# Privacy Policy — Tally

Last updated: 24 August 2026 · Version 1.0
Canonical page: <https://tallyflows.com/legal/privacy.html>

> **Draft status.** This document is a working draft written to cover how the
> site and product actually behave. The bracketed fields below are unfilled and
> the text has not yet been reviewed by a qualified data-protection adviser. It
> is not legal advice, and it is not a final policy — do not cite it as settled.

This policy explains what personal data Tally collects, why, how long it is kept,
and what rights you have over it. It covers the Tally website, the Tally Telegram
bot and the Tally web dashboard.

## 1. Who we are

Tally is operated by [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS],
company number [NUMBER]. For the purposes of the UK GDPR and the EU GDPR we are
the data controller for the personal data described here.

Data protection enquiries: privacy@tallyflows.com

## 2. What we collect, and why

### 2.1 When you contact us through the website

The demo request form collects the name, work email, company, role, team size,
CRM, events and message you provide, plus the page you submitted from, your
referrer, any UTM parameters, your user-agent string, and a salted one-way hash
of your IP address.

Used to respond to your enquiry and arrange the demo. Lawful basis: your
**consent**, given by ticking the box, and our **legitimate interest** in
responding to business enquiries.

The IP address is stored only as a salted hash, which cannot be reversed. It
exists to identify automated abuse of the form, not to identify you.

### 2.2 When you use the Tally product

Tally processes the content you send to the bot (voice notes, text, photographs)
to produce a structured lead record. That content and the records derived from it
may include personal data about the people you met.

Used in the course of employment, your employer is the controller and Tally acts
as a **processor** under a data processing agreement. On an individual plan,
Tally is the controller.

**You are recording yourself, never the client and never the room.** Tally does
not provide ambient or continuous recording. You are responsible for having a
lawful basis for what you record about the people you meet, and for telling them
where required.

### 2.3 Account and billing data

Your Telegram user identifier, email address, organisation and plan. Payments are
processed by Stripe, who handle card details directly — Tally never sees or
stores your card number.

### 2.4 Website analytics

The website uses Google Tag Manager to load Google Analytics 4, measuring pages
viewed, sections reached and which calls to action are used. A consent banner
appears on your first visit; **analytics is active unless you choose Reject**,
and your choice is stored for 180 days. Google acts as our processor, and Google
Consent Mode is used so a rejection stops analytics storage immediately.

Google advertising cookies are also used, to measure which campaign led to a
visit and to show our adverts on other sites. Same banner, same choice: on unless
you reject, off from the moment you do.

**We never send the contents of the demo form to Google.** Your name, email,
company and message stay on our own servers; the analytics layer reports only
whether a field was completed and how long it took, never what you typed. We do
not sell what we collect, and none of it makes automated decisions about you.
Cookie names and lifetimes are in the [cookie notice](https://tallyflows.com/legal/cookies.md).

## 3. Who we share it with

We do not sell personal data and do not share it for anyone else's marketing.
Service providers processing on our behalf under contract:

| Provider | Purpose | Location |
| --- | --- | --- |
| Microsoft Azure | Application and database hosting | Italy North (EU) |
| Telegram | Message delivery to and from the bot | Per Telegram's own policy |
| [AI/TRANSCRIPTION PROVIDER] | Speech-to-text and information extraction | [REGION] |
| Your chosen CRM | Syncing the records you ask us to sync | Per your CRM contract |
| Stripe | Subscription billing | Ireland (EU) |

Where a provider is outside the UK or EEA, transfers are made under UK
International Data Transfer Agreements or EU Standard Contractual Clauses.

## 4. How long we keep it

| Data | Retention |
| --- | --- |
| Demo request submissions | 24 months from last contact, then deleted |
| Original voice notes | Life of the account, so the recording stays playable. Deleted within 30 days of account closure. |
| Lead records and dashboard data | Life of the account; deleted within 30 days of closure |
| Account and billing records | As required by tax law, currently [N] years |
| Salted IP hashes and server logs | 90 days |

## 5. Your rights

Under the UK and EU GDPR you may access the personal data we hold about you, have
it corrected or erased, restrict or object to our processing, and receive it in a
portable format. Where processing relies on consent you can withdraw it at any
time; withdrawal does not affect processing carried out beforehand.

To exercise any of these, email privacy@tallyflows.com. We respond within one
month.

If you use Tally through your employer, direct requests about captured lead data
to them, as they control it. We will assist them in responding.

Complaints can go to the UK Information Commissioner's Office at ico.org.uk, or
your local EEA supervisory authority.

## 6. Security

Encrypted in transit using TLS and at rest by our hosting provider. Access to
production data is limited to staff who need it, and is logged. **GDPR and SOC 2
certification are in progress; we do not claim to hold them today** and will
publish the certificates when issued.

## 7. Children

Tally is a business tool, not directed at anyone under 18. We do not knowingly
collect data from children.

## 8. Changes to this policy

Material changes update the date at the top, and where the change affects you
directly we tell you by email or in the product before it takes effect.

## 9. Contact

[LEGAL ENTITY NAME], [REGISTERED ADDRESS] — privacy@tallyflows.com