Privacy policy

01Who we are and what this policy covers

TallyoCloud is the trading name of TallyoCloud, whose address is 202, Dev Bhavan, Nehru Place, New Delhi, Delhi 110019. We run the website at https://tallyocloud.com and an independent hosting service that runs your own licensed TallyPrime on private Windows cloud servers, reached through Remote Desktop. We are not Tally Solutions and do not act for it. In this policy "we", "us" and "our" mean TallyoCloud; "you" means a visitor, someone who contacts us, or a customer and the users a customer authorises.

Indian law treats the two kinds of data we handle differently, so this policy does too.

This policy covers our website, sign-up, the free trial, paid plans and support by WhatsApp, phone and e-mail. It does not cover services run by others that you may use alongside ours, such as Tally Solutions' licensing, TSS and Tally.NET services, or Microsoft's Windows App and Remote Desktop clients. Those companies have their own privacy policies. How we may use the service, and what we owe each other, is in our terms of service.

02What we collect and why

We collect personal data from you directly, from the way you use our website and service, and, for customers, from the payment provider that confirms your payment. Each item below has one stated purpose, and we don't reuse it for something unrelated without asking you first.

"You give it for that purpose" refers to the DPDP Act's legitimate use for data a person provides voluntarily for a specified purpose (section 7(a)).

What we never ask for. We don't ask for card details to start a trial, and we never ask for your Tally.NET password: when your licence moves to the cloud, you type it yourself on a screen-share. We don't buy contact lists or enrich your data from other sources. Our service is for businesses and professionals, so we don't knowingly collect data about children; if you think we have, tell us and we'll delete it.

How our forms send your details. A form on this site either sends what you type to our form-handling provider over an encrypted connection, or opens WhatsApp with your details pre-filled as a message. In the WhatsApp case nothing reaches us until you have read the message, edited it if you like and pressed send yourself.

03Customer verification records (CERT-In)

India's CERT-In Directions of 28 April 2022, issued under section 70B(6) of the IT Act, require data centres, VPS providers and cloud service providers to record accurate details about every customer. Providers must keep them for five years, or longer if another law requires, after the service is cancelled. So before we create any server, including a trial server, we record:

• the validated name of the customer hiring the service;
• the validated address and contact numbers;
• the ownership pattern, such as individual, partnership, LLP or company;
• the purpose of hiring the service, and the period of hire with dates;
• the IP addresses allotted to you or used by you;
• the e-mail address, IP address and time stamp used when you signed up.

We collect nothing beyond that list for verification. These records are stored in India, seen only by the few staff who handle onboarding and compliance, and used for nothing else: no marketing, no profiling and no sharing except with CERT-In or another authority that lawfully asks. Because the law fixes the retention period, we can't erase them early even if you ask, but we will tell you exactly what we hold. Our security page explains why this check also means nobody can rent a server from us anonymously.

04Where your data is stored and who can access it

Your server and its backups. Your private Windows server runs in a secure data centre in India, with its primary site in Mumbai. Daily automated backups are encrypted and kept in a separate location that is also in India, with 30-day retention. We name the data-centre facility in your quote. We don't copy server data outside India.

Logs and verification records. Gateway, server and admin-access logs are kept securely in India for a rolling 180 days, as the CERT-In Directions require. Verification records are also kept in India.

Communication tools. Some everyday tools we use to talk to you, such as e-mail delivery and WhatsApp, are run by global companies and may process your contact details and messages outside India. Section 16 of the DPDP Act allows this unless the Government restricts transfers to a particular country, and we will stop using any provider in a country it restricts. Your TallyPrime data never travels through these tools unless you choose to send a file that way.

How our staff can reach your server

• Only for a reason: a support request you approve, or an incident that affects your server, such as a failed backup or an attack.
• Through the same front door: engineers connect through the encrypted gateway with a second factor, like your users do.
• Always on the record: every admin session is logged with the time, the engineer and the purpose, and you can ask us for the log of access to your server.
• Never for our own use: we don't read, analyse, sell or train anything on your books.

For extra privacy you can lock a company with TallyPrime's own TallyVault password, which only you know. Remember that Tally warns a lost TallyVault password can't be recovered by anyone, including us. The full set of controls, from two-factor login to locked backup copies, is on our Tally on Cloud security page.

05SMS, e-mail and WhatsApp messages

One-time passwords. When we text you a sign-in or verification code, it is sent from a sender ID and message template registered on the telecom operators' DLT platform, as TRAI's Telecom Commercial Communications Customer Preference Regulations require. That means the text can't be changed into anything else on the way. If an SMS doesn't arrive, we send the code to your registered e-mail address instead.

Service messages. While you're a customer we send messages you need to run your account: setup details, renewal reminders, payment and pre-debit notices, backup or incident alerts and planned maintenance. These are part of the service, so you can't switch them off while your plan is active, but we keep them short and relevant.

WhatsApp. We send WhatsApp messages only if you have messaged us first or ticked an opt-in box. That box is never pre-ticked. Reply "STOP" or tell us in any way, and we'll stop. Messages on WhatsApp are also handled by WhatsApp under its own terms and privacy policy.

Offers and newsletters. We send these only with your separate consent, and every one has a simple way to unsubscribe. Withdrawing consent is as easy as giving it, as section 6(4) of the DPDP Act requires, and it doesn't affect your service.

Calls. If we ever record a support call, for example to show an engineer the exact error you see, we'll tell you at the start of the call.

06Sharing and sub-processors

We do not sell, rent or trade personal data, and we don't share it with advertisers. We share it only in these cases:

• Sub-processors that help us run the service, under written contracts that allow them to use the data only on our instructions and require them to protect it.
• Authorities such as CERT-In, courts, tax authorities or law enforcement, when Indian law or a valid order requires it. We disclose only what the order covers and, where the law allows, we tell you first.
• People you choose, for example your CA or a Tally partner you ask us to work with.
• A successor business, if TallyoCloud is merged or sold, on the same protections, and only after we tell customers.

We don't share your data with Tally Solutions. Licence activation happens directly between your TallyPrime and Tally's own servers, using your Tally account.

Our sub-processors

We give the name of each current provider to customers in their onboarding pack and to anyone on request. We update this list before a new type of provider starts handling personal data, and we give customers advance notice before adding any provider that can reach server data.

Card details. Payments are taken on the payment gateway's own secure page. We never see or store your full card number, CVV or net-banking password.

07How long we keep data, and what happens when you leave

We keep personal data only while we need it for the purpose it was collected for, or for as long as a law makes us keep it, and then we delete or anonymise it. The DPDP Act sets this as the default (section 8(7)).

Leaving us. You can download a full backup of your companies at any time without asking, and when you cancel we hand over a complete copy of your data. Our guide to moving Tally data to the cloud works in reverse too. Fees and refunds on cancellation are covered by our refund and cancellation policy.

08Your rights under the DPDP Act

As a Data Principal, the person the data is about, you have these rights over the personal data we hold as Data Fiduciary. Using them is free.

How to make a request. E-mail tallyocloud@gmail.com with "Privacy request" in the subject, or message us on WhatsApp. To protect you, we confirm the request comes from your registered e-mail address or mobile number before acting on it. We acknowledge every request within 24 hours and complete it within 15 days. If we can't do everything you ask, for example because a law requires us to keep a record, we explain why in writing.

Your part. Section 15 of the DPDP Act asks Data Principals to give accurate information and not to file false or frivolous complaints. Please tell us when your details change.

Requests about data in your books. If one of your own customers or employees asks us about their data in your TallyPrime company, we pass the request to you, because you are the Data Fiduciary for it, and we help you respond.

09Cookies and similar technology

Our website works without any non-essential cookies. Here is what happens today:

• Essential storage only, by default. The site doesn't need cookies to show pages. The only thing we store is the cookie choice you make below, and it stays in your browser's local storage. It isn't sent to us.
• Analytics only with consent. Google Analytics loads only after you allow it, in the cookie bar shown on your first visit or here. Switch them off and they stop for future visits.
• No advertising or cross-site tracking. We don't use advertising cookies, tracking pixels or remarketing tags.
• Fonts and code libraries. Some pages load fonts or code from content delivery networks such as Google Fonts and jsDelivr, which see your IP address in order to deliver the files.
• No personal data in our addresses. We never put your name, phone number or e-mail in our own page URLs or query strings, where they could end up in logs or browser history. The one exception is a WhatsApp hand-off you start yourself: the message text you will send is passed to WhatsApp, and you can read or change it before sending.

10Data breaches, security incidents and complaints

We protect personal data with reasonable security safeguards, the standard section 8(5) of the DPDP Act sets: private servers, encrypted connections and backups, two-factor login, least-privilege staff access and logs kept in India. No system is perfectly secure, so this is what we commit to if something goes wrong.

1. At once Contain and assess

   Isolate affected systems, preserve logs and work out what happened, which data was involved and whose.

2. Within 6 hours Report to CERT-In

   Reportable cyber incidents, including data breaches and ransomware, go to CERT-In within six hours of our noticing them, as its 2022 Directions require.

3. Without delay Tell you directly

   Affected customers and people hear from us by e-mail, phone or WhatsApp: what happened, when, the likely impact, what we've done and the steps you should take.

4. Within 72 hours Detailed report to the Data Protection Board

   Once the DPDP Rules' breach duties apply, we send the Board an initial notice without delay and a detailed report, with causes and remedial steps, within 72 hours.

If the breach affects data in your own books, we give you everything you need to meet your own duties as Data Fiduciary to your customers and staff. Our service commitments for uptime and incident response are in our service level agreement.

Grievance Officer

The IT Rules, 2021 require hosting providers to name a Grievance Officer, who must acknowledge a complaint within 24 hours and resolve it within 15 days. Ours handles privacy complaints, DPDP requests and any other complaint about our service.

If you're not satisfied with our answer, you may complain to the Data Protection Board of India once you have used our grievance process, as section 13(3) of the DPDP Act provides. All of our contact routes are on the contact page, and day-to-day technical help is on our support page, with Support 7 days a week.

Changes to this policy

When we change this policy we update the date at the top of this page. If a change materially affects how we use your data, we tell customers by e-mail before it takes effect, and we ask for fresh consent wherever the law requires it. Earlier versions are available on request.

Frequently asked questions