Privacy Policy
Version 0.1-draft · Terms · Privacy · Data Processing Agreement
1. Who we are
Tallyback is provided by [Company name] Limited, company number [number], registered office [address] ("we", "us"). We are registered with the Information Commissioner's Office (ICO), registration number [number]. Contact us about privacy at hello@tallyback.co.uk.
This policy explains how we use personal data when we run our own business. When we process data for our customers (for example, their suppliers' contact details), we do so as their processor under our Data Processing Agreement.
2. What we collect and why
| Whose data | What we collect | Why we use it | Lawful basis |
|---|---|---|---|
| Customer users | Name, work email, password (stored only as a secure hash), company name, settings | To create and run your account and provide the Service | Contract |
| Customer users | Login times, IP address, failed login attempts | To keep accounts secure and prevent misuse | Legitimate interests (security) |
| Customer users | Which version of our terms you accepted, and when | To show what was agreed | Contract; legitimate interests |
| Billing contacts | Name, email, company and VAT details, payment status | To invoice and collect fees, and keep VAT and accounting records | Contract; legal obligation |
| Anyone who contacts us | Name, email and what you tell us | To answer questions and give support | Legitimate interests |
| Website visitors | Technical data needed to show pages securely | To run and protect the website | Legitimate interests |
We do not sell personal data, use it for advertising, or use customer content to train AI models. We will only send product news if you agree, and you can opt out at any time.
3. If you are a supplier we contacted
If you received an email from "[a business] via Tallyback", one of your customers uses Tallyback to reconcile its supplier account. That customer is responsible for your data (the controller); we process it for them.
- What we hold: your business name and the contact name and email address your customer has on file, your statements and invoices, and emails you send in reply.
- Why: to ask for statements and copies of invoices, and to match them to your customer's records.
- Who to contact: to stop these emails or ask about your data, contact the customer named in the email. You can also email us at hello@tallyback.co.uk and we will pass your request to them promptly.
We only send emails about statements and invoices. We never use supplier details for marketing.
4. Who we share data with
We use a small number of providers to run Tallyback: hosting (Akamai, servers in London), email (Postmark), AI reading of scanned documents (Anthropic), invoicing (Xero) and payment collection ([GoCardless / Stripe]). Each is bound by a contract to protect the data. We may also share data if the law requires it, or with a buyer if our business is sold.
5. Transfers outside the UK
Our servers and stored data are in the UK. Some providers (Postmark and Anthropic) are based in the United States, so some data passes to them when emails are sent or documents are read. We rely on [the UK–US data bridge / the ICO's International Data Transfer Agreement or Addendum] to protect it.
6. How long we keep it
| Data | How long |
|---|---|
| Account data | While your account is open, then [30] days |
| Customer documents and emails | Until the customer deletes them or leaves, then deleted within [60] days including backups |
| Billing and VAT records | 6 years after the end of the financial year, as required by law |
| Security logs | [12] months |
| Support emails | [2] years |
7. Your rights
You have the right to ask for a copy of your data, and to ask us to correct it, delete it, restrict or object to its use, or move it to another provider. Email hello@tallyback.co.uk. We reply within one month.
8. Complaints
If you're unhappy with how we use your data, please complain to us first at hello@tallyback.co.uk. We will acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
9. Cookies
We only use cookies that are needed to log you in and keep your session secure. We don't use advertising or tracking cookies, so we don't ask for cookie consent.
10. Changes
We will post any changes here and tell customers by email if they are significant.