Legal notice — found from the homepage — Balsamiq

Cited by

Facts read from this source

• Entity name Report an error

  “Balsamiq Studios, LLC and its affiliates ("Balsamiq," "we," "us," or "our") collect, use, disclose, and protect your personal information”

• Policy last updated Report an error

  “Last updated on October 24, 2026. Document History”

• Corporate structure Report an error

  “Balsamiq is a small multi-national organization, based in Italy and the USA. Our corporate group consists of: GJMG Holdings S.r.l. (Italy) — our parent holding company, which owns the Balsamiq trademark, name, and logo. Balsamiq S.r.l. (Italy) — our research and software development entity, based in Bologna, Italy. Balsamiq Studios, LLC (USA) — our sales, marketing, and distribution entity, based in Sacramento, California.”

• Data sale Report an error

  “We never sell, rent, or trade your Personal Data.”

• Joint controller Report an error

  “In accordance with GDPR Article 26, the essence of our joint controller arrangement is: Both Balsamiq entities collaborate in joint processing activities as defined in this policy.”

• Customer data role Report an error

  “For Customer Data (like your wireframes, prototypes, AI inputs and outputs): you are the data controller. Balsamiq acts as a data processor on your behalf, processing Customer Data only to provide the Services and Licensed Products.”

• Payment stored card Report an error

  “We do not store your credit card information — all payment processing is handled by Stripe (for Balsamiq Cloud) or Atlassian Marketplace (for Atlassian integrations).”

• Customer data AI training Report an error

  “We do not use Customer Data to train AI models.”

• Licensed products Report an error

  “Our Licensed Products (Balsamiq for Desktop, Balsamiq for Confluence Data Center, and Balsamiq for Jira Data Center) do not collect or transmit data unless you take a specific action that requires online access, such as accessing product documentation or registering a license.”

• Desktop data local Report an error

  “Balsamiq for Desktop stores project data locally on your device. We do not have access to it.”

• Desktop end of sale Report an error

  “sales of Balsamiq for Desktop end on December 31, 2026, and support ends on December 31, 2027. Desktop licenses stay perpetual.”

• AI provider Report an error

  “We use Google's Gemini models to power our AI features, as listed on our subprocessor list.”

• AI opt in Report an error

  “AI features are opt-in per interaction. If you do not want your data sent to AI providers, do not use Balsamiq AI features.”

• AI no automated decisions Report an error

  “Our AI features do not make such decisions — they are creative assistance tools.”

• List URL Report an error

  “Our current subprocessor list, including the purpose and location of each provider, is maintained at balsamiq.com/legal/subprocessors/.”

• Atlassian temporary copy Report an error

  “We store a temporary copy of your projects on our servers to provide functionality such as autosave and real-time collaboration. This data is regularly sent back to the Atlassian platform for official storage. We retain our temporary copy for up to 30 days.”

• Available integrations Report an error

  “If you use Balsamiq integrations such as the Balsamiq Trello Power-Up, Balsamiq Slack integration, or Balsamiq MCP server, your data may be shared with those third-party platforms to provide the integration functionality.”

• Analytics providers Report an error

  “We use third-party providers like PostHog and Google Analytics to understand how our websites and web-based Services are used.”

• Storage provider Report an error

  “Your Personal Data is stored on industry-standard third-party services, like AWS. Data may be processed in the US, EU, or other locations depending on third-party provider terms, the product you use, and your Balsamiq plan.”

• Data residency option Report an error

  “Balsamiq Cloud customers on an Enterprise Plan may choose their data residency region (US or EU).”

• Dpf certified Report an error

  “Balsamiq Studios, LLC* complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.”

• Transfer mechanisms Report an error

  “EU Standard Contractual Clauses (SCCs): Where the DPF does not apply, we use the European Commission's Standard Contractual Clauses.”

• Customer data retention Report an error

  “Retained during active subscription. Deleted within 60 days after Space closure. Available for export for 30 days after Space closure; if a Space Owner deletes a Space, there is no export period, and it is deleted within 60 days. Backups may persist for up to 90 days before permanent deletion.”

• Account data retention Report an error

  “Retained during your relationship with Balsamiq. Deleted within 60 days after contract termination, except where required by law (such as billing and financial records).”

• Usage data retention Report an error

  “Retained for up to 90 days. Some analytics data may be anonymized and retained longer in aggregated form, when it cannot identify individuals.”

• Data rights response time Report an error

  “You can exercise all of these rights by contacting us at support@balsamiq.com. We will respond within 30 days.”

• Data portability export Report an error

  “Right to portability: You can export your Customer Data (wireframes/projects) through the product interface.”

• CCPA Report an error

  “We do not collect sensitive personal information as defined by the CPRA.”

• Security measures Report an error

  “Encryption in transit and at rest Logical data isolation Strict access controls (SSO/MFA internally, least privilege) Regular vulnerability scanning, testing, and independent audits Documented incident response and communication procedures Participation in a security bug bounty program SOC 2 Type II compliance”

• Pci dss Report an error

  “All payments are processed by PCI-DSS compliant processors. Balsamiq does not store your payment card information.”

• No sensitive data Report an error

  “Our Services are not designed, certified, or intended to store or process sensitive personal data, including protected health information (HIPAA), financial account numbers, government-issued identifiers, or biometric data.”

• Minimum age Report an error

  “You must be at least 16 years old to use Balsamiq. We do not knowingly collect personal data from anyone under 16.”

• Privacy contacts Report an error

  “Email: support@balsamiq.com”

Scores citing this record

• The Agency Owner Files, formats & portability
• The Agency Owner AI features & rights to the work
• The Agency Owner European sovereignty
• The Agency Owner Pricing transparency
• The Brand Marketer Files, formats & portability
• The Brand Marketer AI features & rights to the work
• The Brand Marketer European sovereignty
• The Data Protection Officer Files, formats & portability
• The Data Protection Officer AI features & rights to the work
• The Data Protection Officer European sovereignty
• The Frontend Engineer Files, formats & portability
• The Frontend Engineer AI features & rights to the work
• The Frontend Engineer European sovereignty
• The Product Designer Collaboration, review & developer handoff
• The Product Designer Files, formats & portability
• The Product Designer AI features & rights to the work
• The Product Designer European sovereignty
• The Skeptic Files, formats & portability
• The Skeptic AI features & rights to the work
• The Skeptic European sovereignty
• The Skeptic Pricing transparency