Compliance & Trust Center

✓ Permitted Uses

• Access and view Site content for your own lawful personal or business use
• Download or print a single copy of content solely for non-commercial personal reference
• Share links to Site content through standard social sharing functionality

✗ Prohibited Uses

• Copying, reproducing, distributing, or transmitting any content without prior written consent
• Modifying, creating derivative works from, or reverse engineering any portion of the Services
• Using any content for commercial purposes without express written authorisation
• Removing or altering any copyright, trademark, or other proprietary notices
• Using automated tools (bots, scrapers, crawlers) to collect or extract content

6.1 Account Information

You agree to provide accurate, current, and complete information when creating your account and to promptly update such information. You are solely responsible for all activities that occur under your account.

6.2 Confidentiality of Credentials

You are responsible for safeguarding your username, password, and any other authentication credentials. You agree not to share your credentials with any third party and to use strong, unique passwords that are not easily guessable. If you suspect your account has been compromised, notify us immediately at security@aibilan.com.

6.3 Lawful Use

You agree to use the Services only for lawful business purposes. You must not use the Services to engage in any activity that is illegal, harmful, fraudulent, or that violates the rights of others.

6.4 Data Accuracy

You are solely responsible for the accuracy, quality, integrity, legality, reliability, and appropriateness of all data you submit to the Services. Bilan AI is not responsible for any inaccuracies in your data or for any legal, tax, or compliance consequences arising from your reliance on outputs generated from inaccurate data.

6.5 Compliance with Tax and Legal Obligations

You are solely responsible for verifying the accuracy of any information that you use from the Services for your legal, tax, and compliance obligations. Bilan AI's Services are tools to assist you, but they do not constitute professional legal, tax, or accounting advice.

Encryption Standards Summary

Breach Notification

In the event of a security incident that affects your personal data, Bilan AI will:

• Notify you without undue delay, and in any event within 48 hours of becoming aware, of a personal data breach affecting data we process on your behalf, as set out in our Data Processing Addendum
• Provide information about the nature of the breach, data affected, likely consequences, and remediation steps, as it becomes available (in phases where necessary)
• For your account data, of which we are the controller, notify the competent supervisory authority and affected individuals as required by law and described in Section 48 of the Privacy Notice

16.1 Consent and Enrollment

By providing your mobile phone number and opting in, you expressly consent to receive recurring automated text messages from Bilan AI. Consent to receive marketing text messages is not a condition of purchasing any products or services.

16.2 Message Frequency and Charges

Message frequency varies based on your account activity. Standard message and data rates may apply. You are responsible for all charges imposed by your mobile carrier.

16.3 Opt-Out

Reply STOP to any text message at any time to opt out. Reply HELP for help.

16.4 Carrier Liability and Privacy

Carriers, including wireless carriers, are not liable for delayed or undelivered messages. Your mobile information is used solely to deliver the messages described above and is never shared with or sold to third parties for their marketing purposes. For details on how we handle the mobile phone number you provide, see our Privacy Notice.

Event Recordings

• Events may be recorded and shared with registrants, made available in our resource library, or published publicly
• By participating in an Event, you consent to being recorded and to your name and likeness appearing in recordings where you actively participate
• If you do not wish to be recorded, you may attend with your camera and microphone disabled

Content Disclaimer

Content presented at Events is for informational and educational purposes only and does not constitute professional legal, tax, accounting, or financial advice. Bilan AI makes no warranties regarding the accuracy or completeness of Event content. Attendees should seek qualified professional advice before acting on any information presented.

Cancellation & Rescheduling

• Bilan AI reserves the right to cancel, postpone, or reschedule any Event and will provide reasonable advance notice where possible
• For paid Events, a full refund will be issued in the event of cancellation by Bilan AI
• Registered attendees who cancel more than 48 hours prior to a paid Event may request a refund or credit

CPD Credits

Where Bilan AI Events are approved for CPD credit by a recognised professional body, this will be stated clearly in the Event details. Bilan AI is not responsible for determining whether an Event qualifies for CPD credit under your specific professional membership requirements.

Copyright Agent Contact

Counter-Notice Procedure

If you believe that content was removed in error, you may submit a counter-notice to our Copyright Agent. A valid counter-notice must include: your electronic or physical signature; identification of the removed content and its former location; a statement under penalty of perjury that you have a good-faith belief the content was removed in error; your name, address, and telephone number; and consent to jurisdiction of the federal courts in the district where you reside or, if you reside outside the United States, the U.S. District Court for the Northern District of Georgia.

58.1 Creating a Subscription

When you create a subscription and accept these Terms, you become a subscriber. You are responsible for paying the applicable subscription fees and for all activities that occur under your subscription.

58.2 Invited Users

Invited users must also accept these Terms to use the Services. As a subscriber, you are responsible for all activity by your invited users. You should carefully consider the permissions you grant, as different user roles have different levels of access.

58.3 User Roles and Access

Bilan AI provides a role-based access control system. Common roles include: Owner, Admin, Standard User, and Custom roles (where available). You can change or revoke access at any time.

58.4 Partner Program

If you participate in our partner program as an accounting or advisory professional, additional partner terms apply.

58.5 Your Responsibilities as a Subscriber

• Keep your contact and billing information up to date
• Provide true, accurate, and complete information and verify its accuracy for compliance purposes
• Protect your username and password — use strong, unique, not easily guessable credentials
• Resolve any disputes with your invited users regarding subscription access
• Be responsible for all your invited users' activity under your subscription

59.1 Subscription Tiers

Every module and feature each plan includes, the add-ons and current prices are published at aibilan.com/pricing, generated from the same catalog the Services enforce. Prices are subject to change with 60 days' notice for existing subscribers.

59.2 Subscription Fees

Unless you are in a free trial or promotional offer period, use of the Services requires payment of a monthly or annual subscription fee based on your selected pricing plan. Annual plans are billed upfront and recorded as deferred revenue, recognised monthly per our GAAP Revenue Recognition Policy (Section 25).

59.3 Free Trials

The Starter plan is free and needs no payment card. A paid plan starts with a free trial of 14 days; checkout collects a payment card, which is charged only when the trial ends unless you cancel before. If you choose not to continue, you may cancel or delete your organisation before the trial ends to avoid charges. After a trial ends, your trial data remains available as described in Section 60.7.

59.4 Auto-Renewal

Your subscription automatically renews at the end of each billing period at the then-current price for your plan, unless you terminate in accordance with Section 66. We will send you a renewal reminder at least 14 days before your billing date and notify you separately of any price changes at least 60 days before they take effect.

59.5 Taxes

Subscription fees may be stated inclusive or exclusive of applicable taxes (such as GST, VAT, or sales tax) depending on your region. Where required by law, Bilan AI will collect and remit applicable taxes. You are responsible for all other external fees and taxes associated with your use of the Services. Tax invoices are available from your billing portal.

59.6 Refund Policy

59.7 Late Payments

60.1 Data Ownership

You own all financial data, records, documents, and content you create or upload into the Services ("Your Data"). Bilan AI claims no ownership rights over Your Data. Upon subscription termination, you retain the right to export Your Data in standard formats (CSV, PDF) for the period set out in Section 60.7.

60.2 Licence to Use Your Data

When you enter or upload data into our Services, you grant us a limited, non-exclusive, royalty-free licence to use, copy, transmit, store, analyse, and back up all data you submit solely in order to: provide and improve the Services; develop new features; communicate with you; and share with authorised sub-processors listed in our Sub-processor List. We will never use Your Data to train AI models for commercial sale to third parties without your explicit consent.

60.3 Your Personal Data

Our Privacy Notice (Part B of this document and the Privacy Notice tab) describes how we process personal data that you enter into Bilan AI about yourself, your organisation, and your team members.

60.4 Data Processed on Your Behalf

Our Data Processing Addendum (DPA) governs how we process personal data on your behalf as a data processor. By accepting these Terms, you also accept our DPA. A copy of the DPA is available in Section 46 of the Privacy Notice tab, or by request to privacy@aibilan.com.

60.5 Anonymised & Aggregated Data

We may create anonymised, aggregated statistical data from your data and usage of the Services. Once anonymised such that no individual or organisation can reasonably be identified, we may use this data for our own purposes, including to identify industry trends, publish benchmarking reports, and improve the Services. Such data is not considered Your Data and does not belong to you.

60.6 Document Retention

Financial records, journal entries and audit logs are kept while your organisation exists, for the periods of our Document Retention Schedule, which follow the accounting and tax law of each customer's jurisdiction (for example 10 years under the OHADA Uniform Act on Accounting Law and Financial Reporting, 7 years in the United States). Deleting your organisation (Section 60.9) ends that retention for everything except the audit trail and the record of the deletion. See Section 47 of the Privacy Notice and Section 25.3 of these Terms for full details.

60.7 Data Export and Portability

• You may export your chart of accounts, transactions, contacts, and reports at any time via the Services export features
• Standard export formats: CSV, XLSX, PDF, and where available, JSON or XML
• After a paid subscription ends, you keep access to Your Data, at least in read-only mode, and to every export feature for 12 months; after a free trial ends, for 90 days. After that period, Your Data may be deleted in accordance with the Retention Schedule (Section 47 of the Privacy Notice), except data that the law requires Bilan AI itself to keep
• You remain responsible for keeping your own accounting records and supporting documents for the period your law requires (for example, 10 years under the OHADA Uniform Act on Accounting Law and Financial Reporting). Export them before your access period ends
• To request a data export after account closure, contact privacy@aibilan.com

60.8 AI Transparency & Model Training

Our Services use artificial intelligence and machine-learning features to categorise transactions, extract data from documents, and surface insights. We commit to the following:

• We do not use Your Data — including your financial records, transactions, documents, or the personal data of your customers, vendors, or employees — to train, fine-tune, or improve any general-purpose or foundation AI model, whether ours or a third party's.
• AI processing of Your Data occurs solely to deliver the specific feature you invoke (for example, extracting fields from an invoice you upload).
• Where an AI feature is powered by a third-party model provider, Your Data is transmitted under contractual terms that prohibit the provider from retaining it or using it for training.
• Optional AI features can be disabled at any time in Settings.
• AI-generated outputs are suggestions only and are subject to Section 69.1 (No Professional Advice); you remain responsible for reviewing entries before they are committed to your books.

60.9 Deleting Your Organisation

• The owner of an organisation may delete it at any time, from Settings. Administrators and other members cannot.
• Before anything is deleted, the Services show the retention period that the law of the organisation's jurisdiction sets for accounting records, the date until which its records must be kept, and the export features. Deleting requires the organisation's name, an acknowledgement of that warning and the owner's password.
• Any subscription of the organisation ends first; fees already paid follow Section 59.6.
• Deletion takes effect at once and cannot be undone: no member can open the organisation again, Your Data is erased from the Services, and erased data leaves our backups as they roll over (Section 47 of the Privacy Notice). The audit trail and the record of the deletion are kept for their own retention period and used for no other purpose.
• You remain solely responsible for keeping your accounting records and supporting documents for the period your law requires. Export them before you delete.

62.1 Our Security Safeguards

We have invested in technical, physical, and administrative safeguards including end-to-end encryption, access controls and regular security assessments. Our Services are hosted on SOC 2 Type II-audited infrastructure, with controls designed to the SOC 2 criteria. Full details are set out in Section 14 (Security Statement & Encryption Whitepaper).

62.2 Immutable Audit Trail

Bilan AI's accounting engine is built on an immutable ledger architecture. The audit trail cannot be disabled, modified, or deleted by any user, including system administrators. Specifically:

• Every create, read (where material), update, and delete action on financial records is logged with a tamper-evident timestamp
• All journal entries — including AI-assisted categorisations — are permanently attributed to the acting user or system process
• Voided or reversed transactions remain visible in the audit log; they are never hard-deleted
• Before-and-after field values are captured for every data modification
• Audit logs are cryptographically signed to detect unauthorised tampering
• Audit trail data is replicated across multiple availability zones for redundancy
• Audit logs are retained for the longer of 7 years and the statutory minimum of your jurisdiction (Section 47 of the Privacy Notice), including after the organisation is deleted

62.3 Auditor Access

Subscribers may grant read-only auditor access to their organisation. External auditors with appropriate access permissions can:

• View the complete transaction history and audit log for any period
• Export audit trail records in CSV or PDF format
• Access bank reconciliation records, journal entry approvals, and system-generated entries
• Request a formal Audit Log Export Report by contacting security@aibilan.com

62.4 Account Security Features

We offer security features including multi-factor authentication (MFA), single sign-on (SSO), IP allowlisting (Enterprise plans), and session timeout controls. Where security features are optional, we strongly encourage their use. We are not liable for consequences arising from your choice not to enable available optional security features.

62.5 Your Security Responsibilities

• Keep your login details secure and do not share them with others
• Ensure strong security on your own systems, devices, and networks
• Immediately notify us of any unauthorised use of your password or account breach at security@aibilan.com
• Do not store sensitive data (credit card numbers, tax identifiers, bank details) in free-form text fields not designed for that purpose
• Regularly review and update your security settings, including MFA enrollment and user access levels
• Promptly revoke access for users who leave your organisation

62.6 Payment Card Security (PCI DSS)

Payment card transactions are processed by a third-party payment provider certified as PCI DSS Level 1, the highest level of certification available. Bilan AI does not store, process, or transmit full payment card numbers (PANs) on its own servers; card data is tokenised by our payment provider. Our handling of the resulting tokens and reference data is designed to align with the applicable requirements of the PCI DSS. You must not enter full card numbers into free-form fields (see Section 62.5).

63.1 Third-Party Services

Some Bilan AI features are delivered through third-party services. These third parties have their own terms that apply to your use of their services.

63.2 Bank Feeds

Automated bank feeds may be enabled through third-party providers including Yodlee. Use of Yodlee-enabled bank feeds is subject to separate Yodlee terms. Bank feeds are generally provided at no charge but may have associated fees which we will communicate in advance.

63.3 Bilan AI App Store

The Bilan AI App Store allows you to discover and connect third-party apps to your subscription. Third-party apps are subject to their providers' own terms and privacy policies — please read these carefully before connecting.

63.4 Third-Party Terms

Third-party products and services are independent of Bilan AI. We do not endorse or assume responsibility for any third-party products, their accuracy, availability, or compliance with applicable laws.

63.5 Revenue Sharing

Some third-party providers may pay Bilan AI referral fees or revenue share. We are transparent about these arrangements and they do not influence our editorial or listing decisions.

64.1 Availability

We aim to keep the Services available at all times, except scheduled maintenance announced in the app. No contractual service level applies except in an Enterprise agreement, which states its own measure.

64.2 Scheduled Maintenance

Occasionally, we need to perform scheduled maintenance. We will attempt to notify you at least 48 hours in advance by an in-app notice. Scheduled maintenance is excluded from the availability measure.

64.3 Support

Support by in-app ticket and e-mail. Our team responds within one business day. Requests reporting a complete outage or a risk of data loss are handled first.

64.4 Unplanned Downtime

Despite our best efforts, unplanned outages may occur. We will work to restore the Services as quickly as possible and keep account owners informed by an in-app notice and by e-mail during an active incident.

64.5 Data Loss

Data loss is an inherent risk with any technology service. You are responsible for maintaining copies of your data, using the export features (Section 60.7). We keep rolling backups for the period stated in Section 47 of the Privacy Notice.

64.6 Service Credits

Service credits apply only where an Enterprise agreement sets a contractual service level; that agreement states the measure, the credits and how to claim them.

Things You May Do ✓

• Use the Services for lawful business purposes in accordance with these Terms
• Invite other users to your subscription and manage their access levels
• Export your data at any time using the available export features
• Connect compatible third-party apps and services
• Provide feedback and suggestions for product improvements
• Transfer your subscription to a new subscriber in accordance with these Terms

Things You Must Not Do ✗

• Undermine the security or integrity of our computing systems, networks, or data
• Use the Services in any way that impairs functionality or interferes with other users
• Access any system, account, or data without authorisation
• Introduce or upload viruses, malware, or any malicious code
• Share content that violates any law or infringes on the rights of others
• Modify, decompile, or reverse engineer any part of the Services
• Resell, sublicense, or otherwise provide the Services to third parties without authorisation
• Repackage or resell any leads or data accessed through the Services
• Commit fraud or any other illegal acts through the Services
• Engage in any abusive or disrespectful conduct toward Bilan AI staff, partners, or other users

Fair Use

We offer our Services in a way that encourages responsible use. If your use is excessive or unreasonable, we will notify you and ask you to adjust your usage within 14 days. Continued violations may result in suspension or termination.

66.1 Termination by You

You may terminate your subscription at any time by providing Bilan AI with one month's written notice. Notice may be given through the account settings in the Services or by emailing billing@aibilan.com. You remain responsible for subscription fees through the end of your notice period.

66.2 Termination by Bilan AI

Bilan AI may terminate your subscription at any time by providing you with one month's written notice. We may also terminate or suspend your subscription immediately if:

• You breach any of these Terms and fail to remedy the breach within 14 days of notice
• You breach any Term that cannot be remedied
• You or your business becomes insolvent, enters liquidation, or is subject to an insolvency proceeding

66.3 Effect of Termination

Upon termination: (a) your right to use the Services ceases, except for the access to Your Data and the export features described in Section 60.7; (b) once that access period ends, your data is no longer accessible; (c) no refund is due for fees already paid; and (d) all provisions of these Terms that by their nature should survive termination shall survive.

66.4 Data After Termination

Following termination, your data remains available as described in Section 60.7, to allow for export and reactivation, and is then kept only as our Retention Schedule allows to meet our legal obligations. The owner may also delete the organisation at any time (Section 60.9), or request deletion of your data by contacting us at privacy@aibilan.com.

67.1 Your Indemnification Obligation

You indemnify Bilan AI and our affiliates, officers, directors, employees, and agents against all losses, costs (including legal costs), and liabilities arising from third-party claims connected to: your use of the Services; your violation of these Terms; or your violation of any applicable law or third-party rights. This indemnification does not apply to losses arising from our own breach, gross negligence, or wilful misconduct.

67.2 Disclaimer of Warranties

The Services and all third-party products are provided on an "as is" and "as available" basis. We disclaim all warranties, express or implied, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement.

67.3 Limitation of Liability

• We have no liability for loss of revenue, profit, goodwill, customers, capital, anticipated savings, or reputational damage
• We have no liability for indirect, consequential, incidental, punitive, or special losses
• For data loss or corruption, our liability is limited to taking reasonable steps to recover data from available backups
• Our total aggregate liability in any 12-month period is limited to the total fees you paid us in the 12 months preceding the claim

67.4 Non-Excludable Rights

In some jurisdictions, certain statutory rights cannot be excluded or limited by agreement. If you reside in such a jurisdiction, those rights continue to apply. Our liability for breach of non-excludable guarantees is limited, where permitted, to either resupplying the Services or paying the cost of resupply.

68.1 Initial Resolution

Most concerns can be resolved quickly by contacting our support team. Please raise your concern with us first, and we will make every reasonable effort to resolve it to your satisfaction.

68.2 Formal Dispute Resolution

If we are unable to resolve a dispute informally, and to the extent permitted by applicable law, you and Bilan AI agree to resolve disputes through binding arbitration or small claims court rather than litigation in courts of general jurisdiction.

68.3 Class Action Waiver

To the extent permitted by applicable law, you and Bilan AI agree that any dispute must be brought in your individual capacity and not as a plaintiff or class member in any class or representative proceeding.

68.4 User-to-User Disputes

You are solely responsible for resolving disputes between yourself and any other subscriber or invited user. Bilan AI will not act as an arbitrator between users but may, in appropriate cases, take action to enforce these Terms.

69.1 No Professional Advice

Bilan AI is not a professional services firm and the Services do not constitute professional legal, tax, accounting, financial, or other advice. Any information we provide is for general informational purposes only and should not be relied upon as a substitute for professional advice from a qualified practitioner.

69.2 Events Outside Our Control

We are not liable for any failure or delay in performing our obligations arising from events beyond our reasonable control, including natural disasters, war, terrorism, labour disputes, internet failures, governmental actions, or failures of third-party providers.

69.3 Notices

All formal legal notices to Bilan AI must be sent to legal@aibilan.com or by post to our legal address. All notices we send to you will be sent to the email address you have provided through your subscription.

69.4 Changes to These Terms

We may change these Terms from time to time. Changes are not retrospective. We will endeavour to provide at least 60 days' notice of material changes. Continued use of the Services after changes take effect constitutes acceptance.

69.5 Relationship of the Parties

Nothing in these Terms creates a partnership, joint venture, employment, or agency relationship between you and Bilan AI.

69.6 Governing Law and Jurisdiction

These Terms are governed by the laws of the State of Georgia, United States, and applicable U.S. federal law. Subject to the dispute resolution provisions, any litigation must be brought in the state or federal courts located in the State of Georgia, subject to your rights under mandatory applicable consumer-protection laws in your jurisdiction.

69.7 Assignment

You may not assign these Terms without our written consent. Bilan AI may assign these Terms in connection with a merger, acquisition, or sale of substantially all assets, with written notice to you.

69.8 Severability and Entire Agreement

These Terms (including the Privacy Notice and any Site Specific Terms) constitute the entire agreement between you and Bilan AI regarding the Services. If any provision of these Terms is invalid or unenforceable, it will be modified to the minimum extent necessary to make it enforceable, and remaining provisions will continue in full force.

69.9 Language

These Terms and the policies incorporated in them may be made available in languages other than English. Translations are provided for convenience only. If a translation conflicts with the English version, the English version governs, except where mandatory local law requires the version in the local official language to prevail.

Directly from You

When you visit our websites, create an account, sign up for a trial, purchase services, contact support, participate in surveys or competitions, or attend our events.

Automatically

We automatically collect technical data when you visit our websites or use our Services — including data about your device, browser, IP address, usage patterns, and platform interactions.

From Third Parties

• Marketing partners and data providers who help us identify potential customers
• Social media platforms where you have made information publicly available
• Analytics providers
• Financial services providers including payment processors and fraud detection services
• Partners and resellers who refer customers to our platform

Do Not Track & Global Privacy Control

Some browsers offer a “Do Not Track” (DNT) signal. Because there is no common industry standard for interpreting DNT signals, we do not currently respond to them. However, we honour the Global Privacy Control (GPC) signal where required by law: when we detect a valid GPC signal from your browser, we treat it as a request to opt out of the “sale” or “sharing” of personal information as those terms are defined under applicable US state privacy laws.

Children’s Privacy

The Services are business tools intended for use by organisations and are not directed to children. We do not knowingly collect personal data from anyone under the age of 16 (or the age of digital consent in your jurisdiction), and we do not permit individuals under 18 to create an account. If you believe we have inadvertently collected personal data from a child, contact privacy@aibilan.com and we will delete it promptly.

Mobile / SMS Data — Not Shared for Marketing (controls this section)

None of the sharing or disclosure described in this section applies to your mobile phone number or SMS/text-messaging consent data. We do not share, sell, rent, lease, or otherwise disclose your mobile phone number, SMS opt-in, or text-messaging consent data to any third parties or affiliates for their own — or for any — marketing or promotional purposes. The only parties that ever receive your mobile number are the messaging providers (such as Twilio) that deliver the account-security text messages you request; they act solely as our service providers under contract and are prohibited from using your information for their own purposes. Message frequency varies by your account activity, and message and data rates may apply. Reply STOP to opt out, HELP for help.

Controller vs. Processor

DPA Key Obligations

• Process personal data only on documented instructions from the subscriber
• Ensure persons authorised to process data are bound by confidentiality
• Implement appropriate technical and organisational security measures (Article 32 GDPR)
• Assist the subscriber in responding to data subject rights requests
• Notify the subscriber without undue delay, and in any event within 48 hours of becoming aware, of any personal data breach affecting data we process on its behalf, with the information it needs as it becomes available (in phases where necessary) and reasonable assistance with its own notifications
• Delete or return all personal data upon termination of services
• Provide all information necessary to demonstrate compliance upon request

Within the Bilan AI Group

With other companies within the Bilan AI group to enable us to provide you with our Services.

Third-Party Service Providers (Sub-processors)

With service providers who process data on our behalf, including providers of: cloud hosting and storage; email and account-notification delivery; customer support tools; data analytics; security and fraud prevention; and payment processing. These service providers process your data only on our documented instructions, solely to provide these services to us, and are prohibited from using it for their own marketing or advertising. They are listed in our Sub-processor List.

Third-Party Integrations

If you connect third-party apps or services, your data may be shared with those providers. Their use of your data is governed by their own terms and privacy policies.

Legal and Regulatory Requirements

We may disclose personal data to regulators, law enforcement, courts, or other authorities where required by applicable law. Where permitted, we will notify you before making such disclosure.

Business Transfers

In connection with a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity, who will be bound by privacy obligations at least as protective as those set out here.

Requesting Early Deletion

You may submit a Data Subject Access Request (DSAR) or erasure request at any time. Note that we may be unable to delete data that we are legally required to retain. Requests should be sent to privacy@aibilan.com.

The owner of an organisation may also delete it, and its books, at any time from Settings, after a warning that states how long the law of its jurisdiction requires the records to be kept (Terms, Section 60.9).

Personal Data Breach Notification

As the controller of your account data, in the event of a security incident that constitutes a notifiable personal data breach, Bilan AI will:

• Notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware (GDPR Art. 33 and equivalent laws), or within any shorter period applicable law requires
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms (GDPR Art. 34), or within any shorter period applicable law requires
• Provide clear information about the nature of the breach, categories and approximate number of individuals affected, likely consequences, and measures taken or proposed
• Maintain a breach register for internal accountability and regulatory inspection

For personal data we process on a subscriber's behalf, we notify the subscriber without undue delay, and in any event within 48 hours of becoming aware, as set out in Section 46 and our Data Processing Addendum. Report a suspected security incident to security@aibilan.com.

Transfer Safeguards by Region

Transfer Impact Assessments

Where required, Bilan AI conducts Transfer Impact Assessments (TIAs) prior to transferring personal data to third countries to evaluate the legal landscape and ensure adequate protection is maintained in practice. TIA summaries are available to Enterprise subscribers upon request.

Sub-processor Locations

Our principal sub-processors, including our cloud infrastructure provider, operate data centres in the United States. Your data is stored in the United States. Contact privacy@aibilan.com for specific data-residency information.

How to Exercise Your Rights

Identity Verification

To protect your privacy, we may ask you to verify your identity before processing a rights request. We will use the minimum information necessary to confirm your identity and will not use it for any other purpose.

Complaints & Escalation

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority:

California Residents — CCPA/CPRA

California residents have additional rights including: the right to know about personal information collected and disclosed; the right to delete personal information; the right to opt-out of the sale or sharing of personal information; the right to correct inaccurate personal information; the right to limit use of sensitive personal information; and the right to non-discrimination for exercising CCPA rights. Submit a CCPA request at privacy@aibilan.com. We do not sell your personal information.

Virginia Residents — VCDPA

Virginia residents have rights under the VCDPA including rights to access, correct, delete, and obtain a copy of their personal data, and to opt out of processing for targeted advertising, sale, or profiling.

Colorado, Connecticut, and Other US State Residents

Similar rights may apply to residents of Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with comprehensive privacy laws.

California “Shine the Light” (Civil Code § 1798.83)

California residents may request, once per calendar year, information about the categories of personal information (if any) we disclosed to third parties for those third parties’ own direct-marketing purposes during the preceding calendar year, and the identities of those third parties. Bilan AI does not disclose personal information to third parties for their direct-marketing purposes. To make a request, email privacy@aibilan.com with “Shine the Light Request” in the subject line.