Privacy Policy

This policy explains what PFR Labs Private Limited collects when you use Tally, why we collect it, who else processes it, and what you can ask us to do about it.

Effective 9 July 2026. We are the data fiduciary (controller) for the data described below.

1. Who we are

Tally is operated by PFR Labs Private Limited, [registered address pending]. For any question about this policy or your data, write to privacy@example.invalid.

2. What we collect

Tally reads your accounting data out of your own Tally ERP installation and mirrors it to our cloud so that dashboards and WhatsApp answers work when your office PC is asleep. Concretely, we handle:

Account data

Your email address and name, from sign-up or from Google if you sign in with Google. Passwords are stored only as a hash.

Accounting data from Tally

Ledger accounts and balances; parties (your customers and suppliers) and their names and outstanding balances; vouchers, including dates, amounts, and free-text narration; stock items, including HSN codes and GST rates; and balance-sheet and profit & loss lines. Narration and item metadata are free-text fields — whatever your staff typed into Tally, including any personal details, is synced as written.

WhatsApp data

When you message the Tally bot we receive your phone number, the text of your message, and its timestamp. We do not store your phone number: we keep only a one-way cryptographic hash of it, to recognise you on your next message. We do not read your WhatsApp profile name, media, or location.

Device data

The name, platform, and architecture of each Windows machine you enrol, so you can tell your devices apart. Device secrets are stored only as a hash.

3. How we use it

We use your data to run the product you asked for: to sync your books, render your dashboards, answer your questions on WhatsApp, send the summaries you subscribe to, authenticate you and your devices, and keep an audit trail of what was read. We do not sell your data, and we do not use your accounting data to train machine-learning models.

4. Automated processing by AI models

When you ask the WhatsApp bot a question, your message text and the accounting figures needed to answer it are sent to a large language model hosted by a third party (currently Google's Gemini models, reached through OpenRouter). Those figures can include the names of your customers and suppliers. The model composes the reply; it does not write to your books. If you would rather this did not happen, do not use the WhatsApp interface — the dashboards do not send your data to a language model.

5. Who else processes your data

We share data only with the processors below, only to the extent they need it to run the service.

Meta Platforms (WhatsApp Business Cloud API)

Delivers messages to and from you on WhatsApp.

Your WhatsApp phone number, message text, message metadata.

OpenRouter, routing to Google (Gemini)

Generates the natural-language answer to a WhatsApp question.

Your message text, and the accounting figures needed to answer it — including counterparty (customer and supplier) names.

Convex

Accounts, sign-in, projects, devices, and WhatsApp link records.

Email address, name, device names, company names, hashed phone numbers.

Neon (PostgreSQL)

Stores the accounting data synced from your Tally installation.

Ledgers, parties, vouchers, narrations, stock items, financial statements.

Cloudflare

Serves this website, the sync endpoint, and installer downloads.

Accounting data in transit through the sync endpoint; request metadata.

Google (Sign in with Google)

Optional sign-in method.

Email address and name, if you choose to sign in with Google.

6. Where your data is stored

Your accounting data is stored with Neon; your account and project records with Convex; installers and website traffic with Cloudflare. These providers operate globally, and your data — including the processing described in section 4 — may be stored or processed outside India. We do not currently offer a contractual data-residency guarantee. If residency is a requirement for you, contact us before you connect a company.

7. Retention and deletion

We keep your accounting data for as long as your project exists, because the product is a live mirror of your books. Deleting a project in the dashboard immediately revokes its devices and removes its records from our control plane. To have the mirrored accounting data itself erased, email privacy@example.invalid and we will erase it and confirm when it is done. Copies may persist in our providers' routine backups until those backups age out.

8. How we protect it

  • Your books stay on your PC. The agent reads Tally through its read-only interface and does not create, edit, or delete vouchers.
  • Traffic is encrypted with TLS in transit, and our providers encrypt data at rest.
  • Every row in our database is protected by row-level security tied to your project, and the WhatsApp bot connects using a role that can only read, never write.
  • Phone numbers, passwords, device secrets, and link codes are stored only as one-way hashes.
  • Devices authenticate with short-lived, per-project tokens that you can revoke.
  • Our audit trail records which query ran, when, and how long it took — identified by a cryptographic digest rather than the query text, so the audit log itself does not reveal your data.

9. Your rights

Under India's Digital Personal Data Protection Act, 2023, you may ask us for a summary of the personal data we hold about you, ask us to correct or complete it, ask us to erase it, and nominate someone to exercise these rights if you cannot. Write to privacy@example.invalid. If you are not satisfied with our response, you may escalate to our grievance officer at grievance@example.invalid, and thereafter to the Data Protection Board of India.

Note that most of the personal data in your books belongs to your customers and suppliers, not to you. For that data you are the data fiduciary and we are your processor: we act on your instructions, and requests from those individuals should reach us through you.

10. Children

Tally is a business product and is not directed at children. We do not knowingly collect personal data from anyone under 18.

11. Changes to this policy

If we change how we handle your data we will update this page and revise the effective date above. If the change is material we will tell you before it takes effect.