Tally

Tally

Privacy Policy

Effective date: 31 March 2026

Version 1.0

Applies to users in the United Kingdom only

1. About This Policy

This Privacy Policy explains how Tally Labs (UK) Limited ("Tally", "we", "us", or "our") collects, uses, stores, shares, and protects personal and business data when you use the Tally mobile application and associated Services.

Tally is committed to handling your data lawfully, fairly, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where we act as a data controller, we are responsible for your personal data. Where we act as a data processor on your behalf (for example, storing your customers' data that you input), you are the data controller.

Please read this policy carefully. By using the Services, you acknowledge that you have read and understood it.

2. Who We Are

Tally Labs (UK) Limited is the data controller for personal data collected in connection with your account and use of the Services.

Contact: info@tallyapp.com.

3. Data We Collect

3.1 Data You Provide Directly

  • Account registration data: name, email address, mobile number, business name, business type, and address
  • Identity verification data where required (e.g., for financial account connections)
  • Business financial data: income records, expense records, invoices, receipts, and related documents you input
  • Transaction data imported via Connected Account integrations
  • Tax filing information
  • Inventory data, order information, customer records, and booking data you create within the app
  • Customer and supplier details you enter into the platform

3.2 Data Generated by Your Use of the Services

  • Usage data: how you interact with app features, session frequency, and feature engagement
  • Device data: device type, operating system version, app version, and anonymised device identifiers
  • Log data: error logs, performance data, and diagnostic information
  • AI model inputs and outputs: data processed to generate insights and recommendations

3.3 Data Received from Third Parties

  • Transaction and balance data retrieved from Connected Accounts (bank and payment accounts you authorise)
  • Identity or verification data from third-party identity providers where applicable

4. How We Use Your Data

4.1 To Provide and Operate the Services

We use your data to:

  • Create and manage your account
  • Provide bookkeeping, tax filing, performance tracking, inventory, POS, time management, order and booking services
  • Retrieve and process transaction data via Connected Accounts
  • Generate AI insights and recommendations based on your business data
  • Communicate with you about the Services, updates, and support matters

Legal basis: Performance of a contract with you (UK GDPR Article 6(1)(b)).

4.2 To Improve and Develop the Services

We use aggregated and anonymised data — including usage data and AI model interactions — to understand how the Services are used and to develop new features. Where possible, we anonymise this data so it cannot be linked back to you as an individual.

Legal basis: Legitimate interests (UK GDPR Article 6(1)(f)) — improving our services for the benefit of all users.

4.3 To Comply with Legal Obligations

We may process and retain data as required by applicable law, regulatory obligations, or HMRC requirements, including Making Tax Digital regulations.

Legal basis: Legal obligation (UK GDPR Article 6(1)(c)).

4.4 With Your Explicit Consent — Partner Offers

With your explicit, freely given, and separately obtained consent, we may share your business profile and relevant financial data with selected third-party partners — such as lenders, suppliers, or business service providers — so they can make you relevant offers or opportunities. You may withdraw this consent at any time through your account settings, and withdrawal will not affect the lawfulness of any processing already carried out.

Legal basis: Consent (UK GDPR Article 6(1)(a)).

4.5 Aggregated and Anonymised Data Sharing

With your general agreement at account creation (which you may revisit at any time in your settings), we aggregate and anonymise your business data — removing all personal and directly identifiable information — for the following purposes:

  • Providing aggregated industry and local economic benchmarks to partner suppliers, enabling them to offer relevant discounts or improved services to Tally users
  • Improving and personalising product features using insights from collective patterns
  • Sale of aggregated, anonymised economic and commercial trend data to third parties such as researchers, financial institutions, and market analysts

This aggregated data is processed in such a way that no third party recipient can directly identify you or your individual business from the shared data. It is not linked to your name, contact details, or any unique identifier.

Legal basis: Legitimate interests (UK GDPR Article 6(1)(f)), supplemented by your general consent at account creation.

5. Data Sharing

5.1 Service Providers

We share your data with carefully selected third-party service providers who process it on our behalf to help us deliver the Services. These include cloud hosting providers, analytics platforms, open banking connectivity providers, and customer support tools. All such providers are bound by data processing agreements and may only use your data as instructed by us.

5.2 Open Banking and Connected Account Providers

If you connect a bank or payment account, we share necessary data with regulated open banking providers to facilitate that connection. These providers operate under their own regulatory frameworks including the Payment Services Regulations 2017.

5.3 Partner Offers (with explicit consent)

Only with your explicit, opt-in consent, we may share your data with selected third-party lenders, suppliers, or service providers for the purpose of presenting you with relevant offers. We do not sell your individually identifiable data.

5.4 Aggregated Data Buyers

We may sell or share anonymised, aggregated data with third parties as described in Section 4.5. This data cannot be used by recipients to identify you individually.

5.5 Legal and Regulatory Disclosure

We may disclose your data to law enforcement, regulatory bodies (including HMRC), or other authorities where required by law, court order, or in connection with legal proceedings.

5.6 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, your data may be transferred to a successor entity. We will notify you of any such transfer and of any choices you may have regarding your data.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Services. We also retain data for as long as necessary to comply with legal obligations (for example, HMRC record-keeping requirements for business tax records, typically a minimum of six years), resolve disputes, and enforce our agreements.

When data is no longer required, we delete or anonymise it in accordance with our internal data retention schedule.

7. Data Security

We implement appropriate technical and organisational security measures to protect your data against unauthorised access, loss, alteration, or disclosure. These include encryption in transit and at rest, access controls, regular security assessments, and incident response procedures.

However, no method of electronic transmission or storage is completely secure. While we take the protection of your data seriously, we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) in accordance with our obligations under UK GDPR.

Limitation: Tally's security obligations apply to data within systems under our control. We are not responsible for the security of data held by your bank or payment provider, or for breaches occurring at third-party open banking providers.

8. International Transfers

Tally is a UK-based service. Where we transfer your data outside the United Kingdom, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or equivalent mechanisms, to protect your data in accordance with UK GDPR requirements.

9. Cookies and Tracking

The Tally mobile application uses local storage and similar technologies for essential functionality, session management, and app performance. A full Cookie and Tracking Technology Policy applicable to any Tally web presence is available separately. The app does not serve third-party advertising cookies.

10. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

  • Right of access: to request a copy of the personal data we hold about you
  • Right to rectification: to request correction of inaccurate or incomplete data
  • Right to erasure: to request deletion of your data in certain circumstances
  • Right to restriction: to request that we restrict the processing of your data
  • Right to data portability: to receive your data in a structured, commonly used format
  • Right to object: to object to processing based on legitimate interests
  • Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time

To exercise any of these rights, please contact us at privacy@tally.app. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. Children

The Services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.

12. Limitation of Liability for Data Matters

While we comply with UK data protection law and implement robust security measures, Tally's liability in connection with any data-related matter — including data breaches, unauthorised access, or loss of data — is limited to the fullest extent permitted by law, and subject to the overall liability cap set out in our Terms of Service.

We are not liable for:

  • Any loss or damage arising from your failure to maintain the security of your account credentials
  • Data loss or corruption resulting from third-party service failures, open banking provider failures, or actions outside our reasonable control
  • Consequences arising from data you voluntarily share with or consent to us sharing with third parties

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, Services, or applicable law. Where changes are material, we will notify you via the app or by email before they take effect. Your continued use of the Services after the updated Policy takes effect constitutes your acceptance of those changes.

14. Contact Us

For any privacy-related questions, requests, or concerns:

Tally Labs (UK) Limited

Email: info@tallyapp.com

You also have the right to contact the Information Commissioner's Office (ICO) directly:

ICO: ico.org.uk | Helpline: 0303 123 1113