Privacy notice

Balance Resolve is operated by YRC Business Systems (“we”). We handle personal data in two distinct roles, and your rights run to a different party depending on which one applies.

As a controller, for the data we collect for our own purposes: your account details when you sign up, billing records, sign-in and security logs, and messages you send us.

As a processor, for the business records our customers load into their workspaces — invoices, business contacts, dispute correspondence and evidence documents. That data belongs to the customer who loaded it, they decide why it is processed, and requests about it are routed to them. If you believe a Balance Resolve customer holds your data, you can still use our request form and we will route the request to the responsible customer.

Account data — name, work email, password hash, role, MFA settings. Used to operate your workspace and secure it. Legal basis: performing our contract with you.

Billing data — plan, subscription state, and payment records. Card numbers never touch our servers; they go directly to Stripe. Legal basis: contract and legal obligations.

Security logs — sign-ins, IP addresses, session and audit records. Used to protect accounts and investigate abuse; the audit trail is append-only by design. Legal basis: legitimate interest in securing the service.

Workspace content — the receivables records our customers load. Processed only on the customer’s instructions, under our data-processing terms.

We do not collect data from children, and the service is not directed at them. We do not process health, biometric or consumer-credit data, and the product must not be used for consumer debt collection.

We do not sell personal data. We do not share it for cross-context behavioral advertising. There are no advertising trackers on this site or in the product. Because we neither sell nor share in the meaning of the California Consumer Privacy Act, there is no “sale” to opt out of — but the request form below works regardless, and we honor Global Privacy Control signals by, simply, never selling data in the first place.

A short list of infrastructure providers, each bound by data-processing terms, listed with purpose and location on the subprocessor register. Hosting and backups are in the United States. We add a subprocessor only after reviewing its security posture, and the register shows the current list at any time.

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, or another state with a comprehensive privacy law, you may have the right to know what personal data we hold about you, to access a copy of it, to correct it, and to delete it, and the right not to be discriminated against for exercising any of these.

Use the privacy request form. Every request is verified against the email address it concerns before we act — that verification is what stops someone else exercising your rights. We respond within 45 days. If we decline a request we say why, and you may appeal by submitting a follow-up request referencing the first.

Account data is kept while your account exists. If a workspace subscription lapses, its data is never deleted or held hostage — it becomes read-only and stays exportable. When a customer asks us to delete a workspace, its records and evidence files are removed from the live system, and age out of encrypted backups on the backup retention cycle (14 daily and 8 weekly copies). Security and audit logs are retained longer where the law or a dispute requires it. Customers can apply a legal hold to their own records at any time by instruction to us.

Encryption in transit and at rest, tenant isolation enforced in the data-access layer, MFA for privileged users, signed and expiring external links, malware screening on uploads, an append-only audit trail, and nightly verified backups with tested restores. The full picture is on the security page.

Questions about this notice: use the request form, which reaches the people responsible for privacy directly. If this notice changes materially, the effective date above changes with it and account owners are notified by email.