Privacy notice

Who is responsible

Clarity Bridge Ltd (company number 16451548) operates Tallymere. We are the controller for personal information used to manage Tallymere accounts, security and our relationship with customers.

For personal information in a customer’s supplier invoices, correspondence and financial records, the customer normally determines the purpose of processing and we process that information on its instructions. Requests about those records should normally go to the relevant customer first.

Information we handle

• Account and business details, such as your name, email address, company and workspace membership.
• Documents and information supplied to a workspace, including supplier contacts, invoice details, accounting entries, payment references and statements.
• Instructions, permissions, agent actions, approval records and correspondence needed to carry out and evidence the work.
• Technical information needed to operate and protect the service, such as sign-in events, request logs and browser storage described in our cookie notice.

Information comes from you, your workspace’s authorised users, suppliers who send material to that workspace, and services you authorise. Avoid uploading unrelated personal information or sensitive personal data that is not needed for accounts payable.

Why we use it

We use account information to provide access, communicate about the service and administer your relationship with us. Our lawful basis is performance of a contract where it is with you personally, or our legitimate interests in operating a business service where you represent an organisation.

We also rely on legitimate interests to maintain security, prevent misuse, investigate faults and establish or defend legal claims, and on legal obligations where applicable. Customer financial records are processed to perform the customer’s authorised instructions, rather than for independent marketing purposes.

Automation and your controls

Tallymere uses document extraction and automated workflows to assess and progress AP work. Workspace permissions and policy limits determine which actions can proceed and which require review. Customers should establish an appropriate review process for exceptions and decisions affecting people. You can ask us about processing of your personal information or challenge its accuracy.

Service providers and sharing

We use Vercel for application hosting and Supabase for account authentication, the database and private document storage. Email services such as Resend and inbound email routing are used when configured. Stripe provides subscription checkout and customer billing management when enabled; payment-card details are entered directly with Stripe. Tallymere retains the customer and subscription identifiers, plan state and billing audit events needed to manage access. A bank or payment service receives payment information only as part of an authorised, enabled payment arrangement.

Authorised users in your organisation can access information according to their workspace roles. We may also disclose information where required by law or necessary to establish or defend legal claims. We do not sell personal information.

Provider processing may involve locations outside the UK. Contact us for the processing locations and transfer arrangements relevant to your service. Any international transfer must have an applicable UK adequacy decision or other lawful safeguard; this notice does not represent that all processing is UK-only.

How long we keep information

Retention depends on why the information is held. Account information is needed while the account is active. After closure, continued retention is assessed against outstanding service matters, security investigations, legal obligations and the establishment or defence of claims.

Customer documents and audit records are retained according to the customer’s instructions and applicable obligations. Financial records may need to be preserved even when a user leaves a workspace. Contact us to request deletion or to establish the retention and export arrangements for your business; do not assume account closure immediately removes documents or backups.

Your rights

Depending on the circumstances, you may request access, correction, erasure, restriction, portability or object to processing. If processing relies on consent, you can withdraw it. Some rights have exceptions, including where records must be retained by law. We may need to verify your identity before responding.

Write to Clarity Bridge Ltd, 124–128 City Road, London, England, EC1V 2NX, marking your correspondence “Tallymere” or “Tallymere — Data protection” as appropriate.

You can also complain to the Information Commissioner’s Office.

Changes to this notice

We will update this notice when processing changes. Material changes will be brought to customers’ attention through an appropriate service communication.