Legal · Tally by Outpost
Data Processing Agreement
Effective November 9, 2026 · Last updated November 9, 2026
This agreement is part of the terms of use between you, the customer, and Tesseract Systems Corporation. It applies whenever Tally processes personal information about the visitors to your sites, or about your customers in the payments you connect, on your behalf. You accept it with the terms; there is nothing to sign.
01Roles and scope
For your visitors’ and your customers’ information, you are the controller and we are your processor. For your own account and billing information we are the controller, as the privacy notice explains, and this agreement doesn’t apply to it.
“Data protection law” means the EU General Data Protection Regulation, the UK GDPR and the Data Protection Act 2018, the Swiss Federal Act on Data Protection, and any other law on personal information that applies to the processing. Words such as “personal data”, “processing” and “personal data breach” have the meanings those laws give them.
02Details of the processing
| Item | Details |
|---|---|
| Subject matter | Providing Tally to you: web analytics, linking payments to visits, session replay and heatmaps when you turn them on, alerts and digests, and the API. |
| Duration | As long as your account has the site, then until the data is deleted as set out under Deletion. |
| Nature and purpose | Collecting what your pages’ tag sends, enriching it (location from the IP address, device from the user agent, the channel from the referrer), counting, storing and showing it to you; reading payments from the providers you connect and linking them to visits; recording and replaying sessions; sending the alerts you set up. |
| Data subjects | Visitors to the sites you add; your customers whose payments you connect. |
| Personal data | Visitor ids (random, or a daily hash of the IP address and user agent), visit and page view ids; pages, referrers and campaign tags; country, city and the city’s coordinates; browser, operating system, device and window width; engaged time, scroll depth, goals and the properties you send, links followed; SHA-256 hashes of email addresses (from identify calls and from payments); payment amounts, dates and the provider’s ids; session recordings with form fields masked, and click points. The IP address is used, never stored. |
| Special categories | None. You agree not to send any (see Your obligations). |
| Frequency | Continuous, while the tag is on your pages and your providers are connected. |
03What we do as your processor
- Instructions. We process the personal data only on your documented instructions: these terms and the settings you choose (the counting mode, replay and its masking, connections and alerts), unless the law requires otherwise, in which case we tell you first where the law allows. If we think an instruction breaks data protection law, we tell you.
- Confidentiality. Everyone who can reach the data for us is bound to keep it confidential, and reaches it only when needed to run, support or secure Tally.
- Security. We keep the measures under Security measures, and improve them over time without lowering their level.
- Help with requests. Taking into account what Tally is, we help you answer your visitors’ requests to exercise their rights, and with security, breach notifications, impact assessments and consulting authorities. Some of it you can do yourself: the API reads a visitor’s journey, and deleting your account deletes everything.
- Breaches. We tell you without undue delay after we become aware of a personal data breach affecting your data, with what we know and what we are doing about it, and keep you updated.
- Records and audits. We make available what you need to show that this agreement is kept, and answer reasonable written questions about it. Where the law gives you the right to an audit, we allow one on reasonable notice, at your cost, in a way that protects other customers’ data.
04Subprocessors
You authorise us to use the subprocessors below. Each is bound by written terms that protect the data at least as this agreement does, and we remain responsible for them.
| Subprocessor | What it does | Where |
|---|---|---|
| Oracle Cloud Infrastructure | Hosts Tally: the servers and databases that store your data. | United States |
| Oracle Cloud Infrastructure Email Delivery | Sends the alert and digest emails you set up (a sale alert carries the buyer’s city and device and the pages of the visit). | United States |
| Sentry (Functional Software, Inc.) | Receives reports of errors on our servers, scrubbed of keys, tokens, email addresses and long numbers, with no cookie, request body, IP address or user attached. | United States |
The payment providers and alert channels you connect act for you, not for us: what reaches them is your choice. Before we add or replace a subprocessor, we update this page and email account owners at least 30 days ahead; if you object on reasonable data protection grounds and we can’t resolve it, you may end your plan and we will refund any period paid for and not used.
05Transfers out of Europe
Tally stores and processes the data in the United States. Where data protection law requires safeguards for that transfer, the European Commission’s standard contractual clauses (module two, controller to processor, and module three, processor to processor) and the UK’s International Data Transfer Addendum apply between us and form part of this agreement, with this agreement’s details as their annexes; their optional clauses don’t apply, and the competent supervisory authority is the one for you.
06Security measures
- Less data to begin with. Visitors’ IP addresses are never stored, logged or written to disk; location stops at the city; query strings are dropped; user agents are reduced to browser, system and device; email addresses are hashed on arrival; a payment keeps no name, address or card details.
- Counting without a cookie. Cookieless and consent modes count with a hash whose daily value is deleted after two days.
- Session replay. Off by default; form fields always masked and masking applied again on our server; recordings deleted after 30 days; per-visit and per-day caps.
- Encryption. HTTPS for every request; payment provider keys, webhook secrets and alert addresses encrypted at rest (AES-256-GCM) with a key kept outside the database; passwords hashed with Argon2id; API keys stored only as hashes.
- Access. A site’s data is shown only to the members of its account; API keys are read-only and reach one site each.
- Our pages. A strict content security policy, no third-party scripts, and error reports scrubbed before they leave our servers.
07Your obligations
You are responsible for having a lawful basis for the processing, for telling your visitors about it, and for asking their consent where the law requires (consent mode and replay’s settings are there for it). You don’t send special categories of personal data, passwords or payment card numbers to Tally, and you mask or block the pages and elements where people enter or read such things.
08Deletion
Deleting your account deletes the personal data Tally holds for its sites: their records in our main database at once, and their analytics and recordings by a job that runs right after. Some data is deleted sooner on its own: recordings after 30 days, heatmap click points after 90, the daily hashing value after two, and webhook messages with customer details once processed. Before you delete anything, you can read your data out through the API.
09Liability and precedence
Each party’s liability under this agreement is subject to the limits in the terms, except where data protection law doesn’t allow them. If this agreement and the terms disagree about personal data, this agreement wins; if the standard contractual clauses apply and disagree with either, the clauses win.
10How long it lasts
This agreement lasts as long as we process personal data for you under the terms, and its obligations on deletion and confidentiality continue until the data is gone.
11Changes
We may update this agreement, for example when we add a subprocessor or the law changes. We change the date above, and for significant changes we email account owners at least 30 days before they take effect. A change never lowers the protection of data we already hold.