Privacy notice

Graaph Technologies (Pty) Ltd is the responsible party for your shared Tallied Books login, including your email address, name, password hash and sign-in records, for the practice account and billing information this notice describes, and for the business contact information and correspondence described below. Our Information Officer can be reached at privacy@talliedbooks.co.za.

Company

Graaph Technologies (Pty) Ltd

Registration number

2022/854476/07

Address

2 Platberg Street, Johannesburg, Gauteng, 1687

Support

support@talliedbooks.co.za

Information Officer

privacy@talliedbooks.co.za

Website

talliedbooks.co.za

If your accountant or bookkeeper uses Tallied Books, the practice is responsible for your membership and the records in its workspace. It decides how your documents and practice records are used, and we process them on its behalf under a data processing agreement. Its privacy notice applies to that information, and we pass requests about it to the practice. Requests about your shared login come to us, even if you use it only as a practice’s client.

You have one login, with one email address, name and password across the practices you belong to. Each practice gives you a separate membership, which holds your role, client access, active and owner status, email preferences and last sign-in at that practice. A practice can see your name and email through its membership, but cannot see which other practices you belong to.

You manage your login’s name, email and password yourself; changes apply across your practices. A practice cannot change those details or lift your login’s lockout. It can change or deactivate your membership in its own workspace, and can correct an invitation address only for a login that has never been accepted.

If you ask us to delete your login, we end its sessions, deactivate its memberships in every practice and anonymise its identity, including the name shown in those practices’ records. The practices’ documents, client records and audit history stay with them, under their own retention and deletion responsibilities. Delete your account explains how to ask, in the app or by email.

The app for iPhone and Android lets a practice’s clients send documents and answer requests. It uses your phone’s camera only while you take a photo, and reads only the photos and files you choose to send. What you send becomes part of your practice’s records, as If you are a practice’s client describes.

Your sign-in is kept in your phone’s secure storage. If you allow notifications, the app gives us your phone’s notification token so we can tell you when your accountant needs something. Apple’s Push Notification service or Google’s Firebase Cloud Messaging delivers them, from outside South Africa, carrying your practice’s name and a short line. For a new request or a reminder, that line names what your practice asked you for, such as “Due today: Capitec Bank Statement — October 2026”, and it shows on your lock screen; anything else is one fixed line. A notification never carries a request’s message or details, a document’s contents, or your name. The token is removed when you sign out of the app or delete your account. You can turn notifications off in the app, or hide what they say on your lock screen in your phone’s settings.

The app does not use your location or contacts, and has no advertising or analytics tracking.

To book a demo we ask for your name, email address, practice name and roughly how many clients it has, and any note you add. We email a code to check the address is yours, then put the demo on our calendar and send you an invitation with its video link. We use these details only to hold and prepare for the demo.

The details stay in our database in South Africa. The calendar event and its invitation go through our Google Workspace, which Google may process outside South Africa under its data processing terms (section 72). A request whose code is never entered is deleted after a day, and a booked demo after 12 months, unless your practice signs up.

Booking a demo is not consent to marketing. We send product news only if you tick the box for it, and every message lets you stop.

• Login information: your name, email address, a one-way hash of your shared password, never the password itself, failed sign-ins, lockout and last sign-in across Tallied Books, and whether emails to your address have bounced or been reported as unwanted.
• Membership information, processed for each practice: your role, client access, active and owner status, email preferences and last sign-in at that practice.
• Practice information: the practice or business name and workspace address, its registration and VAT numbers, province, practice type, practitioner and membership numbers with its professional body, its address and branding, and who owns and administers the workspace.
• Verification: for a practice, the details we check before it can invite clients.
• Billing information: the plan, invoices and payment status. Paystack takes card payments; for a saved card we keep Paystack’s reference, a short description of the card and its expiry date, never the full card number.
• Security records: sign-in and session records, the browser used and a one-way hash of the network address. Each practice’s audit trail of significant workspace actions is processed on its behalf.
• Messages: what you send to support, and the delivery status of the emails we send, including bounces and complaints.
• The app: if you allow notifications, your phone’s notification token, held with your membership.
• Business contacts: a firm’s name, town, website and published business email address, the page we found it on, and relevant information from its own website, such as the services it offers. We also keep our correspondence and a record of consent and contact preferences. Our first email identifies the page where we found the address.

• To provide Tallied Books under our agreement with you.
• To keep Tallied Books and our customers secure, prevent fraud and investigate incidents, which is our legitimate interest and yours.
• To check that a practice is what it says before it can invite clients, which protects those clients.
• To bill you, issue tax invoices and keep the records the law requires.
• To send service messages: sign-in codes, billing notices, and changes to these documents.
• To tell our customers about our own similar services, with a way to opt out in every message. We send other direct marketing only with consent.
• To identify accounting, bookkeeping and tax practices that Tallied Books may be relevant to, ask once whether they would like to hear about it by email, and respond to enquiries.
• To understand how Tallied Books is used, from counts and totals rather than the contents of documents.

A published business email address does not itself give us permission to send marketing. Our first email asks for that permission; if you agree, we send what you asked for. If you decline or do not answer within 30 days, we do not write again and record your address on a do-not-contact list. Answering is voluntary, and no law requires it.

We use only the cookies Tallied Books needs: to sign you in and keep your session secure, to protect changes against cross-site requests, to remember whether you chose a light or dark theme, and, where they apply, to act for a client or hold a support session. We do not use advertising or analytics cookies.

• Each practice you belong to, which can read your login’s name and email and the email delivery status it needs for your membership.
• The sub-operators on the register, under written agreements.
• Google Workspace, to send and receive our business emails, and service providers that help us prepare them, under agreements protecting the information they process.
• Paystack, to take payments.
• Accounting software you connect, such as Xero or Sage, on your instruction.
• Authorities, where the law requires it.
• Anyone who buys our business, under a duty of confidentiality and bound by this notice.

We do not sell personal information.

We store information in South Africa. Some sub-operators process it elsewhere, for the purposes and in the countries the register lists, under agreements that give it protection substantially similar to POPIA’s (section 72). Google and the service providers that help us prepare business emails may also process business contact details and correspondence outside South Africa under protective agreements.

• Login information: while your login remains active, unless you ask us to delete it as described above. Closing one practice or deactivating a membership does not delete a login you use across practices.
• Practice account information and workspace records: while the workspace is open, and until its data is deleted 90 days after it closes.
• Invoices and payment records: for as long as tax law requires, which is at least five years.
• Security records and messages: for as long as we need them to protect Tallied Books, investigate incidents or deal with what you asked.
• Business contact details: an email address we never use is deleted within 90 days. If you decline contact, we delete your firm’s details within 30 days; if you do not answer, 12 months after we asked. If you agree to hear from us, we delete them 24 months after we were last in touch, or within 30 days of you asking us to stop.
• Contact preferences: a minimal do-not-contact record stays for as long as we conduct outreach, so we can honour your preference if we find your firm again.

The measures are described on our security page and in Annex A of the data processing agreement.

• Ask whether we hold personal information about you or your firm, and for a copy of it (section 23).
• Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully (section 24).
• Object to processing that relies on legitimate interests, and to direct marketing at any time (section 11(3)).
• Withdraw your consent where we rely on it.

To stop business emails or ask about the information we hold about your firm, reply to our email or contact our Information Officer below. You do not need to use a particular word or form to ask us to stop.

Write to our Information Officer at privacy@talliedbooks.co.za. We may need to confirm who you are before we act. Our manual under the Promotion of Access to Information Act is available from the Information Officer.

You may also complain to the Information Regulator: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; POPIAComplaints@inforegulator.org.za; inforegulator.org.za.

We publish each version here with its date, and email account holders about changes that matter to them.