Privacy Policy

This Privacy Policy describes how TallySpark collects, uses, and protects your personal information. We are committed to transparency and compliance with GDPR, CCPA, and international privacy standards.

1. Who We Are (Data Controller)

Pixelheads B.V.
De Nieuwe Erven 3
5431 NV Cuijk
The Netherlands

Chamber of Commerce (KvK): 69959447
VAT Number: NL 8580.81.301.B01

Contact for Privacy Matters:
Email: [email protected]
Website: https://tallyspark.com

Data Protection Role:
We act as the Data Controller under GDPR for your account information, user preferences, and subscription data. We act as a Data Processor for business content you upload (invoices, expenses, client data) - you are the Data Controller for that content.

2. Information We Collect

We collect information in the following categories:

2.1 Account Information

What We Collect:

• Full name
• Email address
• Password (securely encrypted)
• Organization name and details
• Role within organization
• Account preferences and settings
• Language and timezone preferences

How We Collect It:

• Directly from you during registration
• When you update your profile
• Through your use of the Service

Legal Basis (GDPR):

• Performance of contract (to provide the Service)
• Legitimate interests (account security, fraud prevention)

2.2 Organization Information

What We Collect:

• Organization name, address, and contact details
• Tax identification numbers (VAT, Tax ID)
• Business registration numbers
• Bank account information (IBAN) for payment processing
• Logo and branding assets
• Custom email domain settings

How We Collect It:

• Directly from you during organization setup
• When you update organization settings

Legal Basis (GDPR):

• Performance of contract (to provide invoicing and payment features)
• Legal obligation (tax compliance, financial record-keeping)

2.3 Billing and Payment Information

What We Collect:

• Billing name and address
• Payment method details (we do NOT store raw card numbers)
• Transaction history and invoices
• Subscription plan and billing cycle
• Payment processor merchant account identifiers

How We Collect It:

• Directly from you when setting up billing
• From payment processors when you process customer payments

Legal Basis (GDPR):

• Performance of contract (to process subscription payments)
• Legal obligation (tax records, financial compliance)

Important: We do NOT store credit card numbers. Payment card data is handled exclusively by our PCI-DSS Level 1 certified payment processors.

2.4 Business Content (You are the Data Controller)

What We Collect:

• Invoices - Client names, amounts, dates, line items, payment terms
• Quotes - Prospect information, pricing, approval status
• Expenses - Uploaded receipts, vendor information, amounts, categories
• Clients & Contacts - Names, email addresses, phone numbers, addresses
• Products & Services - Product names, descriptions, pricing
• Email Templates - Custom email content and branding

How We Collect It:

• Directly from you when creating records
• Uploaded documents (PDFs, images) processed via AI
• Imported data (CSV uploads)

Legal Basis (GDPR):

• Performance of contract (to provide business management features)
• Your legitimate interests (managing your business operations)

Your Responsibility:
You are the Data Controller for this business content. You must ensure you have the legal right to process your clients' and contacts' personal data under GDPR/CCPA.

2.5 AI-Processed Documents

What We Collect:

• Uploaded receipts (PDF, JPEG, PNG)
• Uploaded invoices (PDF)
• Expense reports and scanned documents

How We Process It:

1. You upload a document to TallySpark
2. Document is sent to our third-party AI service provider
3. AI extracts structured data (vendor, date, amount, line items)
4. Original document stored on secure cloud storage in Europe
5. You review and approve extracted data

AI Providers:
See Section 5.1 (Sub-Processors) for details on AI service providers.

Legal Basis (GDPR):

• Performance of contract (to provide AI document processing)
• Your consent (you explicitly upload documents for AI processing)

Data Retention by AI Providers:

• Documents are processed in real-time and NOT retained by AI providers after processing
• Customer data not used for model training
• Data not retained after processing completion

2.6 AI Chat Conversations (TallyAI)

What We Collect:

• Messages you send to the TallyAI chat assistant
• AI-generated responses
• Conversation metadata (timestamps, message count, conversation status)
• Actions performed by TallyAI on your behalf
• Usage statistics (monthly assist count, feature usage)
• Tool execution logs (what actions TallyAI performed)

How We Process It:

1. You send a message through the TallyAI chat interface
2. Your message is transmitted securely via HTTPS to Anthropic's Claude AI API
3. Anthropic processes your message and returns a response
4. If TallyAI needs to access your business data (clients, invoices, etc.) to answer your question, that data is included in the API request
5. The full conversation (your messages and AI responses) is stored in TallySpark's database
6. Conversations are automatically archived after 24 hours of inactivity

Third-Party AI Provider:
TallyAI is powered by third-party AI services. See Section 5.1 for details on AI service providers.

Data Shared with AI Providers:

• Your chat messages
• Recent conversation history (for context)
• Business data from your organization when needed to fulfill your requests (e.g., client information when you ask "show my top clients")
• No payment card data, passwords, or bank account information is ever shared

AI Provider's Data Usage:

• Your data is NOT used to train AI models
• Data is processed in real-time and not retained by the AI provider after the API call completes
• AI providers operate as sub-processors under Data Processing Agreements

Legal Basis (GDPR):

• Performance of Contract – To provide the AI chat assistant feature you've subscribed to
• Consent – By using TallyAI, you consent to your messages being processed by Anthropic's AI service
• Legitimate Interests – Improving the Service and monitoring for abuse

Data Retention:

• Active Conversations – Stored in database while your account is active
• Auto-Archival – Conversations archived after 24 hours of inactivity
• Account Deletion – Conversations deleted when you delete your account (subject to 30-day retention period)
• Legal Retention – Action logs may be retained for compliance purposes (see Section 7 - Data Retention)
• Backups – Included in daily backups, purged after 90 days from backup rotation

Your Rights:

• Access – You can view your conversation history within the application
• Deletion – You can request deletion of your conversations by contacting [email protected]
• Export – Conversation data is included in data export requests (GDPR Art. 20)
• Opt-Out – You can stop using TallyAI at any time; this does not retroactively delete stored conversations

Security:
All chat messages are transmitted over encrypted HTTPS connections. Conversations are stored with the same security measures as your other business data. Access to conversations is restricted to users within your organization.

Important Note:
Do not share sensitive personal information (e.g., social security numbers, passport numbers, health information) in TallyAI chat unless absolutely necessary for your business operations. While data is processed securely, minimizing sensitive data sharing reduces privacy risk.

2.7 Usage Data and Analytics

What We Collect:

• Pages viewed and features used
• Time spent in application
• Buttons clicked and actions taken
• Session duration and frequency
• Feature adoption and usage patterns
• Error reports and crash logs

How We Collect It:

• Automatically through our analytics service
• Browser cookies and local storage
• Error monitoring service

Analytics Providers:
See Section 5.1 (Sub-Processors) for details on analytics providers.

Legal Basis (GDPR):

• Legitimate interests (improving product features, fixing bugs, understanding user behavior)
• Consent (for non-essential cookies)

Data Retention:

• Analytics data: Up to 1 year for product improvement
• Error logs: 30-120 days for troubleshooting

2.8 Technical and Log Data

What We Collect:

• IP address
• Browser type and version
• Operating system
• Device information (desktop/mobile, screen resolution)
• Referrer URL (how you arrived at TallySpark)
• HTTP request logs
• Real-time connection logs
• API request logs

How We Collect It:

• Automatically via web server logs
• Application logging system
• Real-time communication services

Legal Basis (GDPR):

• Legitimate interests (security, fraud prevention, service performance)
• Legal obligation (maintain audit trails for security incidents)

Data Retention:

• Technical logs (server, connection, API): 30-120 days for troubleshooting and security purposes
• Security audit logs: Up to 2 years for compliance and investigation purposes

2.9 Communication Data

What We Collect:

• Emails sent through TallySpark (invoice notifications, payment confirmations)
• Email delivery status (sent, delivered, opened, clicked, bounced)
• Email tracking events (if enabled by your organization)
• Support ticket history and correspondence

How We Collect It:

• Email service provider webhooks
• Email tracking pixels and link tracking (when enabled)
• Support system interactions

Legal Basis (GDPR):

• Performance of contract (to send transactional emails)
• Legitimate interests (email deliverability, support quality)
• Consent (for email tracking, if enabled)

Data Retention:

• Email logs: 30-120 days
• Support tickets: 3 years for service quality and issue tracking

2.9 Cookies and Tracking Technologies

Cookies We Use:

Essential Cookies:

• Session cookies to keep you logged in (typically 2 hours)
• Security tokens to prevent unauthorized requests (session duration)
• Remember-me cookies if you choose to stay logged in (up to 1 year)
• Language and preference cookies (up to 1 year)

Analytics Cookies (with consent):

• Usage analytics cookies to understand how the platform is used (up to 1 year)
• Error tracking cookies to identify and fix technical issues (session duration)

Cookie Control:

• Essential cookies: Cannot be disabled (required for service functionality)
• Analytics cookies: Can be disabled via browser settings
• Third-party cookies: Controlled by respective analytics and monitoring services

Legal Basis (GDPR):

• Essential cookies: Performance of contract
• Analytics cookies: Consent (implied for product improvement)

2.10 OAuth and Third-Party Sign-In Data

What We Collect (Optional - Only if you use OAuth):

Google OAuth:

• Email address
• Full name
• Profile picture URL
• Google account ID

GitHub OAuth:

• Email address
• Username
• Profile picture URL
• GitHub account ID

How We Collect It:

• When you choose to sign in with Google or GitHub
• Through OAuth 2.0 authorization flow

Legal Basis (GDPR):

• Consent (you explicitly authorize OAuth sign-in)
• Performance of contract (to provide login functionality)

Data Sharing:

• We do NOT access your Google Drive, Gmail, or GitHub repositories
• Only basic profile information is collected
• You can disconnect OAuth at any time in account settings

3. How We Use Your Information

We use your personal information for the following purposes:

3.1 Service Delivery

• Provide access to TallySpark platform
• Process and store your invoices, quotes, and expenses
• Send transactional emails (invoice notifications, payment confirmations)
• Enable real-time features (real-time updates for expense processing)
• Facilitate payment processing integrations

Legal Basis: Performance of contract

3.2 AI Document Processing

• Extract data from uploaded receipts and invoices
• Automatically categorize expenses
• Match vendors to existing clients
• Populate invoice fields from templates

AI Providers: See Section 5.1 (Sub-Processors) for details
Legal Basis: Performance of contract, Consent (explicit document upload)

Guarantees:

• Your documents are NOT used to train AI models
• AI providers process data only on our instructions
• Data is not retained by AI providers after processing

3.3 Payment Processing

• Process subscription payments for TallySpark
• Facilitate customer payments through your connected payment processor account
• Calculate and deduct platform fees
• Generate invoices and receipts for tax purposes

Legal Basis: Performance of contract, Legal obligation (tax compliance)

3.4 Communication

• Send invoice and quote emails to your clients
• Deliver payment confirmations and receipts
• Send automated reminder emails for overdue invoices
• Notify you of important account events
• Respond to support requests

Email Provider: Third-party email delivery service (see Section 5.1)
Legal Basis: Performance of contract, Legitimate interests (customer communication)

3.5 Product Improvement and Analytics

• Understand how users interact with TallySpark
• Identify and fix bugs and errors
• Develop new features based on usage patterns
• Optimize performance and user experience
• Conduct A/B testing and feature experiments

Analytics Tools: See Section 5.1 (Sub-Processors) for details
Legal Basis: Legitimate interests (product improvement)

Privacy-Friendly Analytics:

• No cross-site tracking
• No third-party advertising networks
• Data used only for TallySpark improvements

3.6 Security and Fraud Prevention

• Detect and prevent fraudulent transactions
• Monitor for suspicious account activity
• Protect against unauthorized access and cyberattacks
• Maintain audit logs for security investigations
• Enforce Terms of Service and Acceptable Use policies

Legal Basis: Legitimate interests (security, fraud prevention), Legal obligation

3.7 Legal Compliance

• Comply with tax and financial reporting requirements
• Respond to legal requests (subpoenas, court orders)
• Enforce our legal rights and defend against claims
• Maintain records required by law (7-year financial record retention)

Legal Basis: Legal obligation, Legitimate interests (legal compliance)

3.8 Marketing Communications (With Consent)

• Send product updates and feature announcements
• Share tips and best practices
• Promote webinars and educational content

Legal Basis: Consent (opt-in required)
Opt-Out: Unsubscribe link in every marketing email

Note: Transactional emails (invoices, payment confirmations) cannot be unsubscribed from.

4. Legal Bases for Processing (GDPR Article 6)

Under GDPR, we process your personal data based on the following legal grounds:

Legitimate Interests Assessment:
Where we rely on legitimate interests, we have balanced our interests against your privacy rights and determined that processing is necessary and proportionate.

5. Data Sharing and Disclosure

We share your personal information only with trusted third-party service providers (sub-processors) who help us deliver the Service.

5.1 Sub-Processors (GDPR Article 28)

Infrastructure Providers

AWS S3 (Amazon Web Services)

• Purpose: Document storage (receipts, invoices, images)
• Location: European Union
• Data Processed: Uploaded files only
• Safeguards: GDPR Data Processing Addendum, EU hosting

Redis / Hosting Provider

• Purpose: Caching, session storage, queue management
• Location: EU or same region as application
• Data Processed: Session tokens, cached data, background jobs

AI & Machine Learning Providers

AI Service Providers

• Purpose: Document processing and AI-powered features
• Location: United States
• Data Processed: Uploaded documents, chat messages, business data (temporary, not retained after processing)
• Safeguards: Data Processing Agreements, not used for model training, Standard Contractual Clauses for EU-US transfers

Sub-processor List: For compliance purposes, we maintain a current list of AI service providers in our Data Processing Agreement (DPA). The list is available upon request and updated as providers change.

Payment Processors

Payment Processors

• Purpose: Secure payment processing compliant with PCI-DSS Level 1 standards
• Location: United States, European Economic Area
• Data Processed: Payment information, transaction details, merchant account identifiers
• Safeguards: PCI-DSS Level 1 certification, GDPR-compliant Data Processing Agreements. We do NOT receive or store raw card numbers.

Communication Services

Resend

• Purpose: Transactional email delivery
• Location: United States
• Data Processed: Email addresses, email content, delivery metadata
• Safeguards: Data Processing Addendum, Standard Contractual Clauses, Email encryption (TLS)
• Privacy Policy: https://resend.com/legal/privacy-policy

Analytics & Monitoring

Product Analytics Services

• Purpose: Product analytics, feature usage tracking, and user experience optimization
• Location: European Union or United States
• Data Processed: Usage events, user properties, anonymized analytics
• Safeguards: Data Processing Agreements, PII automatically scrubbed, data retention up to 1 year

Error Monitoring Services

• Purpose: Error tracking and performance monitoring
• Location: United States
• Data Processed: Error logs, stack traces, performance data (PII scrubbed)
• Safeguards: Data Processing Agreements, automatic PII scrubbing, Standard Contractual Clauses

Authentication Providers (Optional)

Google LLC

• Purpose: OAuth sign-in (optional)
• Location: United States
• Data Processed: Email, name, profile picture (only if you use Google sign-in)
• Privacy Policy: https://policies.google.com/privacy

GitHub, Inc.

• Purpose: OAuth sign-in (optional)
• Location: United States
• Data Processed: Email, username, profile picture (only if you use GitHub sign-in)
• Privacy Policy: https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement

5.2 Sub-Processor Changes

30-Day Notice:

We will notify you 30 days before adding a new sub-processor.

Right to Object:

You may object to a new sub-processor within 30 days. If we cannot accommodate your objection, you may terminate your subscription without penalty.

5.3 No Sale of Personal Data

We do NOT:

• Sell your personal information to third parties
• Share data with advertisers or data brokers
• Use your data for third-party marketing
• Allow third-party tracking for advertising purposes

CCPA Disclosure:
We have NOT sold personal information in the past 12 months and do not sell personal information.

5.4 Legal Disclosures

We may disclose your information if required by law:

• To comply with legal obligations (subpoenas, court orders)
• To respond to law enforcement requests
• To protect our legal rights and property
• To prevent fraud or illegal activity
• To protect the safety of our users or the public

Legal Basis: Legal obligation, Legitimate interests (legal defense)

5.5 Business Transfers

If TallySpark is involved in a merger, acquisition, or sale of assets:

• Your information may be transferred to the acquiring entity
• We will notify you 30 days before transfer
• The new owner must honor this Privacy Policy
• You may delete your account before transfer

6. International Data Transfers

6.1 Where We Store Data

• Primary Storage: European Union
• Application Hosting: [Varies by deployment - typically EU]
• Backups: EU region

6.2 Transfers Outside the EU

Some sub-processors are located outside the European Economic Area (EEA), primarily in the United States. These include:

• AI service providers
• Payment processors
• Email delivery services
• Error monitoring services

For a complete list of current sub-processors and their locations, please refer to our Data Processing Agreement (DPA) or contact [email protected].

6.3 Transfer Safeguards (GDPR Chapter V)

For transfers outside the EU, we use the following safeguards:

Standard Contractual Clauses (SCCs):

• EU Commission-approved Standard Contractual Clauses (2021 version)
• Ensures GDPR-level protection for data transferred to US processors

Adequacy Decisions:

• For sub-processors in countries with EU adequacy decisions

Data Processing Agreements:

• All sub-processors sign GDPR-compliant Data Processing Agreements

Additional Safeguards:

• Encryption in transit (HTTPS)
• Encryption at rest using secure encryption algorithms
• Access controls and authentication
• Contractual obligations to protect data

7. Data Retention

We retain your personal information only as long as necessary for the purposes outlined in this policy.

7.1 Retention Periods

7.2 Account Deletion Process

When you delete your account:

1. Day 0: Account deletion requested

• Access immediately suspended
• Data export window opens (30 days)

2. Days 1-30: Grace period

• Data retained for recovery
• You can reactivate account
• You can export data

3. Day 30: Automatic permanent deletion

• All personal data deleted
• Organization data deleted
• User-generated content deleted

4. Days 30-90: Backup purge

• Data removed from automated backups

5. Exception - Financial Records:

• Financial transactions retained for 7 years (legal requirement)
• Anonymized where possible (remove name, email, but keep transaction amounts for accounting)

7.3 Data Deletion Verification

Upon request, we can provide:

• Confirmation of deletion
• List of data categories deleted
• Exceptions (financial records with legal justification)

8. Data Security

We implement comprehensive security measures to protect your personal information.

8.1 Technical Safeguards

Encryption:

• In Transit: Encryption in transit (HTTPS) for all connections
• At Rest: Encryption at rest using secure encryption algorithms for databases and file storage
• Passwords: Secure password storage following industry best practices

Infrastructure Security:

• Firewalls: Network-level and application-level firewalls
• Intrusion Detection: Real-time monitoring for suspicious activity
• DDoS Protection: DDoS protection to maintain service availability
• Vulnerability Scanning: Automated security scans

Application Security:

• Input Validation: Input validation and security controls
• Protection Against Common Vulnerabilities: Protection against common web vulnerabilities
• Rate Limiting: Protection against brute force attacks
• Session Security: Secure session management with automatic timeout

Access Controls:

• Multi-Factor Authentication (MFA): Available for all users
• Role-Based Access Control (RBAC): Organization-level permissions
• Principle of Least Privilege: Minimal necessary access
• Audit Logging: All admin actions logged

8.2 Organizational Safeguards

Employee Access:

• Background checks for employees with data access
• Confidentiality agreements (NDAs)
• Security awareness training (annual)
• Access reviews (quarterly)
• Immediate revocation upon termination

Vendor Management:

• Due diligence on all sub-processors
• Data Processing Agreements required
• Security assessments before onboarding
• Ongoing monitoring of compliance

Incident Response:

• Security monitoring procedures to detect and respond to potential breaches
• Documented incident response plan
• Breach notification within 72 hours of discovery as required by GDPR Article 33
• Affected users notified without undue delay when personal data is compromised
• Annual incident response drills

Note: While we maintain robust security monitoring, we do not guarantee uninterrupted monitoring. Monitoring gaps may occur despite our security measures.

8.3 Data Breach Notification

GDPR Compliance (Article 33-34):

If a personal data breach occurs:

Within 72 Hours:

1. Notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens)
2. Send email notification to affected users
3. Post in-app notification

Breach Notice Includes:

• Nature and scope of the breach
• Categories of data affected
• Number of individuals affected
• Likely consequences
• Measures taken to address the breach
• Recommendations for affected individuals
• Contact information for questions

Your Actions:

• Monitor your account for suspicious activity
• Change your password if credentials may be compromised
• Report any subsequent suspicious activity to [email protected]

8.4 Security Limitations

No Absolute Security:

Despite our efforts, no system is 100% secure. You acknowledge that:

• Internet transmission has inherent risks
• Unauthorized access is possible despite safeguards
• You are responsible for maintaining the security of your password

Your Responsibilities:

• Use strong, unique passwords
• Enable multi-factor authentication
• Do not share account credentials
• Log out from shared devices
• Report suspicious activity immediately

9. Your Privacy Rights

Depending on your location, you have the following rights regarding your personal data.

9.1 GDPR Rights (EU/EEA Residents)

Right to Access (Article 15):

• Request a copy of your personal data
• Receive data in portable format (CSV, JSON)
• Understand how we process your data

Right to Rectification (Article 16):

• Correct inaccurate or incomplete data
• Update your information via account settings

Right to Erasure / "Right to be Forgotten" (Article 17):

• Request deletion of your personal data
• Exceptions: Legal obligations, fraud prevention, pending transactions
• Financial records retained 7 years (tax law requirement)

Right to Restriction (Article 18):

• Request restriction of processing in certain situations
• Data marked for deletion or disputed accuracy

Right to Data Portability (Article 20):

• Receive your data in machine-readable format
• Transfer data to another service provider

Right to Object (Article 21):

• Object to processing based on legitimate interests
• Object to direct marketing (always honored immediately)

Right to Withdraw Consent (Article 7(3)):

• Withdraw consent for marketing communications
• Withdraw consent for non-essential cookies
• Does not affect past processing based on consent

Right to Lodge a Complaint (Article 77):

• File complaint with your national Data Protection Authority
• Netherlands: Autoriteit Persoonsgegevens

Automated Decision-Making (Article 22):

• TallySpark does NOT use automated decision-making or profiling that produces legal effects

9.2 CCPA Rights (California Residents)

Right to Know:

• What personal information we collect
• Sources of personal information
• Purposes for collecting personal information
• Categories of third parties we share with

Right to Access:

• Request specific pieces of personal information (up to 2 times per year)

Right to Delete:

• Request deletion of personal information
• Exceptions for legal compliance, fraud prevention, service delivery

Right to Opt-Out of Sale:

• We do NOT sell personal information
• No opt-out necessary

Right to Non-Discrimination:

• We will NOT discriminate against you for exercising your CCPA rights
• Same service quality regardless of rights exercise

9.3 How to Exercise Your Rights

Self-Service (Account Settings):

• Update personal information: Account Settings → Profile
• Export data: Account Settings → Data Export
• Delete account: Account Settings → Delete Account
• Manage email preferences: Account Settings → Notifications

Email Requests:

• Send requests to: [email protected]
• Subject line: "Privacy Request - [Your Right]"
• Include: Full name, email address, organization name
• Specify: Which right you wish to exercise

Identity Verification:

• We may request proof of identity to prevent fraud
• Typically: Login to your account or answer security questions
• For high-risk requests (deletion): Additional verification required

Response Timeline:

• GDPR: 30 days (may extend to 60 days for complex requests)
• CCPA: 45 days (may extend to 90 days)
• Acknowledgment: Within 5 business days

Free of Charge:

• First request: Free
• Excessive or repetitive requests: We may charge reasonable administrative fees

10. Cookies and Tracking Technologies

10.1 What Are Cookies?

Cookies are small text files stored on your device when you visit TallySpark. We use cookies to:

• Maintain your login session
• Remember your preferences
• Analyze how you use our Service
• Improve security

10.2 Types of Cookies We Use

Essential Cookies (Cannot be Disabled):

• Session cookies to keep you logged in (typically 2 hours)
• Security tokens to prevent unauthorized requests (session duration)
• Remember-me cookies if you choose to stay logged in (up to 1 year)

Functional Cookies:

• Language and preference cookies (up to 1 year)
• Timezone setting cookies (up to 1 year)

Analytics Cookies (with consent):

• Usage analytics cookies to understand how the platform is used (up to 1 year)
• Error tracking cookies to identify and fix technical issues (session duration)

10.3 Third-Party Cookies

We use third-party services for analytics, error monitoring, and payment processing that may set cookies:

• Product analytics services
• Error monitoring services
• Payment processing services (when using payment features)

10.4 Cookie Control

Browser Settings:

• Most browsers allow you to refuse cookies
• You can delete existing cookies through browser settings
• Disabling essential cookies will prevent you from using TallySpark

Do Not Track (DNT):

• We respect DNT browser signals for analytics cookies
• Essential cookies remain active (required for functionality)

Opt-Out:

• Analytics cookies: Can be disabled in account settings or via browser settings
• Error tracking: Essential for error reporting (cannot opt-out)

10.5 Cookie Policy

For detailed information, see our Cookie Policy.

11. Email Tracking and Communication

11.1 Transactional Emails

We send transactional emails for:

• Account verification
• Password resets
• Invoice notifications to your clients
• Payment confirmations
• Quote approvals
• Overdue invoice reminders

Email Provider: Third-party email service (see Section 5.1)

Cannot Unsubscribe: These are essential service communications

11.2 Email Tracking (Optional)

Email tracking (such as open and click tracking) requires your organization's explicit consent. We do not track emails without your opt-in permission. You can manage email tracking preferences in your organization settings.

When Enabled:

• Track when emails are opened (via tracking pixel)
• Track when links are clicked (via link tracking)
• Purpose: Understand when clients view invoices/quotes

When Disabled:

• No tracking pixels inserted
• No link tracking
• Emails sent as plain transactional messages

11.3 Marketing Emails (Optional)

With Your Consent:

• Product updates and feature announcements
• Tips and best practices
• Educational content and webinars

Opt-In Required: Marketing emails require explicit consent

Opt-Out: Unsubscribe link in every marketing email

Frequency: Maximum 2 emails per month

12. Multi-Organization Data Isolation

12.1 How Organizations Work

TallySpark provides organization-based data separation:

• Your organization's data is kept separate from other organizations
• Users may have access to multiple organizations if invited
• Organization data is not shared with other TallySpark customers

12.2 Organization-Level Data

Isolated Data:

• Invoices, quotes, and expenses
• Clients and contacts
• Products and services
• Email templates and branding
• Payment settings

Shared Data (Across Organizations):

• Your user account (name, email, password)
• Your organization memberships

12.3 Data Access Control

Organization Owner:

• Full control over organization data
• Can invite and remove members
• Can delete organization (triggers 30-day deletion process)

Organization Members:

• Access only to organizations they're invited to
• Cannot access data from other organizations
• Permissions controlled by organization owner

13. Automated Decision-Making and Profiling

No Legal Effect Decisions:

TallySpark does NOT use automated decision-making or profiling that produces legal effects or significantly affects you (GDPR Article 22).

AI-Assisted Features (Not Automated Decisions):

• AI document processing: Extracts data from receipts (you review and approve)
• Client matching: Suggests client matches (you confirm or reject)
• Expense categorization: Suggests categories (you can override)

Human Review Required:

All AI-generated outputs require your review and approval before taking effect.

14. Children's Privacy

Age Restriction:

TallySpark is NOT intended for individuals under 18 years of age.

No Knowing Collection:

We do not knowingly collect personal information from children under 18.

If We Learn of Child Data:

• We will delete it immediately
• Parents/guardians can contact us at [email protected]

Age Verification:

By using TallySpark, you confirm you are at least 18 years old.

15. Third-Party Websites and Services

External Links:

TallySpark may contain links to third-party websites (e.g., Stripe dashboard, Mollie portal).

Not Our Responsibility:

We are not responsible for the privacy practices of third-party websites.

Separate Privacy Policies:

Each third party has its own privacy policy. We encourage you to read them.

OAuth Providers:

If you use Google or GitHub sign-in, review their privacy policies:

• Google: https://policies.google.com/privacy
• GitHub: https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement

16. Changes to This Privacy Policy

16.1 How We Notify You

Material Changes:

• 30 days advance notice via email
• In-app notification
• Updated "Last Updated" date at top of policy

Non-Material Changes:

• Posted on website
• Updated "Last Updated" date
• No additional notice

16.2 Your Rights on Changes

Continued Use = Acceptance:

Continued use after changes take effect constitutes acceptance.

Disagree with Changes?

You may delete your account before changes take effect.

Review Recommended:

We encourage you to review this policy periodically.

17. Data Processing Agreement (DPA)

17.1 B2B Customers

If you use TallySpark for business purposes and need a Data Processing Agreement:

Request DPA:

Email: [email protected]
Subject: "DPA Request - [Company Name]"

DPA Includes:

• Detailed data processing terms
• Complete sub-processor list with contact details and locations
• Security measures
• Audit rights
• Standard Contractual Clauses (for EU-US transfers)

Sub-processor List: We maintain a current list of third-party service providers (sub-processors) who process data on our behalf. This list includes:

• AI service providers
• Payment processors
• Email delivery services
• Analytics providers

To request the current sub-processor list, contact [email protected].

17.2 Your Role as Data Controller

For Business Content:

When you upload client data, expense receipts, or contact information, YOU are the Data Controller and TallySpark is the Data Processor.

Your Responsibilities:

• Ensure you have legal basis to process client data (GDPR Article 6)
• Provide privacy notice to your clients/contacts
• Respond to data subject requests from your clients
• Ensure compliance with GDPR/CCPA for your business operations

Our Role:

• Process data only on your instructions
• Implement appropriate security measures
• Assist with data subject requests (to the extent possible)
• Notify you of any data breaches affecting your business data

18. California "Shine the Light" Law

California Residents:

California Civil Code Section 1798.83 allows California residents to request information about disclosure of personal information to third parties for direct marketing.

Our Practice:

We do NOT share personal information with third parties for their direct marketing purposes.

No Request Necessary:

Since we don't share data for marketing, no request process is needed.

19. Contact Information

19.1 Privacy Inquiries

General Privacy Questions:

Email: [email protected]

GDPR Data Subject Requests:

Email: [email protected]
Subject: "GDPR Request - [Access/Deletion/Portability]"

CCPA Consumer Requests:

Email: [email protected]
Subject: "CCPA Request - [Access/Deletion]"

Data Breach Reports:

Email: [email protected]

19.2 Company Information

Pixelheads B.V.
De Nieuwe Erven 3
5431 NV Cuijk
The Netherlands

Chamber of Commerce (KvK): 69959447
VAT Number: NL 8580.81.301.B01

Website: https://tallyspark.com
Support: [email protected]
Legal: [email protected]

19.3 Data Protection Authority

Netherlands DPA:

Autoriteit Persoonsgegevens
Postbus 93374
2509 AJ Den Haag
The Netherlands
Website: https://autoriteitpersoonsgegevens.nl

EU Residents:

You can also contact your local Data Protection Authority. Find yours at: https://edpb.europa.eu/about-edpb/board/members_en

20. Additional Information

20.1 Data Minimization

We collect only the personal information necessary to provide the Service (GDPR Article 5(1)(c)).

We Do NOT Collect:

• Sensitive personal data (health, religion, political opinions) unless you voluntarily include it in business content
• Biometric data
• Genetic data
• Criminal records

20.2 Accuracy

We take reasonable steps to ensure personal data is accurate and up-to-date (GDPR Article 5(1)(d)).

Your Responsibility:

Keep your account information current via Account Settings.

20.3 Storage Limitation

We retain personal data only as long as necessary (GDPR Article 5(1)(e)).

See Section 7 (Data Retention) for specific retention periods.

20.4 Integrity and Confidentiality

We implement appropriate security measures (GDPR Article 5(1)(f)).

See Section 8 (Data Security) for details.

Acceptance of Privacy Policy

By creating an account, accessing, or using TallySpark, you acknowledge that you have read, understood, and agree to this Privacy Policy.