Privacy Policy

1.What we collect

• Your account: your name, work email, job title and role, and your password (stored only in scrambled, hashed form by our sign-in provider; we can never see it).
• Your company's data: what your team uploads or enters: vendor invoices (PDFs and the details read from them), vendor contracts and rates, warranty documents, work orders, properties, equipment, vendor contacts, disputes and approvals.
• Technician check-ins: when a technician scans a property's QR code, the name and company they enter, the job, check-in and check-out times, their device's location at those moments if their browser allows it, and an optional completion photo.
• Activity: a log of changes made in Tally (who uploaded, approved, disputed or deleted what, and when), so your team has a record.
• Technical data: our hosting providers keep standard server logs (such as IP address, browser type and time of request) to run and secure the service.

2.How we use it

Only to provide Tally to your company: checking invoices against contracts, visit times and past prices; writing dispute letters and reports; signing you in; keeping the service secure; and helping when you contact us.

We do not sell personal information, we do not show ads, and we do not use your company's data to build products for anyone else.

3.AI processing

Tally uses Claude, made by Anthropic, to read invoice, contract and warranty PDFs and to answer questions asked of Penny, the in-app assistant. The document or question and the data needed to answer it are sent to Anthropic for that purpose only. Under Anthropic's commercial terms, data sent through its API is not used to train its models. The audit itself (which charges get flagged) follows fixed rules, not AI, so every flag can be explained.

4.Who we share it with

Only the service providers that run Tally, each limited to its job:

• Supabase: database, file storage and sign-in.
• Vercel: hosting the website.
• Anthropic: reading documents and answering Penny questions (see above).
• Resend: sending sign-in emails.

We would also share information if the law requires it, or with a buyer if Tally Audit LLC is sold, in which case this policy would continue to apply.

5.Your company's data stays separate

Every record belongs to one company. The database itself only lets signed-in members of that company see or change it, and each person's role (admin, manager or viewer) limits what they can do. Sign-in is by invitation only. Uploaded files are kept in private storage and opened through links that expire after an hour. All traffic is encrypted (HTTPS).

6.Cookies

Tally uses only the cookies it needs to work. No advertising or tracking cookies.

• Sign-in cookies, which keep you signed in.
• Which properties you picked in the side menu.
• Whether you hid the setup checklist.

7.How long we keep it, and deleting it

We keep your company's data while it uses Tally. Your team can delete invoices, work orders, vendors and properties at any time. To delete your whole account, or to ask what we hold about you, email legal@tallyaudit.dev. We will delete it within 30 days, except where the law requires us to keep something longer.

8.Children

Tally is a business tool and is not meant for anyone under 18.

9.Changes and contact

If we change this policy, we will update the date above and tell account admins about significant changes. Questions or requests: legal@tallyaudit.dev.