The long version
Balise Privacy Policy
Last updated 17 August 2026 · Publisher and controller: BRK (Groupe Tamara)
Publisher / controller: BRK, the public brand of Groupe Tamara. Product site: usebalise.com. Publisher site: groupe-tamara.com. Company-level policy: BRK privacy policy — this Balise policy controls for Balise data practices. Privacy contact: apps@groupe-tamara.com (subject “Balise privacy”).
Balise is not an on-device-only product. Short-lived inference copies are uploaded for cloud vision processing, and structured knowledge is stored server-side for your workspace. Balise does not keep an archive of your images.
1. In short
- Your original photos stay in Apple Photos (or another library you connect later). Balise is not a photo backup service.
- For photos you include in processing, Balise uploads a temporary inference render (a bounded, downsized derivative — 2,560 px on the long side today — not a full-resolution archive) to private Balise infrastructure on Google Cloud so vision models can extract structured knowledge.
- Inference renders are deleted when their batch finishes, with an automatic one-day lifecycle backstop for interrupted or abandoned batches. A same-size display copy may back the evidence tile in the app for at most one day when the original is not reachable on the device; it is subject to the same one-day deletion. Balise does not keep an archive of your images; no image copy Balise holds is older than about one day.
- Balise stores structured knowledge derived from your photos (observations, facts, domains, search indexes, preferences) in your workspace — that is the durable product asset, and it is yours to correct or delete.
- We do not use your content to train models, and we instruct our AI providers not to train on Balise inference content.
- Balise does not offer face recognition or a people identity graph. On-device face detection reports only counts, positions and head angles. The one face vector Balise stores is a self reference for the account holder, built on device from your own selfies and used only to mark whether you are in a photo (§4.6).
- You must be 16+ to use Balise (see §11). Parents photographing their own children for personal knowledge is an expected personal use.
- You can delete all Balise data from inside the app (Profile → “Delete all Balise data”), and ask us by email to close the sign-in account itself. See §10.
- We do not sell your photos or knowledge, and we do not show ads.
- The website (usebalise.com) stores a waitlist email if you give one and counts visits without cookies or third-party trackers (see §4.8).
2. Who we are
Groupe Tamara (public brand BRK) is the legal entity that publishes Balise and acts as data controller for personal data processed in connection with the Balise service and the usebalise.com website, unless a specific processing is described as performed by a third party as an independent controller (for example Apple operating system services on your device).
Contact: apps@groupe-tamara.com · groupe-tamara.com · BRK Support
3. Scope
This policy covers:
- the Balise iOS app (iOS 17+), including TestFlight / beta builds;
- Balise backend APIs and storage used to provide the service;
- the usebalise.com website, including the waitlist form and site analytics;
- related support communications about Balise.
It does not cover third-party websites or apps that link to us, or Apple’s own processing as platform provider (Sign in with Apple, Photos, App Store, TestFlight), except to describe how Balise interacts with them.
4. Personal data we process
4.1 Account and authentication
| Category | Examples | Source |
|---|---|---|
| Identity / auth | Clerk user id, sign-in identifiers (for example Sign in with Apple), session tokens, and the email or name held by Clerk if your sign-in method provides one. Balise’s own servers store only the Clerk user id and use it as your workspace id. | You / Clerk / Apple |
| Workspace linkage | Workspace id, provisioning state, role | Generated by Balise |
| Push notifications | Device push token, if you allow notifications, so we can tell you when a round is done | You / Apple |
4.2 Photo library inputs
With your permission via Apple PhotoKit, Balise reads, for the assets you include:
- image content (to create a temporary inference render for cloud vision — not to archive your Camera Roll). The render is re-encoded on device with camera metadata (EXIF, GPS, maker notes, thumbnails) stripped from the file;
- capture / modification timestamps and the capture time-zone offset;
- location metadata when present on the asset (GPS coordinates, altitude, heading, accuracy from the photo — not live tracking of you) and a place name resolved on device from those coordinates;
- album membership, including album names (for inclusion / exclusion rules and as context);
- technical flags and camera settings (for example screenshot, favorite, edited, dimensions, camera model and lens, exposure, flash) and any caption you typed in Photos;
- on-device Vision results: number and position of faces and people, whether you appear (§4.6), animals, whether text is present, and quality scores — never the recognized text itself, and never face templates of other people;
- PhotoKit local identifiers and, where available, cloud identifiers, and a per-install device identifier, used for deduplication and to link facts back to the photo on your device.
These facts travel with the render as structured data (not inside the image file), are stored with the resulting knowledge, and are given to the vision model as context for reading the photo.
Defaults and limits
- You choose how many photos and which period Balise should consider; the app samples evenly across that period. Album-by-album selection is not offered in the current build.
- Hidden albums and shared albums are always excluded; this cannot be switched on. Screenshots are excluded unless you turn them on.
- Limited Photos access (iOS) is supported: Balise can only see the photos you picked in Apple’s sheet.
- Photo-library permission does not mean every asset is uploaded immediately or at all.
- Keep up as you shoot (new photos picked up automatically) is off unless you turn it on, and is offered with a Balise Plus entitlement.
4.3 Temporary inference media
Bounded inference renders uploaded for cloud vision processing. These are short-lived processing copies, not an archive of your Camera Roll. They are deleted by the application when their batch completes, with a one-day object-lifecycle rule as an automatic backstop for interrupted or abandoned batches; the storage soft-delete window is set to zero so a deleted copy is gone.
4.4 Image copies (no archive; nothing older than about a day)
Balise does not keep an archive of your images — neither originals nor long-lived “retained renditions.” Originals stay in Apple Photos (or another Connected library).
When a photo’s facts are written to your workspace, the same downsized copy may be kept for at most one day in a separate private bucket so the app can draw the evidence tile if the original is momentarily unreachable on your device. That bucket has the same one-day lifecycle deletion and zero soft-delete window, and its contents are removed immediately if you delete all Balise data (§10). After that, no image copy exists on our side.
A future optional feature that keeps display-sized previews for longer, only for images you explicitly ask us to keep, is not available today. If it ships it will be off by default, require a separate explicit opt-in, and be described in an updated version of this policy first.
4.5 Structured knowledge (durable)
- observations and extracted facts (objects, text cues, places, domain-specific fields) — including structured descriptions of photos that may depict children or other people when you included those photos;
- provenance linking facts to evidence identifiers;
- domain / interest configurations and insight definitions;
- search indexes and embeddings of structured content (not a photo backup);
- corrections and preferences you provide;
- an import ledger used for deduplication and “already processed” state (photo identifiers, capture time and photo location, dimensions, status — not your original file);
- your preferred language, notification registration, and subscription entitlement state (from Apple’s StoreKit, no card details).
4.6 On-device processing, faces and the self reference
On device, Balise uses Apple frameworks (PhotoKit, ImageIO, MapKit, Vision) to select, sort and downsize photos before upload, to resolve a place name from the photo’s coordinates, and to detect faces, people, animals, text and foreground. Only counts, boxes, head angles and scores leave the phone; recognized text, landmarks and feature vectors do not.
Self reference. To tell whether you are in a photo, the app builds one face reference vector on device from your own selfies (Apple’s Selfies album, or recent front-camera photos), compares faces to it on device, and uploads only the yes/no result per photo. That single vector is uploaded to and stored in your workspace’s control database so it can be restored on a new device. It is the only face vector Balise stores; it is never used to identify anyone else, never shared with model providers, and is deleted with everything else when you delete all Balise data (§10). Balise does not compute or store face templates for other people and does not run face recognition or a people index.
4.7 Operational and diagnostics data
- API logs, IP address, device / app version, crash or performance signals reported by Apple where you have allowed sharing with developers;
- Redis / Memorystore operational state (job progress, locks, manifests, short-lived tokens) — not a durable photo store;
- a control database (Cloud SQL) holding import batches, the import ledger, entitlement usage and an audit trail of account actions (for example that a data reset completed);
- security and abuse-prevention signals.
The iOS app contains no third-party analytics or advertising SDK.
4.8 The website (usebalise.com)
- Waitlist. If you leave your email on the homepage we store the email address, the optional line about what you photograph, your browser’s user-agent string, a salted hash of your IP address (used only to rate-limit sign-ups) and the time of sign-up, in Cloudflare KV. A notification email with the same details is sent to the founder’s inbox at Groupe Tamara so we can invite you. We use the address to send TestFlight invitations and Balise news, and for nothing else.
- Site analytics. The site records anonymous interaction events (page views, sections seen, scroll depth, clicks, waitlist outcomes) in Cloudflare Workers Analytics Engine: event name, page path, a random per-tab session id kept in your browser’s session storage, device class, referrer host, country as reported by Cloudflare, viewport size, and a salted IP hash used only as a sampling key. No cookies, no cross-site tracking, no third-party script. The script does nothing if your browser sends Do Not Track or Global Privacy Control. Cloudflare Web Analytics (aggregate traffic and Core Web Vitals, cookie-less) may also be enabled on the zone.
- Language cookie. If you pick a language path (for example /fr), the site sets a single functional cookie,
balise_lang, to remember it. Nothing else is stored in cookies. - Hosting. The website and its API run on Cloudflare (Workers, KV, Analytics Engine, Email Service).
4.9 Support communications
If you email us, we process your address and message content to respond.
5. Why we process data (purposes and legal bases)
| Purpose | Data (high level) | Proposed legal basis |
|---|---|---|
| Create and secure your account | Auth identifiers, sessions | Contract (Art. 6(1)(b)); legitimate interests for security |
| Provide library processing and knowledge features you request | Ephemeral inference renders, structured knowledge, preferences | Contract |
| Ephemeral cloud inference | Inference renders, model input / output | Contract |
| Tell you when a round is done | Push token | Contract / consent (iOS notification permission) |
| Improve reliability, debug, prevent abuse | Logs, operational metadata, salted IP hashes | Legitimate interests; legal obligation where applicable |
| Waitlist and invitations | Email, interest line | Consent / steps prior to a contract |
| Understand how the website is used | Anonymous interaction events | Legitimate interests (no cookies, no cross-site tracking) |
| Support | Email content | Contract / legitimate interests |
| Comply with law | Limited records, deletion audit entries | Legal obligation |
Future optional preview retention (not offered today): if shipped, processing would be based on your explicit opt-in and described in an updated policy.
5.1 No training, no selling
We do not sell personal data. We do not use your photos, inference renders, structured knowledge, or other customer content to train machine-learning models. We instruct our AI subprocessors (Vertesia, and OpenAI, Google Vertex AI / Gemini and xAI as used through Vertesia) not to use Balise inference content to train their models. Providers process content only to deliver inference and related Service features for your workspace.
6. How processing works (pipeline)
- You authorize Photos (full or limited) and choose how many photos and which period.
- On-device rules decide which assets are eligible (screenshots only if enabled; hidden and shared albums always out; the sample spread evenly across the period).
- For each eligible asset, Balise creates a downsized inference render (HEIC, 2,560 px on the long side today; a 512 px JPEG for the quick first pass), strips camera metadata from the file, packs renders into an archive and uploads it over TLS, via a short-lived signed URL, to a private Balise inference bucket on Google Cloud Storage, together with the photo facts listed in §4.2 as structured data.
- Vision models (orchestrated by Vertesia; currently OpenAI and Google Vertex AI / Gemini paths) read the render and extract structured evidence. Google’s Vertex path reads the render directly from the private bucket under a read-only grant scoped to inference objects; OpenAI paths receive a short-lived signed read URL. Text-only steps that design how a domain is laid out (schema, card templates, search screens) may run on OpenAI or xAI (Grok) models through Vertesia and receive the domain’s field schema, not your photos.
- Structured results are written to your workspace (Vertesia content objects and search index) and to the control database ledger.
- Temporary inference objects are deleted when the batch completes, with the one-day lifecycle rule as a backstop. A same-size display copy may back the evidence tile for at most one day (§4.4).
- Balise keeps no image archive.
New photos after the first import. You can send more rounds by hand. “Keep up as you shoot” picks up new photos automatically when you turn it on (Balise Plus). The app UI for your build is the source of truth for whether newly added photos are being picked up.
7. Processors and subprocessors
We use service providers (“processors”) to operate Balise. They process data on our instructions. The list below reflects company-confirmed vendors and the deployed infrastructure for the Balise Google Cloud project (region us-central1 today).
| Provider | Role / purposes | Data typically involved |
|---|---|---|
| Clerk | Authentication and session management (including Sign in with Apple) | Account identifiers, auth metadata, email if provided |
| Google Cloud | Hosting and infrastructure: Cloud Run (API and import services), Cloud Storage (private inference bucket; a separate private bucket for the one-day display copy), Memorystore (Redis) (operational queues / locks / manifests), Cloud SQL (control database and import ledger), Secret Manager, Artifact Registry, networking; Vertex AI / Gemini when Vertesia routes inference to Google’s Vertex environment | Ephemeral inference renders, ledger and operational data, model input / output for the Vertex path |
| Vertesia | Durable workspace knowledge, search, agents / workflows, and inference orchestration using short-lived media access supplied by Balise (US region today) | Structured knowledge, workspace-scoped credentials, run metadata; temporary media access for inference |
| OpenAI | Vision / model inference via Vertesia using short-lived HTTPS media access supplied by Balise; text-only domain design steps | Temporary media references / model inputs and outputs |
| xAI | Text-only model inference via Vertesia for designing domain screens (Grok) | Domain field schemas and templates — no photos, no per-photo facts |
| Cloudflare | Website hosting, waitlist storage (KV), site analytics (Workers Analytics Engine, Web Analytics), waitlist notification email (Email Service) | Waitlist email and interest line, salted IP hashes, anonymous interaction events |
Apple (platform, not a Balise AI subprocessor): OS, PhotoKit, Sign in with Apple, push notifications, App Store / TestFlight distribution and crash reports. Apple acts under its own terms for platform services.
We require processors to protect data appropriately. We do not authorize processors to use Balise customer content to advertise to you or to train models on Balise inference content.
8. International transfers
Balise infrastructure and processors may process data in the European Union and other countries, including the United States (the Google Cloud project runs in us-central1 today; Vertesia runs in its US region today; OpenAI and Vertex paths may also process outside the EEA; Cloudflare runs a global network), depending on provider regions and account configuration.
Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for transfers of personal data from the EEA/UK to countries without an adequacy decision.
9. Retention
| Data | Retention |
|---|---|
| Inference renders (temporary) | Deleted when the batch completes; one-day lifecycle backstop for interrupted or abandoned batches; zero soft-delete window |
| Display copy behind the evidence tile | At most one day (lifecycle deletion, zero soft-delete window); removed immediately on “Delete all Balise data” |
| Long-lived image copies / “retained renditions” | None. A future optional opt-in (if shipped) would keep only images you explicitly ask us to keep, until you delete them |
| Structured knowledge, import ledger, self reference | Until you delete it or delete all Balise data / your account |
| Auth / account records (Clerk) | For the life of the account; then deleted or anonymized on request |
| Redis / Memorystore operational state | Short-lived / cache-oriented; loss must not recreate a photo archive |
| Waitlist record (website) | Until you ask us to remove it, or once invitations for the beta are no longer sent |
| Site analytics events | Anonymous; retained per Cloudflare Analytics Engine defaults |
| Support emails | As long as needed to handle the request and ordinary business / legal records |
| Deletion audit entry | Minimal non-content record that deletion completed (counts, timestamp) |
If an original photo is deleted from Apple Photos, related structured records may remain marked as evidence-unavailable until you delete them; Balise does not silently invent displayable originals.
10. Your rights and controls
10.1 In-product controls
- choose Photos access level (full or limited, picking photos in Apple’s sheet), how many photos and which period; screenshots on or off; “Keep up as you shoot” on or off;
- rely on the fixed exclusion of hidden and shared albums;
- correct or delete structured knowledge;
- Delete all Balise data (Profile → Balise data → “Delete all Balise data”): permanently deletes your searchable photos, notes, collections, import history, the self reference, and any copies stored by Balise, across knowledge storage, both media buckets, the control database, push registration and operational state; running jobs are aborted first. Your Apple Photos and your sign-in account do not change;
- manage sign-in methods and sign out (Profile → Account & sign-in).
10.2 Access, export, correction, deletion
Depending on where you live (including GDPR if you are in the EEA/UK, and similar laws elsewhere), you may have rights to access, rectify, erase, restrict, port, and object to certain processing, and to withdraw consent where processing is consent-based.
Export. You can request an export of workspace-held data such as profile properties, observations / facts / provenance, and domain configuration, by email. Exports do not include Apple Photos originals, which Balise never stored.
Account deletion. Deleting all Balise data from the app removes your workspace content. To close the sign-in account itself (the Clerk identity), email apps@groupe-tamara.com with subject “Balise delete my account” from your account email (or include enough detail to identify the Sign in with Apple account). We will delete your workspace data if you have not already, and delete or anonymize the Clerk identity in the weekly prune of closed sign-in accounts, retaining only a minimal non-content audit entry if needed to prove completion. We are committed to offering in-app account deletion meeting App Store Guideline 5.1.1(v) before App Store release.
Waitlist. Email us and we remove your address from the waitlist.
10.3 Complaints
You may contact us first so we can help. You may also lodge a complaint with a supervisory authority. In France, that is the CNIL (cnil.fr). If you live elsewhere in the EEA/UK, contact your local authority.
10.4 California / other US state laws
We do not sell personal information for money, and we do not share it for cross-context behavioral advertising.
11. Children and age eligibility
You must be at least 16 years old to create a Balise account (or the higher age of digital consent where you live). Where local law allows a lower age with verifiable parental consent (for example 13+), we may permit that only after implementing an appropriate parental-consent flow; until then, 16+ is the default. Balise is not directed at children under these thresholds. We do not knowingly create accounts for children or solicit personal data from them. If you believe a child has used Balise in a way that provided us personal data, contact apps@groupe-tamara.com and we will take appropriate steps, including deletion.
12. People who appear in your photos (including children)
Your library may contain images of other people (including children). When the account holder includes such photos, Balise may temporarily process those images for ephemeral inference and may store structured knowledge about them (descriptions, events, places, and related facts) in the workspace. Balise does not keep the image files beyond the one-day windows described in §4.
Expected personal use. Parents photographing their own children for personal knowledge (for example watching a child grow up) is an expected personal use of Balise. The way to “see the pictures” is Apple Photos on your device — not Balise becoming a photo archive.
We do not have a direct relationship with third parties who appear in your photos and do not run a face-recognition identity network. You (the account holder) remain responsible for having the right to process photos that include other people. Use limited Photos access, the period and count controls, and deletion if photos should not be processed. Shared albums are always excluded, and Balise does not compute face templates for anyone other than the account holder’s own self reference (§4.6).
13. Security
We use private (non-public) buckets for inference media with public access prevention enforced, short-lived signed upload and read URLs, workspace-scoped credentials and object paths, encryption in transit (TLS), and access controls intended to isolate workspaces. No method of transmission or storage is perfectly secure. Report suspected vulnerabilities or incidents to apps@groupe-tamara.com (subject “Balise security”).
14. Automated decision-making
Balise uses machine learning to extract and organize information from photos. These outputs are assistive knowledge tools for your account. They are not intended to produce legal effects or similarly significantly affect you as solely automated decisions under GDPR Art. 22. You can correct or delete extracted knowledge.
15. Changes
We may update this policy by publishing a new version at this URL with a revised date. Material changes will also be called out in App Store / TestFlight release notes or in-app notice when practicable. For significant changes that require consent under applicable law (including any future optional image-retention feature), we will request consent / opt-in before proceeding.
16. Contact
BRK · Groupe Tamara
apps@groupe-tamara.com (subject “Balise privacy”)
groupe-tamara.com · usebalise.com
Contact and requests
Delete everything we learned: in the app, Profile → Balise data → Delete all Balise data. It runs right away. Your Apple Photos and your sign-in stay as they are.
Close the account itself, export your data, or anything else: email apps@groupe-tamara.com from your account email. Subjects that help us route it: “Balise delete my account”, “Balise export”, “Balise security”, “Balise privacy”. A person answers.
Off the waitlist: same address, one line, done.