Privacy Policy

TallyPip is a service of Rise Technologies LLC, doing business as TallyPip ("TallyPip", "we", "us"). This policy applies to personal information we handle through tallypip.com, the TallyPip app, our emails, and TallyPip Experts. It should be read together with our Terms of Use.

Two kinds of information. Some information is about you as our customer, such as your name, email and billing details. For that information, we decide how it's used. Other information is what you keep in your books about other people, such as your customers, vendors and staff. For that information, you are in charge, and we process it on your behalf and only on your instructions. If one of your customers asks about their data, we'll point them to you and help you respond.

• We never sell your data, or your customers' data, to anyone.
• We don't use it for advertising. The app has no ad trackers.
• Your business stays separate. Each business's data is walled off from every other customer's, including inside our database.
• No AI training on your books. Your data isn't used to train AI models, ours or anyone else's.
• You can take it with you. You can export your records at any time.

Information you give us

• Account details: your name, email address, password (stored only in scrambled, hashed form) and the businesses you create or join.
• Business details: business name, country, address, logo and settings.
• Your books: transactions, invoices, estimates, bills, customers, vendors, products, receipts, notes and files you add. When you upload a photo, we remove hidden details it may carry, such as where it was taken and what device took it, before we store it. Bank statement files are read and not kept: only the transactions from them are saved.
• Billing details: your plan and billing history. Our payment processor collects your card details. We never see or store your full card number.
• Messages: what you send us when you contact support or request Experts help, including any phone number you give us.

Information from services you connect

• Bank and card accounts, through Plaid: account names, balances and transactions. We never receive your bank login details.
• Google or Apple sign-in: your name and email address, and an ID that confirms it's you. We don't get your Google or Apple password.

Information collected automatically

• Your IP address, browser and device type, and pages visited in the app, kept in security and diagnostic logs.
• Sign-in activity (time, IP address, approximate country, and device and browser type), used to keep your account secure and kept for 90 days.
• Activity history: a record of the changes made in each business (who added, changed or deleted what, and when), which owners, admins and accountants of that business can see. It's kept while the business's account is open.
• Which days your business used TallyPip and on what kind of device, and how many of each thing it has (for example, number of invoices), so we can see which features help. Our team sees these counts, not what's in your books.

We use personal information to:

• provide the Service, including keeping your books, sending invoices and reminders, and producing reports;
• create and secure your account, confirm your email, and detect and prevent fraud or abuse;
• process payments and send receipts, trial reminders and other account notices;
• answer your questions and provide Experts help you've asked for;
• fix problems and improve TallyPip, using usage statistics that don't identify you where we can;
• send product news if you've agreed to it (you can unsubscribe at any time);
• meet our legal obligations, and enforce our Terms.

If you're in a place where we need a legal basis to use your information, we rely on these: providing the service you signed up for, our legitimate interest in running a secure and useful business, your consent (such as for marketing emails), and legal obligations.

Some TallyPip features use automated tools, including AI models, to sort transactions, read receipts and bank statements you upload, and answer questions about your books. When they do:

• They only see the business you're working in. Our servers decide which business a request belongs to, and the database blocks access to any other business. Someone can't trick the assistant into showing them another customer's data.
• Learning stays with your business. For example, suppose you teach TallyPip that "Shell" means Fuel. That's remembered for your business only. It's never shared with, or used to answer, other customers.
• No training. We use AI providers that don't use customer data to train their models, and we don't train models on your data either.
• Nothing without you. These tools suggest, and you decide. Changes to your books are either approved by you or shown to you so you can undo them.
• No automated decisions with legal effects. We don't use these tools to make decisions about you that have legal or similarly significant effects.

We share personal information only in these cases:

• Service providers who run parts of TallyPip for us, under contracts that limit their use of it to that work. These are: Amazon Web Services (hosting, storage, email delivery and AI models), Anthropic (AI models that read receipts and bank statements you upload), Plaid (bank connections), our payment processor, and Cloudflare (domain and network security).
• People you choose. This includes team members and accountants you invite to your business, and customers you send invoices to.
• TallyPip Experts. If you request Experts help, we share what's needed with the accounting professionals helping you, and only for that work.
• Legal reasons. We share information when we believe in good faith that the law, a court order or a valid legal request requires it, or when it's needed to protect the safety, rights or property of our customers, the public or TallyPip. Where the law allows, we'll tell you before we hand over your data.
• If our business changes hands. If TallyPip is sold or merged, your information may transfer to the new owner. It will stay protected by this policy, and we'll tell you before that happens.

Plaid handles bank data under the Plaid End User Privacy Policy.

We use cookies that are needed for TallyPip to work. One keeps you signed in, and one remembers which business you're working in. Signing in with Google or Apple uses short-lived cookies for that sign-in (gone within 10 minutes). We may also use a cookie to protect sign-in forms from abuse. We don't use advertising or cross-site tracking cookies, and we don't let ad networks track you on TallyPip.

We count visits to our public pages without cookies and without storing anything on your device: we record the page, the site or campaign link you came from, and the kind of device. To count each visitor once a day, we use a one-way code made from your IP address, browser and a random value that we delete every day, so we can't recognise you on another day and we never store your IP address for this. If you sign up, we note which site or campaign link brought you to us. If we ever add analytics that aren't strictly necessary, we'll update this policy and ask for your consent where the law requires it.

• Data is encrypted in transit (HTTPS) and at rest on our hosting provider.
• Each business's data is separated at the database level, not just in the app.
• Passwords are stored only as salted hashes. Sign-in links and session tokens are also stored in hashed form.
• Staff access to customer data is limited to people who need it to support you, and it is logged.
• Our team can see what's in your books only when an owner or admin of your business turns on Support access (Settings > Support access), for the time you choose. They can look but not change anything, you can stop it at any time, and every page they open is listed for you.
• We keep backups, and we test that the walls between businesses hold.

We keep a written security program, with a named person responsible for it, as New York's SHIELD Act requires. If a breach affects your personal information, we'll notify you and the authorities within the time the law sets (for New York residents, within 30 days of discovering it).

We keep your information while your account is open. If you close your account (Settings › Close business), you'll have 30 days to export your data. We then delete it from our live systems. Copies in backups are deleted within 35 days after that.

We keep some records for longer where the law or a legitimate need requires it. Examples are billing records, which we keep for tax purposes (usually up to 7 years), and records needed to resolve disputes or prevent fraud.

• Access and export: see your information, and export your books at any time from the app.
• Correction: change your details in the app, or ask us to fix anything that's wrong.
• Deletion: ask us to close your account and delete your information, subject to records we must keep by law.
• Marketing: use the unsubscribe link in any marketing email. You'll still get important account messages.
• Connections: disconnect a bank or sign-in provider at any time.

To make a request, email support@tallypip.com from the address on your account. We may need to confirm it's you. We'll respond within the time the law requires, usually within 30 days. We won't treat you differently for using these rights.

US residents. Some US states, such as California, Virginia, Colorado and others, give residents extra rights. These include the rights to know, access, correct and delete personal information, and to opt out of its sale, its use for targeted advertising, and profiling. We don't sell personal information, and we don't "share" it for cross-context behavioral advertising, so there's nothing to opt out of. We use sensitive information, such as account logins and financial account data, only to provide the Service. You can use your rights by emailing support@tallypip.com, or through an authorized agent. If we deny your request, you may appeal by replying to our decision.

Canadian residents. We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). You can access and correct your information, and withdraw consent, subject to legal and contract limits. If you're not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

We store and process data in the United States, using Amazon Web Services. If you're outside the US, including in Canada, your information will be transferred to the US and handled there. It may then be accessible to US authorities under US law. We protect it as described in this policy wherever it's processed.

TallyPip is not intended for anyone under 18, and we don't knowingly collect personal information from children. If you believe a child has given us information, contact us and we'll delete it.

We may update this policy as TallyPip grows. For material changes, we'll give you notice by email or in the app before they apply, and ask for your consent where the law requires it. The date at the top shows when it was last updated.

Privacy questions and requests: support@tallypip.com
Rise Technologies LLC, doing business as TallyPip
418 Broadway, Ste R, Albany, NY 12207