Sub-operators
The companies we use to run Tallied Books, what each receives, and where it processes it.
Version 1.0, in force from 27 October 2026
1. Sub-operators for your workspace
These companies process the personal information in your workspace for us, under the data processing agreement. Each is bound by a written agreement with protection substantially similar to POPIA’s.
Google CloudCloud hosting
- What it does for us
- Runs Tallied Books: the application, its own database server, files, queues, keys and logs. Most documents are read here too, by our own reader.
- What it receives
- Everything in your workspace. Logs hold identifiers, never document contents or figures.
- Where
- South Africa (Johannesburg)
- Agreement
- Google Cloud Data Processing Addendum
OpenAIAssisted document reading
- What it does for us
- When our own reader cannot settle a receipt or invoice: choosing between the values it found, then reading what is still missing.
- What it receives
- The text our reader read from that document, with card numbers, long numbers such as VAT and account numbers, email addresses and contact details masked. Never the file, and bank statements are never sent.
- Where
- United States
- Agreement
- OpenAI Data Processing Addendum, with the EU standard contractual clauses
Amazon Web ServicesEmail delivery
- What it does for us
- Delivers the emails Tallied Books sends: requests, reminders, sign-in codes and notices.
- What it receives
- Each recipient's name and email address, and the message.
- Where
- South Africa (Cape Town)
- Agreement
- AWS Data Processing Addendum in the AWS Service Terms
AppleiPhone app notifications
- What it does for us
- Delivers the Tallied Books app's notifications to your client's iPhone, once they turn notifications on, when you need them to act.
- What it receives
- The phone's notification token, your practice's name and a short line: for a new request or a reminder, the request's title; otherwise a fixed line. Never a request's message, a document's contents or a file. Held for at most a day for a phone that is off.
- Where
- United States
- Agreement
- Apple Developer Program License Agreement
GoogleAndroid app notifications
- What it does for us
- Delivers the Tallied Books app's notifications to your client's Android phone, once they turn notifications on, when you need them to act.
- What it receives
- The phone's notification token, your practice's name and a short line: for a new request or a reminder, the request's title; otherwise a fixed line. Never a request's message, a document's contents or a file. Held for at most a day for a phone that is off.
- Where
- United States
- Agreement
- Firebase Data Processing and Security Terms
2. For your account and billing
These process information that we are responsible for ourselves, as our privacy notice describes. They never receive your clients’ documents.
PaystackCard payments
- What it does for us
- Takes subscription payments and keeps a saved card for renewals.
- What it receives
- The billing contact, the amount, and the card details you enter on Paystack's own page. We never see the full card number.
- Where
- As set out in Paystack's privacy policy
- Agreement
- Paystack's merchant terms
3. Services you connect
When you connect Xero or Sage, we send the records you approve to it on your instruction. It is not our sub-operator: your own agreement with it governs what it does with your data.