Privacy Policy

This Privacy Policy describes how Ballad Labs, Inc. (“Ballad,” “we,” or “us”) collects, uses, and shares personal data when you use our website at balladlabs.com, the Ballad web application, our Slack integration, ballad.to hub pages, the content API, the agent API, and related services (together, the “Service”). It also covers the beacon that customers place on their own websites and the analytics on ballad.to pages.

1. Data we collect

Data you give us

• Account data: your name, email address, profile image, and sign-in details (for example from Google sign-in), plus your organization and team details.
• Business context: positioning, product descriptions, audience details, and other material you enter so Ballad can plan and write for you.
• Voice samples and edits: writing you provide, and the edits, approvals, and rejections you make to drafts. These teach Ballad your voice.
• Communications: messages you send us, including support requests and abuse reports.

Data from accounts and systems you connect

When you connect LinkedIn, X, Slack, your website, an analytics provider, Google Search Console, a CRM, an email tool, an advertising platform, or another service, we receive the data that service makes available under the permissions you grant, and we send it the data the integration needs. Depending on the service this can include your profile, your posts, engagement on them (likes, replies, reposts), follower counts, page views and conversion events, search-ranking data, and records of the people and companies in your pipeline. We only use these permissions to provide the Service, and you can revoke them at any time.

Agents and tools you authorize

You can let an AI assistant or other software act on your workspace through the agent API, by creating an agent key or authorizing a client with OAuth. It can then read and act on your workspace data within the scopes you grant — for example reading drafts and contacts, creating drafts, or marking a post published. Every call is recorded in your audit log, and you can revoke a key or client in Settings at any time.

Data collected automatically

• Usage data: how you use the Service, pages viewed, actions taken, and diagnostic logs.
• Device and log data: IP address, browser type, operating system, referrer, and timestamps.
• Signals from your published content: when a customer installs Ballad's beacon on their website or uses a ballad.to page, we collect visit, click, and conversion events from visitors to those pages, and — only when the customer's site passes it — the identity of a person who converted (see section 6).

2. How we use data

We use personal data to:

• provide the Service: plan content, generate drafts in your voice, publish to channels you connect, measure results, and attribute visits, signups, and pipeline to the content that produced them;
• at your direction, pass contacts, attribution, and content to the business systems you connect, such as a CRM, an email tool, or an advertising platform;
• learn your voice and improve the plan for your account. Your content, voice samples, and edits are not used to train models that serve other customers;
• operate, secure, debug, and improve the Service, including aggregate product analytics;
• communicate with you about your account, the beta, and changes to the Service;
• comply with law and enforce our Terms.

3. AI model providers

Ballad generates content and analysis using third-party AI model providers. To do so, we send them the relevant context, which may include your business information, voice samples, drafts, and signals. We use providers under agreements that restrict use of your data to providing the service to us and that prohibit training on it. We do not permit providers to use your data to train their general models.

4. How we share data

We share personal data only:

• With platforms and systems you connect, when you direct Ballad to publish, read, post, or sync through them — a CRM you connect, for example, receives the contacts and attribution data the integration needs;
• With agents and tools you authorize, within the scopes you grant them;
• With service providers who help us run the Service (hosting, databases, email delivery, analytics, error monitoring, AI model providers), bound by confidentiality and data-processing obligations;
• Publicly, at your direction: content you approve for publication, and the profile information you choose to show on a ballad.to page;
• For legal reasons, where required by law or to protect the rights, safety, or property of Ballad, our users, or others;
• In a business transfer, such as a merger, acquisition, or sale of assets, subject to this policy.

We do not sell personal data.

5. Cookies and analytics

We use cookies and similar technologies that are necessary to sign you in and keep the Service working, and privacy-respecting product analytics to understand usage in aggregate. We do not use third-party advertising cookies. You can control cookies through your browser settings; disabling essential cookies may prevent you from signing in.

6. Visitors to customers' sites and ballad.to pages

If you arrive at a website or ballad.to page that uses Ballad, our beacon records the page you landed on and later pages in the same visit, clicks on links or calls to action, any conversion the site owner has chosen to count (for example a signup), the site you came from, a Ballad link token if you followed one, a timestamp, and your country and an approximate location (rounded to about 10 kilometres). Your IP address is used at the edge to derive that location and is not stored; your browser's user agent is used to filter automated traffic and is not stored. So that a later signup can be credited to the content that first brought you, the beacon keeps a note of your first and most recent arrival in your own browser, on the site's own domain, for 90 days. We do not build cross-site profiles of visitors.

If the site owner tells us who you are. A site owner may choose to pass your email address, and optionally your name and company, in one of three ways: when you convert, typically the details you just entered on their signup form; when you sign in to their product, so that a visit your browser already carried can be tied to you; or by importing their own customer records into Ballad. When they do, Ballad keeps a contact record for that site owner: those details, the content that first brought you and the last content you saw before converting where the beacon saw it or an import could match your signup to a visit it had recorded, which conversions you completed, and your country. The site owner uses this to see which content leads to customers, and may direct Ballad to pass the record to their own business systems, such as their CRM. Nothing identifying is collected unless the site owner passes it.

Global Privacy Control. If your browser sends a Global Privacy Control signal, the beacon stores nothing in your browser and sends nothing identifying, even if the site owner would otherwise pass your details. Your visit and conversion are still counted, anonymously. An import from the site owner's own records happens outside your browser, so the signal cannot reach it; what the site owner imports is governed by their own policy toward you.

The site owner is the controller of this data; Ballad processes it on their behalf. To access, correct, or delete your data, contact the site owner, who can do so in Ballad or ask us to. You can also reach us at legal@balladlabs.com, and we will help the site owner respond.

7. Retention

We keep personal data for as long as your account is active and as needed to provide the Service. When you delete your account, we delete or anonymize your account data, business context, voice samples, and drafts within 30 days, except where we must retain data to comply with law, resolve disputes, or enforce our agreements. Content already published through your own accounts is not affected. Backups are purged on a rolling schedule.

Individual visit and conversion events from customers' sites are kept for up to 180 days and then reduced to daily totals. Contact records, however they were created, are kept while the site owner's account is active, or until the site owner deletes them.

8. Security

We protect data with encryption in transit and at rest, access controls, and monitoring, and we scope connected-account permissions to what the Service needs. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as required by law.

9. Your rights and choices

Depending on where you live, you may have the right to access, correct, export, restrict, or delete your personal data, or to object to certain processing. You can update account details and disconnect connected accounts in the Service, and delete your account at any time. To exercise other rights, email legal@balladlabs.com. We will respond within the time required by applicable law. If you are in the EEA, UK, or Switzerland, you also have the right to lodge a complaint with your local supervisory authority.

10. International transfers

Ballad is based in the United States and processes data there and in other countries where our providers operate. Where required, we rely on appropriate safeguards, such as standard contractual clauses, for transfers out of the EEA, UK, and Switzerland.

11. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. If a change is material, we will notify you by email or in the Service before it takes effect. The effective date at the top shows when it was last revised.

Contact

Ballad Labs, Inc.
legal@balladlabs.com