Tallova

Privacy Policy

Last updated: 31 August 2026

This Privacy Policy explains how Tallova ("Tallova", "we", "us") collects, uses, stores, and protects information when you use the Tallova web application, mobile app, and Windows desktop app (together, the "Service"). By using the Service you agree to this policy.

Two kinds of information, and they are not the same. Most of what Tallova holds is information a business puts in about its own customers, suppliers and staff. For that information the business is the controller and Tallova is its processor: we handle it on their instructions, not for our own purposes. Section 4 sets out exactly what that covers, because some of those people never signed up for anything.

1. Who we are

Tallova is business operations and accounting software: invoicing, quotes, expenses, supplier bills, bank and payment tracking, payroll, inventory, projects, reports, connected online shops, document signing and related tools. Questions about this policy or your data: support@tallova.app.

2. Information you give us

Account information: your name, email address, business name, and password (stored only as a strong one-way hash, never in readable form). A phone number if you add one.
Business records you enter: invoices, quotes, expenses, supplier bills, journal entries, customers and suppliers, products and stock, projects and time, employees and payroll, and any notes you add.
Files you upload: receipt photographs, CSV imports, and documents you send for signature. Receipts and documents for signature are scanned for malware before they are stored.
Credentials for services you connect: the keys for your online shop, mail server, payment provider, messaging carrier or AI provider. These are encrypted before they are stored and are never shown back to you or to anyone at Tallova after you save them.
Support messages: anything you send us through in-app support.

3. Information collected automatically

Security and audit data: sign-in events, IP address, and the record of who changed what, kept so an account can be defended and an unusual action explained.
Device permissions you grant: the camera, to photograph a receipt you choose to scan, and file access, to upload a document or a CSV. Used only while you are using those features; never in the background.
Country, for pricing: a visitor's IP address is matched against a country database held on our own server so prices can be shown in local currency. That lookup does not leave our machine and no IP address is sent to a third party for it.
Cookies: see section 9.

4. Information about other people

Running a business means holding information about people who never signed up for Tallova. This is where that happens, and what we do with it. In every case the business using Tallova decides what is collected and why; we act on their instructions.

Your customers and suppliers

Names, email addresses, postal addresses, phone numbers and payment history, either typed in by the business or arriving from a service it has connected.

Orders from a connected shop

If a business connects Shopify, WooCommerce or Square, Tallova receives each order as the shop sends it (buyer name, email address, the items bought and the amounts) and keeps the original message alongside the invoice it produced, so a disputed figure can be traced to what actually arrived. A connected Stripe account sends payments rather than baskets: the amount, the currency, and the buyer's name and email address if the checkout collected them. No card number ever reaches Tallova.

People who sign a document

When a business sends a document for signature, Tallova stores the document, the signer's name and email address, and, if they sign, the name they typed, the date and time, the network (IP) address they signed from, the browser they used, and the exact wording they agreed to. That record exists so the signature can be shown to be genuine later; it is the point of the feature. A copy is emailed to the signer, so they hold the same record. Signing links expire, and a signer can decline instead.

Customers who answer a feedback request

After an invoice is settled, Tallova can email that customer once to ask how the work went. Their rating and any comment are stored and shown only to the business. A comment is treated as private unless the person ticks the box agreeing it may be quoted publicly, and that answer is recorded rather than assumed.

Messages with customers

If a business connects its mailbox, Tallova reads replies to the messages it sent, so a conversation stays in one place. If it connects a messaging carrier, Tallova stores texts, WhatsApp messages and call records exchanged with its customers, including phone numbers. A voice note may be transcribed through the configured AI provider to turn it into a record the business can act on.

5. How we use information

To provide and operate the Service and the features you use.
To bring in sales, payments and transactions from services you connect, and to turn them into records in your books.
To send messages on your behalf (invoices, quotes, reminders, signing requests and feedback requests) to the people you address them to.
To take payments your customers make against your invoices, and to record the fees.
To secure your account: authentication, two-factor authentication, malware scanning of uploads, and detection of abuse.
To provide support, and to maintain, troubleshoot and improve the Service.
To meet legal, accounting and tax obligations.

We do not sell personal information. We do not share it for cross-context behavioural advertising. There is no third-party advertising in the Service, and we do not use your business records to train AI models.

6. The AI assistant

The AI assistant is optional. When you use it, the figures relevant to your request are sent to the AI provider you or your platform administrator has configured, solely to produce an answer for you. It only ever operates on your own organization's data. If you supply your own provider key it is encrypted at rest and never displayed again. Nothing financial is posted to your books by the assistant: it produces proposals a person approves.

7. Checking your email domain

Tallova can check whether somebody could send email pretending to be your business. That check reads the public DNS records of the domain you send from, the same records anybody on the internet can read. It sends no data anywhere and is only ever run against the domain you have already configured.

8. Who we share information with

Only as needed to run the Service, and only with:

Services you connect: your online shop (Shopify, WooCommerce, Square), your own Stripe account, your mail server, your bank or payment aggregator. Tallova talks to these using the credentials you supplied, on your instruction.
Payment processors (Stripe, Paystack, Flutterwave) to take payments your customers make. Card and mobile-money details are entered on the processor's own secure page, never on Tallova's servers; we receive a confirmation and a non-sensitive reference.
Account aggregators (Mono, Plaid) to import transactions from accounts you connect. Access tokens are encrypted at rest. We never store your online banking password.
Messaging and email providers that deliver the Service's messages, and the carrier you connect for text, WhatsApp or voice.
AI providers you enable, as described above.
Infrastructure providers that host the Service.
Authorities, where required by law or to protect rights, safety and the integrity of the Service.

Each acts as our processor or as an independent controller under its own terms. We do not share your data with anyone else for their own marketing.

9. Cookies

Tallova sets only the cookies it needs to work. A sign-in cookie keeps you signed in and cannot be read by scripts in your browser; a second, readable cookie carries a token that protects you against a hostile site submitting actions as you. There are no advertising, analytics or tracking cookies, and no third party sets a cookie through the Service.

10. How we protect information

Traffic is encrypted in transit over HTTPS.
Passwords are stored only as strong one-way hashes (Argon2).
Credentials you save (shop keys, bank tokens, mail passwords, AI keys) are encrypted at rest and never shown again.
Uploaded receipts and documents sent for signature are scanned for malware before they are stored.
Two-factor authentication and account-lockout protections are available.
Each business's data is isolated from every other business's, and an owner can limit what individual colleagues are shown.
Messages arriving from a connected shop or payment provider are cryptographically verified before anything is recorded, so a forged message cannot create a sale.

No method of transmission or storage is completely secure, but we work to protect information using industry-standard measures.

11. Keeping and deleting information

We keep information for as long as an account is active, or as needed to provide the Service and meet legal, tax and accounting requirements.
Deleting a record in Tallova reverses its accounting entry rather than erasing it, so the books stay auditable. The record itself is removed.
Clearing a business ("Start again") removes every transaction and the records behind them immediately. There is no recovery window.
Closing a business ends the subscription and signs everyone out. Nothing is destroyed for 30 days, so the account can be reopened; after that it is permanently deleted.
Signed documents and their signing records are kept while the business's account is active, because a signature that cannot be produced later is not worth having. A business can withdraw an unsigned document at any time.
You can export a complete copy of your records from inside the Service at any time.

12. Your rights

Depending on where you live you may have the right to know what personal information we hold, to obtain a copy, to correct it, to delete it, to limit how it is used, and not to be discriminated against for exercising those rights. Residents of California and other US states with comparable laws have these rights; so do people in the UK, EU and other regions with equivalent protections. As stated above, we do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of on that score.

If your information is held by a business using Tallova, for example because you are their customer or you signed a document they sent, that business decides what happens to it, and your request is best made to them. Contact us and we will help route it.

To exercise any right, email support@tallova.app. We respond within a reasonable time, subject to records we are legally required to keep.

13. Children

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.

14. International use

The Service may be operated from, and information processed in, countries other than your own. Where we transfer information we take steps to protect it consistent with this policy and applicable law.

15. Changes to this policy

We may update this policy. When we do, we revise the "Last updated" date above and, where appropriate, tell you within the Service.

16. Contact us

Questions or requests about this policy or your data:
Email: support@tallova.app