Privacy Policy · Tallylark

This Privacy Policy explains how Tallylark ("Tallylark", "we", "our" or "us") collects, uses and protects information when you use our invoice reminder and collections service for independent consultants and service businesses (the "Service"), including our marketing website at tallylark.com and our web application at app.tallylark.com.

1. Information we collect

We collect the following categories of information:

Account information. When you create an account we collect your name and email address. If you sign in via Google SSO, we receive your name, email and Google account identifier from Google. If you sign up with email/password, your password is stored in hashed form by our authentication provider (Supabase).
Client and invoice data. Any information you enter into Tallylark about your clients (name, email, company, notes) and invoices (invoice numbers, amounts, due dates, notes, payment status) is stored on your behalf so we can send reminders and display your dashboard.
Payment information. Payments for your Tallylark subscription and any invoice payments made by your clients through our pay-now links are processed by Stripe. We do not store or process card numbers or full payment credentials ourselves; we only retain non-sensitive identifiers Stripe returns to us (customer ID, subscription status, payment link IDs).
Communications. Emails you send us and reminder emails we send on your behalf are processed and briefly stored by our email provider (Resend) for delivery and troubleshooting.
Usage data. Standard server logs including IP address, browser type, timestamps and the pages you visit, retained for security and diagnostic purposes.

2. How we use your information

To provide the Service, including generating and sending reminder emails, producing your dashboard, and processing subscription payments.
To authenticate you and secure your account.
To communicate with you about product updates, security notices, and support requests.
To detect, prevent and investigate fraud, abuse, or violations of our Terms of Service.
To comply with legal obligations.

We do not sell your personal information. We do not use your client or invoice data to train machine-learning models.

3. Third-party processors

We rely on a small set of trusted service providers to run Tallylark. Each is bound by their own privacy policy and data-processing terms:

Supabase: database and authentication hosting (data stored in the EU / other regions as configured).
Stripe: payment processing for subscriptions and invoice pay-now links.
Resend: transactional email delivery, including waitlist confirmations and reminder emails sent on your behalf.

4. Data retention

We keep your account and business data for as long as your account is active. If you delete your account, we remove your personal data and business content within 30 days, except where retention is required for legal, accounting, tax or fraud-prevention purposes. Server logs are typically retained for up to 90 days.

5. Your rights

Depending on where you live (including under UK GDPR and EU GDPR), you may have the right to:

Access the personal data we hold about you.
Correct inaccurate or incomplete data.
Request deletion of your data ("right to be forgotten").
Export a copy of your data in a portable format.
Object to, or restrict, certain processing.
Withdraw consent where processing is based on consent.

To exercise any of these rights, email us at hello@tallylark.com. We will respond within 30 days.

6. Cookies and similar technologies

We use a small number of cookies and browser-storage entries strictly necessary to run the Service, for example, to keep you signed in and to remember your preferences. We do not use cross-site advertising trackers. If we add analytics in the future, we will update this policy and give you a way to opt out.

7. International transfers

Tallylark and its processors may store or process data in the EU, UK and United States. Where data is transferred outside your country of residence, we rely on approved transfer mechanisms (such as Standard Contractual Clauses) offered by our processors.

8. Security

We use industry-standard measures to protect your data, including TLS in transit, hashed passwords, database-level access controls and Row Level Security. No system is perfectly secure. Please use a strong, unique password for your account.

9. Children

Tallylark is a business tool intended for use by adults. We do not knowingly collect data from children under 16. If you believe we have inadvertently collected such data, please contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes we will notify you by email or through the Service before the changes take effect. The "Last updated" date at the top of this page reflects the current version.

11. Contact us

Questions or requests? Email hello@tallylark.com.