Clear about your data.

Who we are and what this covers

Balance Eco Ltd (“Balance”, “we”, “us”) is the controller of the personal data described here unless we say otherwise. Our address is 20 Chamberlain Street, Wells, Somerset BA5 2PF, United Kingdom.

This policy covers the Chant by Balance app; Balance ID; balance.eco and related Balance websites; the Chant and Forests workspaces and content-management tools; forest, calculator, form, certificate and impact services; and related support and communications (the “Services”).

Where an organisation uses a Balance workspace to manage its own contacts, staff or customers, that organisation may control some records and Balance may act on its instructions. Ask the organisation first if your relationship is primarily with it.

Data we collect

• Account and identity data: name, display name, email, password hash, verification and account status, profile image, workspace roles and permissions, and identifiers received from Apple or Google if you choose social sign-in.
• Chant and music data: your voice recording, recording name, selected track or event, duration and time, limited client metadata, submission and production status, project assignment, messages or notes, delivered mixes and participation records.
• Forest and impact data: selected forests, tree or Balance Unit allocations, holdings, certificates, planting invitations, notifications and related transaction or impact records.
• Calculator, form and business data: answers such as sector, turnover or emissions information, contact and organisation details, source page, estimates, enquiries, contracts, sales and customer records.
• Communications data: support messages, notification choices, email delivery records, push token, device platform and optional device name.
• Technical and security data: session/token records, essential cookies or local preferences, hashed IP or request fingerprints, user agent, request ID, timestamps, audit events, access history and security/error logs.
• CMS and workspace data: profiles, invitations, catalogue and artist records, uploaded artwork/media, project activity, forest-manager and customer contacts, content, notes and audit history.

Device permissions and local data

Microphone access is used when you record. Camera or photo access is used when you choose a profile image or save a certificate. Biometrics are checked by your device to unlock locally stored sign-in credentials; Balance does not receive your fingerprint or face data. Tokens, app preferences and cached material may be stored on your device.

Location is requested only after you choose a nearby-forest feature. The app obtains a one-time position and compares it with public forest coordinates on the device. Balance does not receive those coordinates through that feature. Apple Maps or Google Maps processes your use under its own policy if you choose to open it.

You can withdraw a device permission in system settings, although the related feature may stop working.

How and why we use data

• Contract: to create and secure accounts, accept and manage Chants, produce/deliver mixes, allocate impact, provide certificates and workspaces, give support and enforce applicable terms.
• Legitimate interests: to operate, improve and protect the Services; administer content and projects; keep proportionate audit trails; prevent fraud and abuse; understand aggregate performance; and communicate with business contacts. We balance these interests against your rights.
• Consent: for optional direct marketing, device permissions where requested, and any processing that a participation flow expressly bases on consent. Withdrawal does not affect earlier lawful processing.
• Legal obligation: to meet tax, accounting, regulatory, safeguarding, law-enforcement and data-protection duties.
• Legal claims or substantial public interests where applicable: to establish, exercise or defend rights and protect people and the public.

Voice recordings and finished works

A submitted recording can be reviewed by authorised producers and workspace users and combined with other contributions. Depending on the Chant, a resulting mix or audio-visual work may be played at an event, streamed, broadcast, exhibited, delivered to participants or released publicly. Any display-name credit depends on the applicable participation terms and product design.

You may delete an unincorporated recording using available controls. Once incorporated into a finished or publicly distributed work, isolating it may be impossible or disproportionate. Account deletion therefore does not necessarily require recall or alteration of lawfully created fixed works, although we remove or de-identify underlying account data where required.

Where data comes from

Most data comes directly from you. We may also receive identity data from Apple or Google; workspace details from your employer, client, rights owner or administrator; forest and impact information from forest managers and delivery partners; and technical/security information from browsers, devices and systems. Public botanical or forest data may come from Kew WCVP/POWO, ChecklistBank or GBIF.

Who we share data with

• Providers that host infrastructure, databases and private media; send transactional email; scan or secure uploads; support authentication; deliver support; and maintain the Services.
• Apple and Google for chosen sign-in; Expo and the relevant Apple or Google push service when push is enabled; and Apple Maps or Google Maps when opened.
• Authorised producers, artists, rights owners and workspace users needing a recording or project data to administer a Chant and create or deliver the work.
• Forest managers, planting and impact partners where necessary to allocate, evidence or update a tree, forest visit, certificate or Balance impact.
• Your organisation or workspace administrator for an employer/client account, or another organisation when you ask us to connect with it.
• Professional advisers, insurers, auditors, regulators, courts, law enforcement and potential transaction counterparties where necessary and lawful.

We require processors to protect data and use it only for authorised purposes, and we share the minimum reasonably necessary. We do not sell personal data.

Public information and third-party links

Published forest pages, updates, certificates, artist/catalogue material and finished Chant works can be public by design. The relevant flow will tell you where your contribution is intended for public use. Public information may be copied or indexed by others.

The Services may link to websites, bookings, videos, maps, app stores, botanical databases and social platforms controlled by others. Their privacy practices apply when you leave Balance.

Cookies and similar technology

Balance ID and authenticated workspaces use strictly necessary cookies or equivalent storage for secure sessions, OAuth continuity, cross-site request protection and essential preferences. The app uses secure device storage, local storage and caches for authentication and your settings.

Public websites may also use analytics or other non-essential technology. Where consent is required, these should remain off until chosen, and choices can be changed through the relevant website controls. Blocking essential storage may stop sign-in or requested features.

International transfers

Some providers or authorised recipients may process data outside the UK. Where transfer rules apply, we use a lawful mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard clauses, together with an appropriate data-protection assessment and supplementary safeguards where required. Contact us for information about a safeguard relevant to your data.

How long we keep data

• Account/profile data is normally kept while an account is active and then deleted or de-identified, except for records still needed below.
• Raw Chant audio and project material is kept for submission, production, delivery and applicable participation terms. Unassigned recordings can be deleted; evidence linked to a delivered work may be retained to administer rights and defend claims.
• Push tokens remain until removed, replaced or invalid. Session/action tokens expire automatically; proportionate security/audit records remain based on risk and accountability needs.
• Contracts, transactions, impact allocations, certificates and essential audit evidence remain for applicable legal, accounting, certification and limitation periods.
• Calculator submissions, enquiries and workspace content remain for their purpose and are then deleted, aggregated or de-identified under our retention schedule.
• Backups rotate on a controlled cycle. Deleted live data may remain protected until a backup expires and is not restored except for recovery.

Periods reflect the amount and sensitivity of data, purpose, expectations, security risk, and legal or contractual requirements.

Your rights

Depending on the circumstances, you may ask for access, correction, erasure, restriction or portability; object to legitimate-interest processing or direct marketing; and withdraw consent. Some rights are limited where we must retain data, protect someone else, preserve legal claims or continue lawful use of a fixed collective work.

To exercise another right, email enquiries@balance.eco. We may verify your identity and clarify the data concerned. You may complain to the UK Information Commissioner’s Office at ico.org.uk.

Children

The Services are not directed to children under 13. If you are under 13, do not create an account or submit a recording. If you are 13 to 17, ask a parent or guardian to review this policy and the relevant participation terms with you; a particular Chant may set a higher age requirement. Contact us if you believe a child has provided data contrary to these rules.

Security and changes

We use access controls, secure transport, password hashing, short-lived authorisation, private media storage, logging, upload controls and other measures appropriate to risk. No service is completely secure, so use a strong unique password and tell us promptly about suspected misuse.

We may update this policy as the Services or law change. We will post the revised date and give additional notice where a change materially affects rights or choices.

Contact