Balanço Patrimonial and related statements). This Privacy Policy explains how we process, store, and protect user data during this test phase. This Privacy Policy should be read together with Balysta's Terms of Service.

1.1. Balysta's Role in Data Processing

For documents uploaded by users, Balysta acts predominantly as a Data Processor, processing personal information on behalf of the user, who acts as the Controller, exclusively in accordance with the technical purposes described in this Privacy Policy.

2. Data We Process

• Account Data: email address and invitation details used to grant login access via one-time password (OTP).
• Uploaded Documents: PDF files uploaded by users containing Brazilian balance sheet data.
• Metadata & Logs: technical information (e.g., file name, upload time, processing logs, anonymized or aggregated usage data, when technically possible) to improve platform performance.
• Personal Data: While Balysta does not actively request personal data, uploaded documents may incidentally include personal information (e.g., accountants' names, CPFs, signatures). Users are responsible for ensuring they have the legal right or consent to upload any documents containing personal data of third parties.

3. Purpose of Processing

We process data in order to: Extract, standardize, and analyze financial information. Provide structured outputs for further processing. Improve the accuracy, reliability, and performance of the platform through analysis of logs and anonymized data. Balysta does not use documents uploaded by users to train general-purpose artificial intelligence models. Processing occurs in an isolated manner and exclusively for extraction, structuring, and analysis purposes as requested by the user.

4. Legal Basis for Processing

We rely on the following legal bases under the LGPD:

• Contract execution: necessary to provide the service requested by the user.
• Consent: by uploading documents, the user consents to their processing for extraction purposes.
• Legitimate interest: analysis of anonymized data and logs to improve platform functionality and security.
• Legal obligations: if required to comply with applicable law.

5. External Services & International Transfers

To operate the platform, Balysta may rely on trusted third-party service providers for: Secure hosting and data storage. Automated document and language processing (which may occur in the EU or USA). Privacy-friendly, self-hosted usage statistics. Cookie consent management (Cookiebot). Some processing may involve transfers of data outside Brazil. In these cases, we apply safeguards consistent with the LGPD to protect personal data.

5.1. WhatsApp Contact

We offer the option to contact us via WhatsApp through an external link (wa.me). By clicking the WhatsApp button, you will be redirected to the WhatsApp platform, operated by Meta Platforms, Inc. In this context, WhatsApp may process personal data such as your phone number, message content, and technical metadata (e.g., device information). Data processing by WhatsApp is subject to Meta's Privacy Policy (https://www.whatsapp.com/legal/privacy-policy).

We process the information you provide via WhatsApp exclusively for handling inquiries and customer communication. Messages are retained only as long as necessary for these purposes.

WhatsApp contact is optional. You may also reach us via email at [email protected].

Legal Basis (GDPR): Art. 6(1)(b) (pre-contractual communication / contract performance) and/or Art. 6(1)(f) (legitimate interest in efficient communication with customers and prospects).

Legal Basis (LGPD): Art. 7, V (contract execution / preliminary procedures related to a contract) and/or Art. 7, IX (legitimate interests), as applicable.

Personal data may be transferred to the USA. Meta participates in the EU-US Data Privacy Framework, which provides adequate safeguards for such transfers.

6. Data Retention & Security

6.1. Data Retention

• Data is stored securely with restricted access.
• During the Alpha phase, uploaded documents and associated data are retained only for the time necessary for testing and validation of the platform, and may be deleted at any time upon user request, unless legally required to be retained.
• Logs and anonymized usage statistics may be retained for longer periods for service improvement.

6.2. Security Measures

Balysta adopts appropriate technical and organizational measures to protect processed data, including, where applicable:

• encryption of data in transit and at rest;
• access control restricted to authorized personnel;
• logical environment segregation;
• monitoring and logging of technical activities.

6.3. Security Incidents

In the event of a security incident that may pose a risk or relevant harm to data subjects, Balysta will take appropriate measures to mitigate the impact and will notify affected users and, where applicable, the National Data Protection Authority (ANPD), as required by the LGPD.

7. User Rights (LGPD)

Under the LGPD, users may request at any time:

• Access to their data.
• Correction of inaccurate information.
• Deletion of documents or personal data.
• Information about how and with whom their data is shared.
• Revocation of consent.
• Balysta will make reasonable efforts to respond to requests within the legal timeframe provided by the LGPD.

8. Updates

This Privacy Policy may be updated as the project evolves. The latest version will always be available on our website.