Privacy Policy

Last updated: 24 August 2026 · Version 1.0

This policy explains what personal data Tally collects, why we collect it, how long we keep it, and what rights you have over it. It covers the Tally website, the Tally Telegram bot and the Tally web dashboard.

1. Who we are

Tally is operated by [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS], company number [NUMBER]. For the purposes of the UK GDPR and the EU GDPR we are the data controller for the personal data described in this policy.

Data protection enquiries: privacy@tallyflows.com.

2. What we collect, and why

2.1 When you contact us through the website

If you submit the demo request form we collect the name, work email address, company, role, team size, CRM, events and message you provide, along with the page you submitted from, your referrer, any UTM campaign parameters in the URL, your browser's user-agent string and a salted one-way hash of your IP address.

We use this to respond to your enquiry and to arrange the demo you asked for. The lawful basis is your consent, given by ticking the box on the form, and our legitimate interest in responding to business enquiries.

The IP address is stored only as a salted hash, which we cannot reverse. It exists so we can identify automated abuse of the form, not to identify you.

2.2 When you use the Tally product

Tally processes the content you send to the bot (voice notes, text messages and photographs) in order to produce a structured lead record. That content, and the records derived from it, may include personal data about the people you met.

Where you use Tally in the course of your employment, your employer is the data controller for that content and Tally acts as a data processor on their instructions, under a data processing agreement. Where you use Tally as an individual on a personal plan, Tally is the controller.

You are recording yourself, never the client and never the room. Tally does not provide ambient or continuous recording. You are responsible for having a lawful basis for the information you choose to record about the people you meet, and for telling them where required.

2.3 Account and billing data

To operate an account we store your Telegram user identifier, your email address, your organisation, and your plan. Payments are processed by Stripe, who handle card details directly; Tally never sees or stores your card number.

2.4 Website analytics

The Tally website uses Google Tag Manager to load Google Analytics 4, which we use to understand which parts of the site are useful. It measures pages viewed, sections reached, and which calls to action are used. A consent banner appears on your first visit; analytics is active unless you choose Reject, and your choice is stored for 180 days. Google acts as our processor for this data, and Google Consent Mode is used so that a rejection stops analytics storage immediately.

We also use Google's advertising cookies to measure which of our campaigns led to a visit and to show our adverts on other sites. These are covered by the same banner and the same choice: on unless you reject, off from the moment you do.

We never send the contents of the demo form to Google. Your name, email address, company and message stay on our own servers. The analytics layer is coded to report only whether a field was completed and how long it took, never what you typed. We do not sell what we collect, and none of it is used to make automated decisions about you. Full detail, including cookie names and lifetimes, is in the cookie notice.

3. Who we share it with

We do not sell personal data, and we do not share it for anyone else's marketing.

We share data with service providers who process it on our behalf under contract:

Where a provider is outside the UK or EEA, transfers are made under UK International Data Transfer Agreements or EU Standard Contractual Clauses as applicable.

4. How long we keep it

5. Your rights

Under the UK and EU GDPR you have the right to access the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to our processing of it, and to receive it in a portable format. Where our processing relies on consent, you can withdraw that consent at any time; doing so does not affect processing carried out before you withdrew it.

To exercise any of these, email privacy@tallyflows.com. We will respond within one month.

If you are using Tally through your employer, please direct requests about captured lead data to them, as they control it. We will assist them in responding.

If you are unhappy with how we have handled your data you can complain to the UK Information Commissioner's Office at ico.org.uk, or to your local supervisory authority in the EEA.

6. Security

Data is encrypted in transit using TLS and at rest by our hosting provider. Access to production data is limited to staff who need it and is logged. GDPR and SOC 2 certification are in progress; we will publish the certificates here when they are issued, and we do not claim to hold them today.

7. Children

Tally is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.

8. Changes to this policy

If we make a material change we will update the date at the top and, where the change affects you directly, tell you by email or in the product before it takes effect.

9. Contact

[LEGAL ENTITY NAME]
[REGISTERED ADDRESS]
privacy@tallyflows.com