Privacy Policy

1. Who we are

Tallied is operated by Tallied (Private) Limited, registered in Pakistan, office at TF-121, Deans Trade Center, Peshawar. In this policy "we", "us" and "Tallied" mean that company, and "the Service" means app.tallied.pk, any custom domain we host on your behalf, and this website.

We are the data controller for our own customers' account information. Where you use Tallied to process your clients' invoices, you are the controller of that data and we act as your processor — we handle it on your instructions and for no purpose of our own.

2. What we collect

Account data. Your name, email address, phone number, firm name and password — stored only as a bcrypt hash, never in readable form.

Business and client data you enter. Business names, NTN/CNIC and STRN numbers, addresses, buyer details, products, rates and the invoices you create. For consultants this includes data about your clients.

FBR credentials. The PRAL bearer tokens you supply so the Service can submit invoices on your behalf. These are encrypted at rest with AES-256, are never displayed back to you in full or shown to other users, and are sent nowhere except FBR's own API endpoints.

Technical and usage data. IP address, login timestamps, browser user-agent, and an audit trail of actions taken in the Service — kept so account activity can be traced for security and for your own compliance records.

We do not collect payment card details, we do not run advertising trackers, and we do not sell data to anyone.

3. Why we use it

To run the Service — creating, validating and submitting invoices to FBR and returning the result to you.
To authenticate you and keep accounts secure, including lockout after repeated failed logins.
To bill you, and to show you your own billing history and ledger.
To answer support requests and send service notices such as billing reminders or downtime warnings.
To meet our own legal and tax obligations in Pakistan.

We do not use your data, or your clients' data, to train machine-learning models, and we never market to your clients.

Only where it is necessary to deliver the Service:

FBR / PRAL — invoice data is transmitted to FBR's Digital Invoicing API. That is the purpose of the Service.
Our hosting provider — the servers that run the Service, located outside Pakistan.
Our email provider — to deliver transactional email such as password resets and invoices.
Where the law requires it — in response to a valid order from a competent Pakistani authority.

We do not sell, rent or trade personal data, and we have no advertising partners.

5. How we protect it

All traffic is encrypted in transit with TLS; the Service is not served over plain HTTP.
FBR bearer tokens are encrypted at rest with AES-256.
Passwords are stored as bcrypt hashes and cannot be recovered, even by us.
Access is role-based — users see only the businesses they have been granted.
Every significant action is written to an audit log with the acting user and IP address.
The database is backed up nightly, and backups are stored outside the public web root.

No system is perfectly secure. If we become aware of a breach affecting your data we will tell you without undue delay, what we know and what we are doing about it.

6. How long we keep it

Invoice records are retained while your account is active and afterwards for as long as Pakistani tax law requires records to be kept. Audit logs are retained for the same period.

If you close your account we delete or anonymise your account data within 90 days, except where we must keep it for legal, tax or accounting reasons. You can request an export before you leave.

7. Your choices

You can view and correct most of your data directly in the Service. You may also ask us to:

send you a copy of the data we hold about you;
correct anything inaccurate;
delete your account and any data we are not legally required to retain;
stop sending you non-essential email.

Write to support@tallied.pk and we will respond within 30 days. We may need to verify your identity first.

8. Cookies

The Service sets a session cookie so you stay logged in, and stores a little data in your browser to remember preferences such as the tab you last opened. Both are strictly necessary for it to work.

This marketing website loads fonts and an animation library from third-party CDNs, which will see your IP address as a normal part of serving those files. We run no analytics or advertising cookies on it.

9. Children

The Service is a business tool, is not directed at anyone under 18, and we do not knowingly collect data from children.

10. Changes to this policy

If we make a material change we will update the date at the top of this page and, where it meaningfully affects you, tell you by email or in the Service before it takes effect.

11. Contact us

Questions about this policy, or about the data we hold:

Email: support@tallied.pk
Phone: +92 3369875333
Address: TF-121, Deans Trade Center, Peshawar, Pakistan