Privacy Policy
Global data protection standards, strict GDPR alignment, CCPA/CPRA recognition, and transparent international privacy governance.
1. Global Scope, Data Controller & GDPR Alignment
Tally52 operates as an international web platform serving members across North America, Latin America, Europe, and worldwide. Tally52 acts as the Data Controller under Article 4(7) of the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and adheres strictly to applicable international data protection statutes including the California Consumer Privacy Act (CCPA/CPRA), Brazil's LGPD, and global privacy standards. For privacy inquiries, Data Protection Officer contact, or rights requests, contact us through our contact form or directly at info@tally52.com.
2. Categories of Personal Data Collected
We adhere to the GDPR data minimization principle (Art. 5(1)(c)) by collecting only strictly necessary data: account identification (email address, salted-hashed password credentials), payment customer identifiers (tokenized and processed securely by Stripe without storing raw card numbers), and member-provided ledger entries (account names, numerical amounts, and transaction tags). When you submit a contact message, we store its contents, contact details, signed-in member identity where applicable, request IP address and browser user agent. Optional browser/device, viewport and screen dimensions, language and timezone help authorized administrators investigate support requests. Authorized support administrators can temporarily view a member account for troubleshooting; this access is marked in the interface and audited. We do not collect biometric data, precise background geolocation, or special categories of personal data under GDPR Article 9.
3. Lawful Bases for Processing (GDPR Article 6 & International Standards)
We process personal data strictly pursuant to lawful bases defined under GDPR Article 6: Article 6(1)(b) (contractual necessity to deliver the 52-week ledger service and user-requested features), Article 6(1)(c) (compliance with statutory accounting and regulatory legal obligations), Article 6(1)(f) (legitimate interests in guaranteeing network security, operational reliability, technical diagnostics, and fraud prevention), and Article 6(1)(a) (explicit consent where required by local statute, including optional preferences).
4. Strict Zero-Sale & Anti-Broker Pledge (CCPA/CPRA & GDPR)
We operate under a strict anti-monetization philosophy regarding member data: Tally52 never sells, leases, licenses, trades, or brokers your personal details or financial telemetry to third-party data aggregators, advertising platforms, or credit bureaus. In compliance with the California Consumer Privacy Act (CCPA/CPRA) and GDPR, we do not sell or share personal information for cross-context behavioral advertising. Your data serves solely to calculate your personal planning horizon.
5. Data Security, Technical Defenses & Inherent Internet Risks
Pursuant to GDPR Article 32 (Security of Processing), all communication with Tally52 is protected by modern Transport Layer Security (TLS 1.3). Application databases and file assets are stored with AES-256 encryption at rest inside ISO 27001 and SOC 2 certified Google Cloud Platform infrastructure across secure United States and European Union regions. While we maintain rigorous technical and organizational measures, no electronic transmission over the internet or cloud storage architecture can be guaranteed to be completely impenetrable against unauthorized third-party breaches, zero-day vulnerabilities, or interception. You acknowledge these inherent risks and are responsible for safeguarding your login credentials.
6. Data Retention, Independent Backups & Account Termination Handling
We retain personal and financial ledger records only for as long as your account remains active or as required to fulfill statutory legal obligations. If membership is denied, revoked, or terminated by Tally52 or voluntarily closed by you, associated ledger data is marked for permanent deletion in accordance with GDPR Article 17 and our retention schedule. Because internet connectivity and synchronization latency may impact real-time transmission, members are advised to maintain independent export backups of their financial records.
7. Global Statutory Rights & GDPR Data Subject Rights
Regardless of where you reside, Tally52 extends comprehensive statutory privacy rights. Under GDPR Articles 15-22, European Union residents hold the Right of Access (Art. 15), Right to Rectification (Art. 16), Right to Erasure / Right to be Forgotten (Art. 17), Right to Restriction of Processing (Art. 18), Right to Data Portability (Art. 20), and Right to Object (Art. 21). You also possess the statutory right to lodge a complaint with an EU Supervisory Authority (Art. 77). California and United States residents hold equivalent statutory rights under CCPA/CPRA (Right to Know, Delete, Correct, and Non-Discrimination). Latin American residents are protected under LGPD and regional privacy principles. You may submit verifiable rights requests to info@tally52.com at any time.
8. Sub-processors & International Transfers (GDPR Chapter V)
We engage only vetted, industry-leading sub-processors under rigorous Data Processing Agreements compliant with GDPR Article 28: Stripe (payment processing), Google Cloud Platform (infrastructure hosting), and Mailgun (transactional notifications). Cross-border and transatlantic data transfers rely on European Commission Standard Contractual Clauses (SCCs) under GDPR Article 46 and robust transfer impact assessments to guarantee adequate protection under applicable international laws.