Privacy Policy

1. Who we are and what this policy covers

TALLISFY is an accounting, billing, GST and stock app for businesses in India. It is offered as:

• a web app, including the version you can install;
• an Android app;
• the website [www.tallisfy.com].

Together we call these the “Services”.

The Services are run by [Legal name of company / proprietor], [CIN / registration no., if any], [registered address] (“TALLISFY”, “we”, “us”). For your account details and for running the Services, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023.

This policy explains:

• what personal data we collect;
• why we collect it;
• where it is kept and for how long;
• who it is shared with;
• how it is protected;
• the rights you have and how to use them.

It applies to everyone who uses the Services: business owners, their staff, sales partners and visitors to our website. It forms part of our Terms of Use.

By creating an account and ticking “I agree”, you give the consent described in section 7. If you do not agree, please do not use the Services.

You can ask us for this policy in Hindi or in any other language listed in the Eighth Schedule to the Constitution of India by writing to the Grievance Officer.

2. Laws we follow

We handle personal data as required by Indian law, as each law applies and comes into force, including:

• the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025;
• the Information Technology Act, 2000, including sections 43A and 72A;
• the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), for as long as they apply;
• the CERT-In Directions of 28 April 2022 under section 70B of the IT Act, on keeping logs and reporting cyber incidents;
• tax and company law on keeping records, including the Central Goods and Services Tax Act, 2017 (sections 35 and 36), the Income-tax Act, and the Companies Act, 2013 (section 128).

If a law gives you more protection than this policy, the law applies.

3. Your data and your customers’ data

Two kinds of personal data pass through TALLISFY.

(a) Data about you. This means your account details, and the details of your staff and of sales partners. For this data, TALLISFY is the Data Fiduciary.

(b) Data inside your books. Your books can hold details of other people, such as the name, phone number, address, GSTIN and bank details of your customers and suppliers, and your staff’s salary records.

• You decide what to record in your books and why. So for this data, your business is the Data Fiduciary.
• TALLISFY processes it only on your behalf and on your instructions, to provide the Services to you. In law, we act as your Data Processor.
• We do not use it for any purpose of our own. We do not contact your customers or suppliers, and we do not sell or share their details.

As the Data Fiduciary for your books, you are responsible for:

• having a lawful reason to keep that data, such as issuing bills, keeping accounts or meeting GST law;
• giving notice to those people where the law requires it;
• answering their requests.

We will help you do this (see section 14).

4. Information we collect

4.1 Information you give us

Under the SPDI Rules, passwords and bank account or other payment details are “sensitive personal data”. We collect them only for the purposes above, with your consent, and protect them as described in section 12. We never store your password itself, only a one-way scrambled form of it (a hash).

4.2 Information collected automatically

• Device and sign-in details. We record:
  • which of your devices made each entry (a short device code such as A or B, which also appears in bill numbers);
  • the device name (for example “Chrome on Windows”);
  • sign-in and last-seen times.
  This means offline entries from two devices never clash, and you can see and sign out your devices.
• Activity log (audit trail). Important actions are logged so the business owner can check who changed what. Examples are creating, changing or cancelling an entry, sign-ins and failed sign-ins, and changes to staff and settings.
• IP address and request logs. These are used to protect sign-in and sign-up from misuse (for example, to limit repeated wrong passwords) and to investigate security incidents.
• Error details. If something fails, technical details of the error may be kept so we can fix it. They do not include the contents of your books.

4.3 Information we do not collect

We do not collect:

• Aadhaar numbers;
• biometric data;
• your phone’s contact list;
• your location;
• SMS or call logs;
• the list of apps installed on your phone;
• advertising IDs;
• your card numbers or UPI PIN.

If we later accept payments through an online payment gateway, the gateway will collect your card or UPI details directly on its own page, under its own licence and policy. We will update this policy before that starts.

5. Device features and permissions

TALLISFY asks for a device permission only when you use the feature that needs it, and tells you why at that moment.

You can turn any permission off in your phone or browser settings at any time. Only the feature that needs it will stop working.

6. Why we use it (purposes and legal basis)

We use personal data only for these purposes:

1. Providing the Services. Keeping your books, syncing them across your devices, and making bills, reports and GST figures. Basis: your consent.
2. Account and security. Signing you in, preventing misuse and fraud, and investigating incidents. Basis: your consent, and our legal duty to keep reasonable security.
3. Service messages. Sign-in and password codes, plan reminders, and notice of important changes or incidents. Basis: your consent and legal duties.
4. Plans, coupons and partner commissions. Checking payments, issuing our invoices and paying partners. Basis: your consent, and tax law for our invoices.
5. Support. Answering your questions and requests. Basis: you asked us to.
6. Fixing and improving the Services. We use error details and counts, not the contents of your books. Basis: your consent.
7. Following the law. Keeping tax records and answering lawful orders. Basis: legal obligation, as allowed by section 7 of the DPDP Act.

We do not sell personal data. We do not use your books for advertising. We do not build profiles of you or your customers, and we do not make automated decisions about you that have legal effects.

We collect only what these purposes need. If we want to use data for a new purpose, we will tell you first and, where needed, ask for your consent.

7. Consent and how to withdraw it

When you sign up, you read this notice and tick “I agree”. That is your consent to the purposes in section 6. We keep a record of when you gave it.

You may withdraw consent at any time, as easily as you gave it:

• by deleting your account in the app; or
• by writing to the Grievance Officer.

Withdrawing consent does not make what was done before it unlawful. Because we cannot keep your books without it, withdrawing consent ends the Services for you. We then stop processing your data and delete it as described in section 11, except for records the law requires us to keep.

When Consent Managers registered with the Data Protection Board of India become available, you may also give, manage and withdraw consent through one of them.

8. Who we share it with

We share personal data only as listed here, and only as much as each purpose needs.

Every service provider that processes data for us does so under a written contract. Each one must use the data only to do its work for us, keep it confidential, and protect it at least as well as this policy requires.

Before we add a new kind of service provider that receives your personal data, we will update this policy. One example is a GST Suvidha Provider for GSTIN look-up or e-invoice filing.

9. Where your data is stored

• On your devices. Your books are kept in the app’s storage on each phone or computer where you sign in, so the app works without internet.
• On our server, located in [India / name the country and city].

Some service providers named in section 8, and the speech service your browser uses for voice entry, may process data outside India. Under section 16 of the DPDP Act, we transfer personal data outside India only where the Central Government has not restricted transfers to that country, and only with the safeguards in this policy.

10. Cookies and storage on your device

TALLISFY does not use advertising or tracking cookies, and has no third-party analytics.

To work offline, the app keeps data in your browser’s or phone’s own storage:

• your sign-in;
• your choices, such as language and dark mode;
• the offline copy of your books.

This storage is strictly needed for the app to work, so it cannot be switched off inside the app.

Clearing your browser data, or uninstalling the app, removes this copy from that device. Entries that had not yet synced are lost. The server copy is not affected.

11. How long we keep it

Your own legal duty: GST law requires every registered business to keep its accounts for at least 72 months (six years) from the due date of the annual return for that year. Income-tax and company law may require longer. That duty is yours. Before you delete your account or a business, download a full backup or Excel copy from Settings → Backup. Once deleted, we cannot bring the books back.

12. How we protect it

We follow reasonable security practices as required by section 43A of the IT Act, the SPDI Rules and the DPDP Rules. We do this through a written information security programme that includes:

• Encryption in transit. Everything between the app and our server travels over HTTPS (TLS).
• Passwords. They are stored only as a strong one-way hash (scrypt). Nobody at TALLISFY can see your password.
• Sign-in protection. We use email codes, limits on repeated attempts, a temporary lock after too many wrong passwords, and sessions you can sign out from every device.
• Locking the app on your device with a PIN, fingerprint or face.
• Access control. Each business’s data is kept separate on the server. Staff see only what their role allows. Within TALLISFY, only a few people can reach the servers, and only to keep the Services running, to fix a problem you report, or when the law requires.
• Logs and monitoring. An activity log for every business, and server logs to detect and investigate misuse.
• Backups and checks. Regular backups so data can be restored, and regular security reviews of our code.
• Confidentiality. Our staff and service providers are bound by confidentiality.

No system is perfectly secure. You can help by:

• keeping your password and devices safe;
• giving staff only the access they need;
• locking the app;
• keeping your own backups.

13. If something goes wrong (data breach)

If a personal data breach happens, we will act at once to contain it.

We will tell each affected person without delay, in plain words, by email and in the app. The notice will say:

• what happened, when, and what data was involved;
• the likely effects;
• what we are doing about it;
• what you can do to protect yourself;
• whom to contact.

We will also report it to the authorities:

• to the Data Protection Board of India, first without delay and then with a full report within 72 hours (or a longer time the Board allows);
• to CERT-In within 6 hours of noticing a reportable cyber incident.

14. Your rights

Under the DPDP Act you have the right to:

• Access. Get a summary of the personal data we hold about you, what we do with it, and who we have shared it with. You can also download all your books at any time from Settings → Backup and Excel.
• Correction, completion and updating. Most details can be changed in Settings. For anything else, write to us.
• Erasure. Delete your account in the app (see section 15), or ask us to delete specific data. We erase it unless the law requires us to keep it.
• Withdraw consent (see section 7).
• Nominate a person who can use these rights for you if you die or become unable to act. Write to us with the nominee’s name and contact details.
• Grievance redressal. Complain to our Grievance Officer. If you are not satisfied with the answer, you may complain to the Data Protection Board of India.

How to make a request

1. Write to [privacy@tallisfy.com] from your registered email, or use the in-app options mentioned above.
2. We may ask you to confirm who you are before acting, so that no one else can use your rights.
3. We will acknowledge your request within 48 hours. We will complete it within one month, and in any case within the time the law allows (at most 90 days).

There is no charge for these requests.

Requests from your customers, suppliers or staff

If a person whose details are in your books asks to see, correct or delete them, you handle the request, because you are the Data Fiduciary for that data (see section 3). You can edit or remove their details in the app. If such a request reaches us, we will pass it to you and help you answer it.

15. Deleting your account

In the app: open Settings → Delete account. Then type your password and the word DELETE to confirm.

If you cannot open the app: email [privacy@tallisfy.com] from your registered email address with the subject “Delete my account”. We will confirm it is you and complete the deletion within [7] days.

What is deleted

• Your name, email, mobile number and password. The email and mobile can be used to sign up again.
• All books of every business you own alone: parties, items, bills, payments, stock, staff records and reports, on our server and on the device you delete from.
• Your staff’s access to those businesses, and your place as staff in anyone else’s business.
• All your sign-ins on every device.

What is kept, and why

• Our own invoices and payment records for your TALLISFY plan (business name, GSTIN, plan, amounts, payment reference), and any partner commission records linked to them, because tax law requires us to keep them (see section 11).
• Security logs for the period in section 11. In them you appear only as an account number, not by name or email.

Other phones or computers where you were signed in keep their offline copy until you clear the app’s data there or uninstall the app.

Download a backup first. GST law asks you to keep your accounts for six years, and deleted books cannot be brought back.

16. Your duties

Section 15 of the DPDP Act says that when you use the Services or your rights, you must:

• give true and correct information;
• not pretend to be someone else;
• not hide important facts when giving your details;
• not make false or frivolous complaints.

You must also have a lawful reason for the personal data you put in your books, and must not upload data you are not allowed to keep.

17. Children and people who need a guardian

The Services are meant for businesses, and for people aged 18 or above. We do not knowingly collect personal data of anyone under 18, and we do not track, profile or show targeted advertising to children.

A person with a disability who has a lawful guardian may use the Services only with that guardian’s verifiable consent.

If you believe a child has created an account, write to us. We will delete it.

18. Emails and messages

We send service messages that you need in order to use the Services, such as:

• sign-in and password codes;
• plan reminders;
• security alerts;
• notice of changes to this policy.

These cannot be switched off while you have an account.

We send news or offers only if you have agreed to receive them. Every such email has a way to stop them.

If we ever send SMS or WhatsApp promotions, we will follow the telecom regulator’s (TRAI’s) rules on commercial messages and your Do-Not-Disturb choices.

19. Other websites and services

The Services may open other services when you choose to. Examples are WhatsApp, your email app, the GST portal, your bank’s website or a payment app.

Those services have their own privacy policies. We are not responsible for how they handle your data, so please read their policies.

20. Grievance Officer and contact

For any question, request or complaint about privacy or this policy, contact our Grievance Officer. They are also the person who answers questions about how we process personal data.

Grievance Officer: [Name, designation]
Email: [privacy@tallisfy.com]
Phone: [+91 XXXXX XXXXX] ([Monday to Saturday, 10 am to 6 pm IST])
Address: [Full postal address]

We will acknowledge your complaint within 48 hours. We will resolve it within one month, as the Consumer Protection (E-Commerce) Rules, 2020 and the SPDI Rules require, and in any case within the time the DPDP Rules allow. Other ways to reach us, and other places you can complain, are on the Contact & Grievance page.

If you are not satisfied, you may complain to the Data Protection Board of India once you have used this process.

21. Changes to this policy

We may update this policy when the Services or the law change. The “Last updated” date at the top always shows the current version.

If a change is important, we will tell you in the app or by email before it takes effect. This includes any new purpose, any new kind of sharing, or any change to your rights. Where the law requires it, we will ask for your consent again.

Earlier versions are available on request.

22. Governing law

This policy is governed by the laws of India.

This does not affect your right to complain to the Data Protection Board of India or any other authority. Subject to that, the courts at [City, State] have jurisdiction.