Privacy Policy
This Privacy Policy explains how Tallylark ("Tallylark", "we", "our" or "us") collects, uses and protects information when you use our invoice reminder service for independent consultants and service businesses (the "Service"). That includes our marketing website at tallylark.com and our web application at app.tallylark.com.
1. Who we are
Tallylark is a software service operated by Tarik Bensaria (founder). For UK GDPR and similar privacy laws, Tallylark is the controller of personal data described in this policy, unless we say otherwise.
Questions or requests: hello@tallylark.com.
2. Information we collect
We collect the following categories of information.
Account information
When you create an account we collect your name and email address. If you sign in with Google, we receive your name, email and Google account identifier from Google. If you sign up with email and password, your password is stored in hashed form by our authentication provider (Supabase).
Client and invoice data
Information you enter about your clients (for example name, email, company, notes) and invoices (for example invoice numbers, amounts, due dates, notes, payment status) is stored so we can send reminders and show your dashboard.
Invoice uploads (photos and PDFs)
You can photograph an invoice or upload a PDF or image. We store the file you upload and extract invoice fields (such as amounts, dates, client details and invoice numbers) so the form can be filled for you. See section 3 (AI processing).
Payment information
Payments for your Tallylark subscription, and payments your clients make through our Stripe pay-now / payment links (including where Stripe Connect is used to route client payments), are processed by Stripe. We do not store card numbers or full payment credentials ourselves. We retain non-sensitive identifiers Stripe returns to us (for example customer ID, subscription status, payment link IDs and related payment status).
Tallylark is not a payment marketplace. Stripe handles payment processing under Stripe's terms and privacy policy.
Communications
Emails you send us, and reminder or transactional emails we send on your behalf or to you, are processed and briefly stored by our email provider (Resend) for delivery and troubleshooting.
Marketing and outreach contacts
If you are a business contact we reach out to (for example about a consultative campaign in the US or UK), we may process your name, email, company and related professional details through our outbound email tools (including Instantly) so we can send and track those messages. You can opt out by replying or emailing hello@tallylark.com.
Usage data and logs
We keep standard server logs and similar technical data (for example IP address, browser type, timestamps and pages or screens visited) for security, diagnostics and product improvement.
Cookies, pixels and similar technologies
On our marketing site and app we use cookies and similar technologies for essential operation, consent management, analytics and advertising measurement. Details are in section 6.
3. AI processing of invoice uploads
When you upload an invoice photo or PDF (or similar image), we use automated processing, including AI-assisted optical character recognition (OCR) and field extraction, to read the document and suggest or fill invoice fields in the Service.
- We use this only to help you set up and manage invoices in Tallylark.
- We do not sell your uploads.
- We do not use your client or invoice data, including uploads, to train public or general-purpose machine-learning models.
- Uploaded files and extracted fields are stored as part of your account data and are subject to the retention and deletion rules in section 5.
If you do not want a file processed this way, do not upload it. You can enter invoice details manually instead.
4. How we use your information
- To provide the Service, including OCR/field fill for uploads, reminders, your dashboard, and subscription or pay-now payment flows via Stripe.
- To authenticate you and secure your account.
- To communicate with you about product updates, security notices and support.
- To measure and improve our marketing site and ads (with consent where required).
- To run business outreach to prospective customers where we have a lawful basis (and to honour opt-outs).
- To detect, prevent and investigate fraud, abuse or violations of our Terms of Service.
- To comply with legal obligations.
We do not sell your personal information.
5. Data retention and deletion
- We keep your account and business data (including client records, invoice records and invoice uploads) for as long as your account is active.
- If you delete your account, we remove your personal data, business content and invoice uploads within 30 days, except where we must keep something for legal, accounting, tax or fraud-prevention reasons.
- Server logs are typically retained for up to 90 days.
- Email delivery logs held by Resend are kept only as needed for delivery and troubleshooting.
- Marketing/outreach contact records are kept until you opt out or we no longer need them for that purpose, subject to legal retention needs.
To request deletion without using in-product account delete, email hello@tallylark.com.
6. Cookies, consent and tracking
We use CookieHub to show a consent banner and to record your choices (especially for visitors in the UK and EEA).
Consent before non-essential tracking (UK/EEA): Non-essential analytics and advertising cookies or pixels are not enabled until you accept them through CookieHub (or an equivalent consent control). Essential cookies needed to run the site or keep you signed in may run without that choice.
Depending on your consent and location, we may use:
| Technology | Purpose |
|---|---|
| CookieHub | Consent management and storing your cookie preferences |
| Google Tag Manager (GTM) | Loading and managing tags on the marketing site and app |
| Google Analytics 4 (GA4) | Site and app analytics (page views, events) |
| Meta Pixel and Meta Conversions API (CAPI) | Measuring ads and conversions (browser pixel and server-side events) |
You can change or withdraw cookie consent through CookieHub controls on the site, and via your browser settings. Withdrawing consent does not affect the lawfulness of processing before withdrawal.
7. Third-party processors
We rely on service providers to run Tallylark. Each is bound by their own privacy policy and, where applicable, data-processing terms:
| Processor | Role |
|---|---|
| Supabase | Database and authentication hosting |
| Stripe | Subscription billing and client pay-now / payment links (including Stripe Connect where used). Not a Tallylark marketplace. |
| Resend | Transactional and reminder email delivery |
| CookieHub | Cookie consent management |
| Google (GTM and GA4) | Tag management and analytics |
| Meta (Pixel and CAPI) | Advertising measurement and conversion events |
| Instantly | Cold / outbound email outreach to prospects (US and UK consultative campaigns), where we process prospect contact details |
Some tools load through Google Tag Manager after consent. Processors may change as the product evolves; material additions will be reflected in an updated policy.
8. International transfers
Tallylark and its processors may store or process data in the UK, EU/EEA and United States (and other countries where those providers operate). Where personal data is transferred outside your country of residence, we rely on appropriate safeguards offered by our processors, such as Standard Contractual Clauses, where required.
9. Your rights
Depending on where you live (including under UK GDPR and EU GDPR, and similar US state privacy laws where they apply), you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Request deletion of your data.
- Export a copy of your data in a portable format.
- Object to, or restrict, certain processing.
- Withdraw consent where processing is based on consent.
- Opt out of marketing or outreach emails.
US readers: we do not sell personal information for money. Some analytics and advertising tools may involve "sharing" or targeted advertising as those terms are used in certain US state laws. You can use CookieHub and the contact email below to limit or opt out of those uses where applicable.
To exercise any of these rights, email hello@tallylark.com. We aim to respond within 30 days.
10. Security
We use industry-standard measures to protect your data, including TLS in transit, hashed passwords, database access controls and Row Level Security where configured. No system is perfectly secure. Please use a strong, unique password for your account.
11. Children
Tallylark is a business tool intended for adults. We do not knowingly collect data from children under 16. If you believe we have collected such data by mistake, contact us and we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes we will notify you by email or through the Service before the changes take effect where required. The "Last updated" date at the top of this page reflects the current version.
13. Contact us
Questions or requests? Email hello@tallylark.com.