Privacy Policy

1. Who we are

Tallied (Pty) Ltd ("we", "us", "our") is the data controller for personal information processed through this platform. We are incorporated in South Africa and our platform is available at tallied.work. Questions about this policy can be directed to support@tallied.work.

2. What data we collect

We collect only the data necessary to provide the service:

• Account data: name, email address and role within your scheme, provided at registration or invitation.
• Board and scheme data: votes, motions, uploaded financial documents, announcements and related content that you and your board members create within the platform.
• Usage data: IP address, device type, browser type, access timestamps and feature usage, collected for security and product improvement purposes.
• Billing data: your administrator's email address for invoice delivery. We do not collect or store payment card details.

We do not collect sensitive personal information (as defined under POPIA or equivalent legislation) and you should not upload such information to the platform.

3. How we use your data

We use your data to:

• Provide, operate and improve the Tallied platform.
• Authenticate your identity and maintain account security.
• Send transactional emails such as vote notifications, announcements, invitations and invoices.
• Maintain platform security and detect fraudulent or unauthorised activity.
• Generate anonymised, aggregated analytics to improve our services.
• Comply with legal obligations under applicable law.

We do not sell, rent or share your personal information with third parties for marketing or advertising purposes.

4. AI document processing

Financial management packs and other documents you upload are stored securely and used only to provide the service to your scheme. We do not sell your uploaded documents or use them to train AI models. To deliver the AI document analysis feature, text extracted from your uploaded documents is transmitted to our AI subprocessor (OpenRouter) for processing. This processing occurs within the scope of the services you have subscribed to. You will be asked to acknowledge an AI disclaimer before accessing AI-generated reports for the first time.

5. Data storage and security

Your data is stored on cloud infrastructure provided by our subprocessors, which includes servers in the European Union and other jurisdictions outside South Africa. We apply encryption in transit (TLS 1.2 or higher) and at rest. Access to personal data is restricted to authorised Tallied personnel on a need-to-know basis. We conduct regular security reviews and apply industry-standard organisational measures to protect your data. No system is completely secure and you use the platform at your own risk.

6. Subprocessors and international data transfers

To operate the platform we rely on the following subprocessors, who may process your data in jurisdictions outside South Africa:

• Supabase — database and authentication hosting (AWS EU Frankfurt, Germany).
• Cloudflare R2 — file storage for uploaded and generated documents.
• OpenRouter — AI model routing for document analysis.
• Resend — transactional email delivery (verification, invitations, invoices, notifications).

Where personal data is transferred outside South Africa, we take reasonable contractual and technical steps to ensure adequate protection consistent with POPIA's requirements for cross-border transfers.

7. Cookies

The platform uses essential cookies for authentication and session management only. We do not use advertising, tracking or analytics cookies. No cookie consent banner is shown because we use only strictly necessary cookies.

8. Your privacy rights

Depending on where you are located, you may have the right to access, correct, restrict or request deletion of your personal information, receive a copy of your data in a portable format, withdraw consent where processing is based on consent, or lodge a complaint with your local data protection authority.

• South Africa: you are protected under the Protection of Personal Information Act (POPIA). You may lodge a complaint with the Information Regulator at inforeg.org.za.
• European Economic Area / United Kingdom: you may have additional rights under the GDPR or UK GDPR, including the right to object to processing and the right to erasure.
• Other jurisdictions: you may have rights under applicable local privacy law. We will honour reasonable requests regardless of your location.

To exercise any of these rights, contact us at support@tallied.work. We will respond within 30 days.

9. Data retention

We retain your personal information for as long as your account is active. After account cancellation, your data is retained for 90 days, during which you may contact us to arrange a data export. After 90 days, your data is permanently deleted from our systems. Financial and scheme records may be retained for longer where required by applicable law.

10. Changes to this policy

We may update this policy from time to time. Significant changes will be communicated to account administrators by email before they take effect. Continued use of the platform after notice constitutes acceptance of the updated policy. The current version is always available at this page.

11. Contact

For any privacy-related queries, email us at support@tallied.work. Tallied (Pty) Ltd, South Africa.