Privacy Policy

Tallyhaus is operated from Australia. Tallyhaus is a trading name, not a registered business name. We can be contacted at hello@tally-haus.com for all privacy-related enquiries, access and correction requests, deletion requests, and complaints.

This policy applies to the Tallyhaus website, web application, iOS and Android apps, and related support email communications. It covers personal and operational information handled by Tallyhaus when you register, use the service, or interact with us.

Account and profile information. Your name, email address, and role within your organisation, collected when you register or are invited to join.

Invitation details. First name, last name and email address of people you invite to your organisation, and the role and venue you assign to them.

Business and venue details. Business name, venue name, address, phone number, POS system settings, expected cash values, budget targets, report-section toggles and wage rate settings.

Roles and permissions. The organisational role assigned to each user (founder, director, operational manager, bar manager or team member) and venue assignments.

Operational reports. Information entered into daily reports and related tools, including manager and staff names, hours worked, security hours, cash counts, EFTPOS and POS reads, cash paid out, revenue targets, variances, tasks, shift notes, weather, entertainment, uploaded images and manager sign-off details.

Billing status. Plan status, subscription status and billing dates. Full card details are never stored by Tallyhaus; iOS payments are handled by Apple through the App Store.

Contact and support messages. Your name, email and message when you contact us through the public contact form or in-app help form.

Device, IP and security logs. Standard technical information such as browser type, IP address, authentication tokens and server logs collected automatically to keep the service secure and functioning.

Optional integration data. When you choose to connect a POS or other integration, the data retrieved from that service as needed to provide the features you have selected.

We collect information from the following sources:

• Directly from users when they register, complete onboarding, or enter data into the service.
• From organisation founders and administrators who set up the business, invite staff and configure roles.
• From invited staff members who accept invitations and set up their profiles.
• From connected services that you select, such as POS or payment integrations.
• Through automatic technical collection as you use the website, web app or mobile apps.

We use your information to:

• Provide and secure the service, including daily reconciliation reports, cash summaries and wage-to-revenue analytics.
• Authenticate users and maintain secure sessions.
• Generate reports, insights and dashboards from the operational data entered.
• Manage teams, roles and permissions within your organisation.
• Manage subscriptions, billing and plan administration.
• Deliver transactional messages such as variance alerts, owner digest emails, invitation emails and password reset messages.
• Provide user support and respond to enquiries.
• Prevent misuse, fraud and unauthorised access.
• Comply with legal obligations where applicable.
• Improve the reliability and performance of the service.

We engage the following service providers to help operate the service. Each provider receives only the information reasonably needed to perform its function:

• Base44 provides application hosting, authentication, database storage and file storage.
• Apple processes iOS in-app subscription payments. We do not collect or store your full card numbers.
• Resend delivers transactional emails such as invitations, password resets and report notifications.
• Apple and Google distribute the iOS and Android apps through their respective app stores.
• POS and integration providers chosen by you, such as Square or Lightspeed, provide sales data when you connect them. The data exchanged depends on the integration you select.

We do not disclose your personal information to other third parties except where required by law or as described in this policy.

Tallyhaus is operated from Australia, but your data may be stored or processed outside Australia, including in the United States, by Base44 and other service providers. We take reasonable steps to select and manage providers, but we do not represent that specific contracts, data residency guarantees or certification arrangements are in place unless we have confirmed them. If you would like more information about where your data is processed, contact us at hello@tally-haus.com.

We do not sell your personal information. We do not use advertising networks or behavioural tracking on the service. Organisation data, reports and shift notes are private to authorised users within your organisation, subject to the role-based permissions configured by your founder or administrators. We do not publish your organisation data or notes publicly.

You can access and correct much of the information you enter into Tallyhaus directly within the app. You may also request a copy of, or correction to, your personal information by contacting us at hello@tally-haus.com. Identity verification may be required before we provide access to personal information. In some cases, we may not be able to provide access where an exception applies under the Privacy Act 1988, such as where providing access would pose a serious threat to life, health or safety, or would unreasonably impact the privacy of others.

You can request deletion of your account and associated data by contacting us at hello@tally-haus.com. We will verify your identity before actioning the request. Deletion means removal or irreversible de-identification of your personal information from active Tallyhaus systems within 30 days after identity verification, subject to legally required retention. Records that must be kept for 5 or 7 years under statutory obligations (see the retention schedule below) may be retained in restricted form rather than deleted. Organisation-wide deletion requires founder confirmation.

We do not promise immediate or instant deletion. Provider-controlled backups and deleted-record recovery copies are managed by Base44 and other service providers under their own recovery cycles; we cannot guarantee that a deleted record is purged from every provider backup within a specific timeframe.

We retain your information only for as long as reasonably needed for the purposes described in this policy, to meet legal obligations, to resolve disputes, to maintain security and to support backup recovery. Legal holds, disputes, investigations and statutory duties can extend retention beyond the periods below. Where a record is legally required to be kept, it may be restricted from ordinary use rather than deleted. “Deletion” means removal or irreversible de-identification from active Tallyhaus systems; provider recovery copies expire under their own controlled recovery cycle.

The retention schedule below applies to Tallyhaus-controlled app records. Provider-controlled Base44 logs, deleted-record recovery and backups, and external email-provider records (such as Gmail or Resend) are governed by those providers’ own retention and recovery policies. Tallyhaus cannot configure provider backup or platform-log retention.

The 7-year retention for reports containing employee hours or wage information reflects time-and-wages record obligations under the Fair Work Act 2009. The 5-year retention for general financial reports reflects taxation record obligations under the Australian Taxation Office requirements. These are statutory minimums and may be extended by legal hold, dispute or investigation.

We use reasonable technical and organisational measures to protect your information, including authenticated access, role-based permissions and encryption of data in transit. No method of transmission or storage is completely secure. We do not guarantee absolute security, but we work to protect your information using industry-standard practices.

If we become aware of a data breach, we will assess whether it is an eligible data breach under the Notifiable Data Breaches (NDB) scheme. If we assess that the breach is likely to result in serious harm to individuals and is not capable of remediation, we will take reasonable steps to notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required.

If you have a complaint about how we handle your personal information, please contact us at hello@tally-haus.com. We will acknowledge your complaint promptly and aim to respond within 30 days. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC). More information is available at https://www.oaic.gov.au/privacy/privacy-complaints.

Customer organisations are responsible for ensuring they have authority to enter staff information into Tallyhaus, for informing their staff about how their information is used, for limiting collection to what is needed, and for configuring appropriate role-based access. Tallyhaus provides role-based permissions to help organisations control who can see and manage different types of data.

Do not enter sensitive information into shift notes, upload areas or free-text fields unless it is genuinely necessary for the operation of your business. This includes tax file numbers, government identity numbers, bank or card details, and health information. If sensitive information must be collected, the organisation must have authority and consent where required by law. Tallyhaus does not require sensitive information to provide the service.

Tallyhaus is a business service intended for users aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact us and we will take steps to delete it.

We use essential cookies, authentication tokens and local storage to keep you signed in, remember your preferences and protect against unauthorised access. We do not use advertising or cross-site tracking cookies. If we add an optional analytics tool in the future, we will disclose it here and provide a way to opt out.

We may update this policy from time to time. The effective date at the top of this page reflects the most recent version. If we make material changes, we will notify users through the service or by email where appropriate. Continued use of the service after a change takes effect constitutes acceptance of the updated policy.

For any questions about this Privacy Policy or how we handle your data, please contact us at hello@tally-haus.com.