Privacy Policy

Tallybay is billing software for pallet warehouses. It is provided by Andrii Vynarchuk (“Tallybay”, “we”, “us”). You can reach us at:

This policy covers the Tallybay website and the Tallybay application. Tallybay is a service for businesses: the people who use it do so for their warehouse, not as consumers. We apply the EU General Data Protection Regulation (GDPR) to everything described here.

We handle two different kinds of information, and our role is different for each.

Your account information: we are the controller

We decide how the details of the people who sign in to Tallybay are used: names, email addresses, passwords and sign-in records. The same goes for what you send us when you write to us, and for our own records of who pays us. This policy explains what we do with them.

Your warehouse's business data: we are the processor

The information a warehouse puts into Tallybay about its own clients and operations (client names and billing contacts, rates, pallet movements, services and invoices) belongs to that warehouse, which is its controller. We store and process it only to provide Tallybay to the warehouse and on its instructions, under the processing terms in section 5 of the Terms of Service. Under US state privacy laws we are its “service provider”. We do not sell it, share it for advertising, or use it for any other purpose.

If you are a client or a team member of a warehouse that uses Tallybay and have a question about your information, ask the warehouse first. If you ask us, we pass the request to the warehouse and help it answer.

When a warehouse signs up

We ask for the warehouse's name, country and time zone, and the name, email address and a password for the person creating the account. We use these to create the account, sign you in, write amounts and dates the way your country does, and count billing days in your warehouse's time zone. The free trial does not ask for any payment details.

An owner can add a warehouse address, phone number, billing email, tax registration number, invoice language and a logo image in Settings. At signup we record which version of the Terms of Service was accepted and when.

Team members

Owners and admins add staff and admins by entering their name, email address and role. Tallybay then shows a one-time temporary password, which the member must replace at their first sign-in. We do not send invitation emails.

Your warehouse's business data

What your team enters, imports or generates, which can include:

• client records: names, codes, billing email addresses, billing addresses, payment terms, how tax applies to them and their tax number, the language their invoices are written in, and notes;
• rate cards and the services you charge for;
• pallet movements and service entries, with their dates, quantities, references such as PO or bill of lading numbers, optional pallet tags and notes;
• the names of imported files and how many rows they held;
• invoices and their lines.

Each entry records which team member recorded it, and who voided or issued it. An audit log records every change that affects billing: who made it, when, and the values before and after. Those values can include client billing details, warehouse contact details, and a team member's name and email address. Only owners and admins can read the audit log.

Sign-in and security information

• Passwords are never stored as you typed them; we keep only a scrypt hash. A password-reset link lasts one hour, and using it signs out every existing session.
• Each signed-in session is stored with the IP address and the browser's user-agent string it came from.
• We use IP addresses and email addresses to limit repeated sign-in, signup, password-reset and contact-form attempts. Those counters are held only in the server's memory and are not written to the database.

We do not log ordinary page requests. When something goes wrong, our server logs record the error with the request method and path, without IP addresses, and with passwords, tokens and cookies removed. Our hosting provider handles network traffic to the service and may keep its own logs.

Error reports

When the server hits an error, it sends a report to our error-monitoring service (see section 6) so we can fix it. A report contains the error message and technical trace, the request method and address (including any query string), and the browser's user-agent, referring page, language and content type. It is never given your cookies, sign-in headers, IP address or user account, though an error message can occasionally include a fragment of the data that caused it. Nothing runs in your browser for this.

Emails

The only email the Tallybay application sends to you is a password-reset link, to the address of the account that asked for it. When a warehouse passes a usage threshold, such as the number of clients its plan covers, the application also emails us, naming the warehouse and the count, so that we can get in touch. It does not email invoices to your clients.

When you write to us

If you write to us by email or through the contact form, we receive your name, email address and message, and use them to answer. If you send us invoices or records for a free billing check, we use them only for that check and delete them within 30 days of the call in which we go through the results, or sooner if you ask.

If we contact your business

We may write to warehouse businesses about Tallybay, using business contact details they publish. Every such message says how to stop them. If you ask us to stop, we do, and we keep a note of the request so that we do not contact you again.

Paying us

When you take a paid plan, we keep your business's billing details and our invoices to you, and record each payment and the plan it pays for.

Under the GDPR we need a legal ground for each use of personal information. Ours are:

• Our contract with your business: creating and running the account, signing you in, the password-reset email, and invoicing you for a plan.
• Our legitimate interests in keeping the service secure and working, and in running our business: the session records, the attempt limits, error reports, server logs and backups, the record of which Terms you accepted, the usage notice, answering your messages, free billing checks, and contacting warehouse businesses about Tallybay. You can object to any of these; see section 9.
• Legal obligations: keeping our invoices and payment records as tax and accounting law requires, and answering lawful requests from authorities.

For your warehouse's business data, the legal ground is the warehouse's, as its controller. We do not make decisions about anyone by automated means alone, and we do not build profiles.

We use two small cookies, both needed for the service to work. One keeps you signed in, for up to 14 days or until you sign out. The other lets our website show a link to your dashboard while you are signed in. We use no analytics, advertising or tracking cookies, so there is no cookie banner.

We use these companies to run Tallybay. Each receives only what it needs for its purpose. We do not sell personal information or share it with anyone for their own marketing.

Your data is stored in the United States

Tallybay's server, database and backups are in the United States, whichever country your warehouse is in. If you are in the European Economic Area or the United Kingdom, your information is transferred there. Every company in the list is certified under the EU-U.S. Data Privacy Framework and its UK Extension, which the European Commission and the UK recognise as giving adequate protection. Where a company's data processing terms also include the European Commission's Standard Contractual Clauses, they apply as well. Ask us and we will tell you which safeguard covers which company.

Before we add or replace a company that handles your warehouse's business data, we update this list and tell account owners by email. We may disclose information if the law requires it, and we would tell the affected warehouse unless we are legally not allowed to.

• Account and business data stays for as long as the warehouse's account exists. Nothing is deleted automatically when a trial ends.
• When an owner asks us to delete their warehouse, we delete within 30 days its business data, its audit log, and the accounts of team members who belong to no other warehouse, and confirm by email.
• If a trial has ended without a paid plan and nobody has signed in for 12 months, we may delete the account. We email the owner at least 30 days before we do.
• Backups are taken daily and each one is deleted after 35 days, so deleted data can remain in an encrypted backup for up to 35 days.
• When a team member is removed, their sessions end at once.
• Messages you send us are kept while we need them to deal with what you asked, and while your business is a customer. Files sent for a free billing check are deleted as section 3 says.
• Our invoices to you and the records of your payments are kept for as long as tax and accounting law requires.

• The service is only available over encrypted HTTPS connections.
• Each warehouse's data is kept separate: every query is limited to the signed-in warehouse.
• Access inside a warehouse depends on role. Staff can record activity but cannot see rates, invoices or the audit log, and only owners can export all data.
• Passwords are hashed, and repeated sign-in attempts are limited.
• Backups are encrypted before they are stored.

No system is perfectly secure. We do not hold security certifications such as SOC 2. If we learn of a breach that affects your information, we will tell the affected warehouses without undue delay.

You can ask us for a copy of your personal information, to correct it, to delete it, to restrict how we use it, to receive it in a portable form, or object to how we use it. Write to legal@tallybay.com. We answer within one month, as the law requires, and we will not treat you differently for asking. Much of it you can do yourself:

• See and take your data. An owner can download everything the warehouse has in Tallybay (clients, services, rates, activity, invoices, the audit log and the team list) as CSV files at any time.
• Correct it. You can edit client records, rates, entries and settings in the app. Issued invoices are not edited; they are voided and reissued, and the history is kept.
• Delete it. There is no delete button yet. Email us from the owner's address and we will delete the warehouse as section 7 says.

If you are a team member or a client of a warehouse, the warehouse controls your information in Tallybay; ask it first.

If you think we have handled your information wrongly, please tell us first. You can also complain to a data protection authority: ours is the Spanish Agencia Española de Protección de Datos (aepd.es), or you can go to the authority where you live or work.

Tallybay is a service for businesses. It is not directed at children, and we do not knowingly collect information from them.

When we change this policy we update the date and version at the top of this page. If a change is significant, we will email account owners at least 30 days before it takes effect, unless the law or a security problem needs it sooner. The Terms of Service explain how we handle changes to the service itself.

Questions about this policy or your information go to: