Privacy Policy

1. Introduction

TriBalance LLC (“we,” “us,” or “our”) is committed to protecting the privacy and security of your data. This Privacy Policy explains how we collect, use, store, and protect information when you use TriBalance (“the Service”).

Trust account data is among the most sensitive information a law firm handles. We treat it accordingly.

2. Information We Collect

2.1 Information You Provide

• Account information: Name, email address, law firm name, product role, and, for attorney users, an optional bar number, when an account is provisioned for you.
• Billing information: When you start a subscription, your billing contact details, billing address, and payment card information are collected and processed directly by Stripe, our payment provider. TriBalance does not store full payment card numbers.
• Trust account data: Bank statements, transaction records, client ledgers, reconciliation reports, and all other documents and data you upload to or generate through the Service.
• Communications: Any messages, inquiries, or support requests you send to us.
• Website request forms: If you request materials through our public site (for example, the Trust Close Packet Stress Test) or request a guided first close, we collect the name, email address, firm name, and any qualification details you provide (such as role, plan interest, number of trust accounts, or preferred start month). We use this information to deliver the requested materials and to follow up with you about the Service.

2.2 Information Collected Automatically

• Server and security logs: IP address, browser type, device and request metadata, login timestamps, session information, and security-related events, retained for security and operations.
• Website and product analytics: We use Google Analytics 4 and Google Tag Manager to measure page views, traffic sources, content engagement, and funnel events such as guided-first-close form starts and successful requests. We do not send trust-account records, uploaded document contents, form-field contents, email addresses, or other direct identifiers to these tools.

2.3 Information We Do NOT Collect

• We do not access, collect, or store your bank account credentials. Bank data is provided through files you upload.
• We do not sell, rent, or trade your personal information or trust account data to third parties.
• We do not use your trust account data to train machine learning models or for any purpose other than providing the Service to you.

3. How We Use Your Information

We use your information exclusively to:

• Provide, maintain, and improve the Service
• Process reconciliation computations and generate reports
• Authenticate your identity and secure your account
• Communicate with you about your account, billing, and Service updates
• Detect, prevent, and address technical issues, security incidents, or fraudulent activity
• Comply with legal obligations

We do not use your trust account data for any purpose other than providing the Service to your organization.

4. Data Storage and Security

Infrastructure: The Service is hosted on Vercel and Supabase. Data is protected in transit and at rest using the security controls provided by those platforms.

Access controls: Trust account data is isolated at the database level through row-level security (RLS). Authenticated users are limited to their organization and assigned product role. Consequential workflow changes are logged and auditable.

Authentication: We use Supabase Auth for identity management. Passwords are not stored by TriBalance in plaintext. Verified-email password recovery is available; multi-factor enrollment is planned but is not active during opening beta.

Auditability: Consequential reconciliation actions are recorded with the acting user, time, organization, period, and target record. Broader security-event monitoring and alerting remain part of beta hardening.

No system is impenetrable. While we implement security measures appropriate to the Service, we cannot guarantee absolute security. You share responsibility by maintaining strong credentials and promptly notifying us of any suspected unauthorized access.

5. Third-Party Service Providers

We use the following third-party services to operate the Service. Each processes data only as necessary to provide their respective services:

• Supabase (database hosting, file storage, and authentication)
• Vercel (application hosting and content delivery)
• Resend (transactional email and delivery of requested materials, when email delivery is enabled)
• Stripe (payment processing and subscription billing)
• Google (Google Analytics 4 and Google Tag Manager for site and product usage measurement)

Each provider publishes its own security and compliance documentation, which you can review directly. We do not share your data with any other third parties except as required by law or with your explicit consent. A list of current subprocessors is maintained at /legal/subprocessors.

6. Data Retention

We retain your trust account data for the duration of your active subscription. After cancellation or termination:

• Your data remains accessible for thirty (30) days to allow export
• After thirty (30) days, your data is permanently deleted from our active systems
• Backup archives may retain encrypted copies for up to ninety (90) days as part of standard disaster recovery processes
• We may retain operational and usage metrics that contain no client information, financial record content, or document content, for service improvement

You may request earlier deletion of your data by contacting us at privacy@tribalance.io. We will comply within thirty (30) days, subject to any legal retention obligations.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of your personal data we hold
• Correction: Request correction of inaccurate personal data
• Deletion: Request deletion of your personal data
• Portability: Request transfer of your data in a structured, machine-readable format
• Objection: Object to certain processing of your data

To exercise any of these rights, contact us at privacy@tribalance.io. We will respond within thirty (30) days. We may need to verify your identity before processing your request.

8. Cookies

The Service uses essential cookies for authentication and security (session management and request protection) and limited first-party analytics cookies created by Google Analytics 4. Analytics is configured with advertising storage, advertising user data, and ad personalization disabled. We use analytics data to understand acquisition, content engagement, and funnel performance, not to build cross-site advertising profiles.

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child under 18 has provided us with personal information, we will delete it promptly.

10. International Data Transfers

The Service is operated in the United States. If you access the Service from outside the United States, your data will be transferred to, stored, and processed in the United States. By using the Service, you consent to this transfer. The Service is intended for United States law firms and is not designed for or directed to users subject to non-US data protection regimes.

11. Data Breach Notification

In the event of a data breach involving your trust account data or personal information, we will notify you without unreasonable delay after confirming the breach, consistent with applicable law and any lawful requests of law enforcement, and in any event within thirty (30) days, describing the nature of the breach, the data affected, the measures taken to address it, and recommended steps for you to take.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to you by email or through a notice on the Service at least thirty (30) days before the changes take effect. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

13. Contact

For privacy-related inquiries or to exercise your data rights:

TriBalance LLC
Email: privacy@tribalance.io