Privacy Policy — Tally by DECIML

1. Who we are

Tally ("the app") is provided by Muhasib Peer Limited (trading as DECIML), a company registered in England & Wales (company number 12005472), whose registered office is at 82 Armstrong Street, Gateshead, United Kingdom, NE8 4XS.

We are the data controller for the personal data described in this policy.

We are registered with the Information Commissioner's Office (ICO); our registration number is available on request.

If you have any questions about this policy or your data, contact us at info@deciml.co.uk.

2. Who this policy is for

This policy applies to:

• Accountants and firm users who use Tally to keep books for their clients.
• Client users who are invited by their accountant to access their business's records.
• Customers and suppliers of those businesses, whose details are recorded in the app for the purpose of issuing invoices, recording expenses, and managing payments. If your details appear in Tally because a business you deal with uses it, this policy explains how that data is handled; the business you deal with is responsible for the accuracy of that data, and we process it on their behalf.

3. What data we collect

Depending on how the app is used, we may process:

• Account data: email address, and authentication information needed to sign in.
• Business data: business name, address, logo, VAT registration details, financial year end.
• Financial records: sales invoices, purchase invoices/expenses, receipts and their images, line items, payments, categories, and imported bank statement transactions.
• Customer and supplier data: names, email addresses, and postal addresses of the businesses' customers and suppliers, as entered into the app.
• Documents and images: photographs or files of receipts and invoices uploaded to the app, and generated invoice PDFs.

We do not ask for or store your bank login credentials. Bank statement data enters the app only when a user manually uploads a statement file.

4. How we use your data, and our legal basis

We process personal data to:

• Provide the bookkeeping service (create, store and manage financial records) — legal basis: performance of a contract and our legitimate interests in providing the service.
• Authenticate users and secure accounts — legitimate interests and contract.
• Read receipt/invoice images to extract details (e.g. supplier, amounts, dates) — legitimate interests in providing an efficient service.
• Generate and send invoices and payment reminders by email on behalf of a business — legitimate interests of that business.
• Meet legal and regulatory obligations, including record-keeping — legal obligation.

5. Who we share data with (our processors)

We use trusted third-party service providers to run the app. They process data on our behalf, under contract, and only as needed to provide their service:

• Supabase — database, authentication and file storage hosting.
• Anthropic — processes uploaded receipt/invoice images to extract text and figures (optical character recognition). Images are sent to be read and are not used to train models.
• Resend — sends emails (such as invoices and payment reminders) to recipients on behalf of a business.

We do not sell your personal data. We do not share it with third parties for their own marketing.

6. Where your data is stored

Your data is stored on infrastructure provided by our processors. Our primary database and storage are hosted in the United Kingdom. Some processors (e.g. for OCR or email) may process limited data outside the UK; where they do, appropriate safeguards (such as standard contractual clauses) are in place.

7. How long we keep your data

We keep financial records for as long as needed to provide the service and to meet legal and professional record-keeping obligations, which for accounting records is generally six years. When data is no longer required, it is deleted or archived. An accountant can archive or permanently delete a business's records within the app.

8. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete your data (subject to our legal retention obligations);
• object to or restrict certain processing;
• request a copy of your data in a portable format;
• withdraw consent where processing is based on consent.

To exercise any of these, contact info@deciml.co.uk. If you are a customer or supplier of a business that uses Tally and want your details corrected or removed, you can also contact that business directly, as they control that data.

You have the right to complain to the ICO (ico.org.uk) if you are unhappy with how we handle your data.

9. Security

We take reasonable technical and organisational measures to protect your data, including encryption in transit and at rest, access controls that limit each user to only the data they are permitted to see, and authentication safeguards. No system is completely secure, but we work to protect your information.

10. Children

Tally is a business tool and is not intended for use by anyone under 18.

11. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the version number and date, and may ask you to review and accept the updated policy before continuing to use the app.

12. Contact

For any privacy questions or requests, contact us at info@deciml.co.uk.