TallyDock Privacy Policy

1. Scope and operator

This policy covers the Mobile Services website, the TallyDock mobile application, its server and its customer console. TallyDock helps organisations scan product barcodes and work with product catalogues, inventory and trade documents, and connected devices. Statements about TallyDock do not automatically apply to other applications.

TallyDock is owned and operated by Interdevelopment UAB, a Lithuanian company, and distributed under the Retail Tech Solutions brand. Retail Tech Solutions is the brand; Interdevelopment UAB is the responsible legal entity.

• Company code: 305801503.
• VAT number: LT100014237617.
• Address: Juozo Maceikos g. 5, LT-02213 Vilnius, Lithuania.
• Privacy Officer and privacy contact: info@interdevelopment.eu.
• Company website: Interdevelopment UAB.

2. Console accounts and Google sign-in

You do not need a personal account to operate the mobile terminal using an organisation's connection PIN. Account administration takes place in the separate web console.

When you sign in to the console with Google, we receive a Google account identifier, your name, email address and email-verification status. We keep these details with your TallyDock account, selected interface language and organisation membership to provide account access. TallyDock does not receive your Google password. The sign-in integration uses basic identity information, not access to Gmail or Drive.

The console uses a secure session cookie and stores your language choice in your browser. If you enable two-factor authentication, the server stores the information needed to verify authenticator codes, protected recovery-code records and security events. Google processes information when its sign-in component loads and when you authenticate, under Google's own privacy terms.

3. Device registration and connectivity

A new, unconnected installation can work locally. Entering a PIN does not by itself connect the app: pressing the connection button starts registration and pairing with your organisation.

The app creates a random access credential, and the server assigns a device UID. The server stores a hash of the credential, the UID, device code and name, platform, application version, organisation link, connection history, and registration, connection and last-contact times. The UID identifies an application registration; it is not an IMEI, hardware serial number or advertising identifier. The platform indicates iOS, Android or web, and the application version is the TallyDock version, not a separately collected operating-system version or phone model.

If registration succeeds but pairing fails, for example because a PIN is invalid, the server registration and credential hash can remain. Cancelling the attempt, closing the app or uninstalling it does not send a request to erase that server registration.

After a successful connection, the app stores its credential in protected storage within the current installation. The current version does not restore a previous connection through iOS Keychain or Google Block Store. After reinstalling, you need to connect again; a previous server record can remain. Device operating-system copies and records left by older versions are separate from the current connection-storage mechanism.

While a connected app is active, it normally checks connectivity about every ten seconds, subject to network availability and retry delays. The server records the last-contact time to show device availability and return current organisation settings. These checks run separately from document exchange and do not upload documents or photographs. Platform and application version are recorded during registration; connection-delay measurements displayed by the app are calculated locally and are not separately sent to the server.

Disconnecting requires confirmation from the server. Once confirmed, the app clears its local connection and the server removes the current organisation link. Disconnecting does not erase the server registration, its credential hash, historical organisation links or documents previously stored for the organisation. Section 9 explains retention and deletion.

4. Catalogues and business documents

TallyDock stores product catalogues, document identifiers and dates, product names, codes and barcodes, quantities, comments and other organisation-entered fields. These fields may contain personal information, depending on what your organisation enters. Please enter only information needed for your work.

Documents and catalogues are kept locally for offline use. Pressing the exchange button sends eligible document changes and deletion requests to the server and retrieves documents and the organisation catalogue. Changes made offline reach the server through the applicable exchange process.

Your organisation's authorised console users can view and manage records within their permissions. Devices and integrations authorised by your organisation can also receive data within their permitted scope. Disconnecting a device does not delete documents already held for the organisation or immediately erase offline copies on other devices.

5. Camera and selected photographs

Camera access is used to read product barcodes. When you choose a photograph, TallyDock decodes its barcode locally. The document-exchange format contains barcode and document data, not photographs or camera frames. The selected image is not added as a document attachment by this feature and is not sent to DeepSeek by the mobile scanner.

You can refuse camera access, cancel photo selection or change permissions in device settings. You can still search for products and enter barcodes manually. Your operating system may retrieve a selected photograph from your own photo-library cloud service.

6. Website, technical data and local storage

The public pages provide their main content as static HTML without requiring sign-in or JavaScript. A local script supports the language selector; ordinary language links remain available without it. The public page sources do not include advertising scripts, analytics scripts or external fonts. This describes our page sources, not every operation performed by the traffic-delivery provider. The console is separate: it uses its session cookie, local language preference and Google's sign-in component. A console session cookie may also accompany visits to public pages on the same host.

Our web server and traffic-delivery service process connection information to deliver and protect the service. Request logs can include the network peer address, time, method and requested address, including query parameters, response status, response size, referring page and User-Agent. Where Cloudflare proxies a request, the network peer recorded at the origin is normally a Cloudflare node; Cloudflare can separately process the connecting visitor's information.

Nginx request and error logs, application and system journals, and database error logs serve operational, security and fault-investigation purposes. Error records can contain information about a failed operation and fragments of processed data. Access to server logs is restricted. Do not put credentials, PINs or unnecessary personal information in URLs or free-text fields.

The app uses local database and preference storage for offline documents, catalogues and settings. Local storage, protected connection storage, server records and operating-system backups have separate lifecycles.

7. Purposes, roles and legal bases

Account information enables sign-in, organisation access and security. Device information enables registration, pairing, authorisation, availability status and delivery of settings. Catalogue and document information supports your organisation's stock and trade workflows. Technical records support service operation, abuse prevention and fault investigation.

Interdevelopment UAB is the controller of service-account, contact and operational-security data. We process these data to provide the service under a contract with you where you are a contracting party (GDPR Article 6(1)(b)), and otherwise for our legitimate interests in providing organisational access, maintaining a reliable service and preventing unauthorised access (Article 6(1)(f)). We process requests and retain information where necessary to meet applicable legal obligations (Article 6(1)(c)).

Camera and photo access are controlled by your choices and device permissions; declining access disables that scanning method, not manual entry. Permission to use a device feature is not treated as consent to every other operation.

Your organisation determines what personal information it puts into its catalogues and documents and why. For that content, it acts as controller and we process the content on its behalf to provide TallyDock. The organisation is responsible for its lawful basis and instructions. Account administration and service security remain distinct processing by Interdevelopment UAB.

An authorised TallyDock platform administrator may access an organisation without becoming its member to provide support, correct data and administer the service, including deleting the organisation. This does not grant access to users' Google accounts, passwords or MFA secrets. Administrative access and actions are recorded in a restricted technical audit.

8. Recipients and international processing

Recipients depend on the operation: your organisation's authorised users, devices and integrations; the service operator; infrastructure providers; Google for console sign-in; and operating-system services involved in device storage and selected photographs. DeepSeek is involved only in the optional web-console import process described in section 13. Access to organisational records is restricted by account, device or integration authorisation.

The TallyDock application server is hosted at Hetzner in Finland, within the European Economic Area. The domain uses Cloudflare Free for traffic delivery and protection. Cloudflare processes traffic passing through its network, potentially including request content as well as technical metadata. Hosting the application server in Finland does not confine all processing to Finland or to the EEA.

Cloudflare and Google operate internationally, including outside the EEA and in the United States. Cloudflare's published self-service terms incorporate its Data Processing Addendum, which provides standard contractual clauses for restricted transfers. Google describes adequacy mechanisms and standard contractual clauses in its published transfer framework. These are provider terms, not a claim that all data stays in the EU or that we have signed a separate bespoke transfer agreement.

Information processed outside Canada or Quebec is subject to the laws of the country where it is processed and may be accessible to that country’s courts, law-enforcement or national-security authorities.

Provider processing and retention also depend on the provider's applicable terms and service configuration. The origin server's log-rotation settings do not establish a retention period for Cloudflare. You can request information about applicable safeguards and retention using our privacy contact.

• Hetzner — Privacy.
• Cloudflare — Privacy.
• Cloudflare — Data Processing Addendum.
• Google — Privacy.
• Google — Data transfers.

9. Retention and deletion

Accounts, registrations and business records

TallyDock account profiles, memberships, device records, catalogues and business documents remain in the live service until removed under an applicable service workflow or a verified request. Documents have no automatic age-based expiry. An authorised user can delete an individual document through the app or console; server-side application of an offline deletion depends on the exchange process. Exchange and deletion receipts have separate lifecycles from the document itself.

There is currently no automatic expiry for device registrations and credential hashes, including registrations that were never paired or were subsequently disconnected. Uninstalling the app or disconnecting a device does not erase those server records. Applicable account or organisation deletion can remove or revoke associated device records according to ownership and connection history. A registration that was never associated with an organisation is not automatically covered by that organisation's deletion. Contact us if you need help with a registration or another record that you cannot remove through the service.

Account and organisation deletion

You can delete your TallyDock account in the console: Settings → Delete account. The console previews the affected organisations and data, requires two confirmations, a fresh Google identity check and MFA if enabled.

If you are the only owner, the affected organisation, catalogue, documents, device access, PINs and associated records within the deletion scope are erased. An organisation with another owner is retained; your account, membership and personal authentication/access records are removed. Device records with history involving other organisations are handled separately to preserve those organisations' data and access boundaries. If an erased organisation has other members, the console warns that they lose that organisation's data and access; their own accounts are retained.

All sessions of the erased account are revoked. A new Google sign-in creates a new TallyDock account and does not restore deleted data. Your Google account is not deleted. The server cannot remotely erase every offline copy on phones. An opaque technical receipt expires 24 hours after completion and is cleaned by the service; pending external file/configuration cleanup is retried, and the operation is not reported as fully complete before that cleanup finishes. Infrastructure logs and minimal administrative audit records follow their separate retention rules.

Sessions, protective counters and audits

An anonymous console sign-in session lasts 15 minutes, a pending second-factor session lasts 5 minutes and an authenticated session lasts 7 days from sign-in. Expired sessions and temporary authentication records are cleaned in limited batches.

Protective request counters use keyed hash identifiers rather than storing the original identifier in the counter key. These are protective, pseudonymous records, not a promise of anonymity. Counter records become eligible for cleanup after their window is older than one day and any block has ended. Expired or cancelled ordinary PIN records become eligible after their expiry time plus one day; consumed PIN records and pairing/disconnection repeat-request receipts become eligible after seven days from the relevant event. This device-related cleanup runs in limited batches on specific console requests, so records can remain beyond those thresholds, particularly when those requests do not occur.

Account security events become eligible for limited-batch cleanup after 90 days. The separate platform administration audit records the acting TallyDock user ID, target organisation ID, action, time, result and request ID, without PINs, credentials or document contents. Entries older than 90 days are cleaned by a background process that normally runs hourly. Minimal audit entries can remain after an organisation or account is erased until cleanup applies. Deleting an organisation administratively preserves its members' personal accounts; deleting an administrator's personal account affects organisations according to actual ownership, not merely because that administrator visited them.

Technical logs and separate copies

Nginx logs are configured for daily rotation with 14 rotated files, and database logs for weekly rotation with 10 rotated files. Rotation may skip empty files. These settings are not guaranteed 14-day or 70-day deletion deadlines for every record or copy. System and application journals are subject to systemd's storage and available-space rules, without a separately configured fixed calendar deletion period. Errors or interrupted cleanup can also delay removal. Provider-side records follow separate applicable settings and terms.

The current TallyDock application deployment has no configured service-backup procedure. This does not establish the absence or retention of independent hosting-level snapshots or operating-system copies. Local phone copies, infrastructure logs and any independently managed copies are separate from deletion in the live service. Contact us for information about retention or a deletion request affecting such records.

If you cannot use self-service deletion or have another data request, contact info@interdevelopment.eu, preferably from your account email. Identify TallyDock and the account or organisation; we may request proportionate information to verify your authority. Do not send passwords, device credentials, pairing PINs or authenticator recovery codes.

10. Your requests and choices

Depending on the law that applies, you may request access, correction, deletion, restriction or portability of personal data and object to processing. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. You may complain to the competent data-protection supervisory authority, including in your country of habitual residence, work or the alleged infringement where applicable.

Where PIPEDA applies, you may ask our Privacy Officer for access to your personal information or its correction. We provide access or explain a lawful refusal within 30 calendar days, subject to lawful extensions. We notify you of any extension within the initial period, stating the reason, new deadline and your right to complain to the Office of the Privacy Commissioner of Canada. Where Quebec’s private-sector privacy law applies, we respond to access and correction requests within 30 days. You may also request eligible computerised personal information in a structured, commonly used technological format, subject to the law’s conditions, and seek review by the Commission d’accès à l’information du Québec.

For information entered by your organisation, contact its administrator first. Self-service account deletion is available in the console settings. For other requests or help, contact info@interdevelopment.eu.

In Lithuania, the supervisory authority is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI). Contacting us first does not prevent you from complaining directly to an authority.

Where the New Zealand Privacy Act 2020 applies, you can ask for access to your personal information and request its correction by contacting our Privacy Officer. We will communicate our decision as soon as reasonably practicable and ordinarily within 20 New Zealand working days. If a lawful extension is needed, we will notify you within that period, explain the reason and give the extended timeframe. Information we agree to release will be provided without undue delay. If we decline a correction, you may ask us to attach a statement of the correction you requested. You may complain to the New Zealand Office of the Privacy Commissioner.

Where French data-protection law applies, you may give us instructions on the retention, deletion and disclosure of your personal data after your death and change or revoke those instructions. Contact our Privacy Officer to exercise this right. These instructions do not grant access to an organisation’s records or other people’s personal data.

Where Chilean personal-data law applies, contact our Privacy Officer to exercise the rights available under that law, including access, correction, erasure, objection, portability and provisional blocking where provided for. We assess the applicable conditions and time limits. Requests concerning information processed on behalf of your organisation are handled with that organisation.

11. Protection and intended use

We use HTTPS, protected device credentials, hashed server authentication tokens, access controls between organisations, request limits and optional two-factor authentication in the console. No system can guarantee absolute security. TallyDock is intended for organisational trade and stock work, not as a service directed at children.

Our Privacy Officer oversees the protection of personal information throughout its lifecycle, including access authorisation, retention and deletion, requests, complaints and incident handling. Section 9 describes our retention and deletion practices and their current limitations. To make a privacy complaint, contact our Privacy Officer at info@interdevelopment.eu and describe your concern. We record and investigate the complaint, request only information needed to assess it, communicate our findings and any corrective measures, and explain the available review or complaint routes. For information processed on an organisation’s behalf, we involve that organisation while remaining responsible for our own account and security processing.

12. Changes and language versions

We maintain this policy in English and update it when processing practices change. The effective and last-updated date appears at the top of this page. Translations may be provided separately and should identify the version they translate. The English original and any translations do not limit rights available under applicable law.

13. Catalogue import and DeepSeek

Catalogue import templates in the web console optionally use DeepSeek through api.deepseek.com to propose mapping rules. An authorised organisation user explicitly starts each model attempt after reviewing the data to be sent. Parsed files up to 24 KiB are sent in full; larger files use a bounded representative sample and structural statistics. The chosen product language, interface language, current rules during editing and optional parsing instructions are also sent. File names are not sent. Uploading data or running a saved template does not itself call the model. This is separate from local barcode recognition in the mobile app.

You can choose original values or server-side masking before transmission. Masking replaces field names, paths and nonempty values; free instructions are disabled in that mode. It can reduce accuracy and does not guarantee anonymity. DeepSeek is an external provider based in China; its processing is subject to its own applicable terms. TallyDock does not promise EU-only processing, zero retention or exclusion from model training by DeepSeek. Do not upload unnecessary personal or confidential information.

Input files, model samples and temporary previews are scheduled for cleanup after their temporary storage period, normally 24 hours, or removed earlier when cancelled or after a successful import. Cleanup runs through service workers and can be delayed by service interruption or errors. Sandbox parsing files are removed after processing. Import job receipts become eligible for cleanup after seven days. Saved templates store rules and explanations without original samples; AI accounting records retain token counts and statuses for the organisation budget. Deleting the organisation removes its import data and revokes integration keys. Integration secrets are shown once and stored only as hashes.

• DeepSeek API.
• DeepSeek Privacy Policy.

14. Product assistant and conversation history

The optional TallyDock product assistant on the website and in the console is a separate AI feature. When you send a question while replies are enabled, we send your text, a bounded recent history of that conversation, the interface language and selected public help fragments to DeepSeek at api.deepseek.com. The assistant does not retrieve your organisation's catalogue, documents or account details and cannot perform actions. Do not include passwords, access keys, PINs, personal data or confidential business information in your messages. Sending a chat question is separate from authorising AI catalogue-template generation. DeepSeek's applicable processing terms and the international-processing limitations described above also apply to this feature; we do not promise EU-only processing, no retention or no training use by that provider.

Guest conversations and their session cookie are eligible for deletion after 30 days from session creation. Console conversations are eligible for deletion after 90 days without new messages. You can delete a conversation using the assistant's delete control; an in-progress request must finish first. Deleting a TallyDock account deletes its conversations. Background cleanup can be delayed by an interruption or service error. Conversation text and hidden model reasoning are not written to diagnostic logs; hidden reasoning is not stored in chat history. Token-accounting records are separate from the transcript and can remain under the service's existing accounting rules; orphaned request-diagnostic receipts without message text are eligible for cleanup after 90 days, and aggregate emergency-budget totals have no fixed expiry.

Choosing “Continue in the console” moves only the selected guest conversation to the account after completed sign-in and organisation selection. Other conversations are retained separately. A short-lived transfer identifier is stored in this browser tab's session storage; the transcript is not placed in the URL. The assistant also uses a secure session cookie, and the selected conversation identifier may be kept in tab-local session storage. Copying selected context for an external AI is a manual action; connecting MCP does not automatically forward your chat history.