Privacy Policy

Effective date: July 2, 2026 | Last updated: October 4, 2026

Software Development Services, LLC ("we," "us," or "our") operates the TallyTill autonomous checkout platform. This Privacy Policy explains how we collect, use, and protect information when merchants and their customers use TallyTill-powered kiosks and the TallyTill mobile/web application, and when anyone visits our website (collectively, the "Service").

1. Who This Policy Covers

This policy applies to:

Merchants — businesses that register a TallyTill account and deploy the Service at their location.
Shoppers — customers who interact with a TallyTill kiosk to browse and purchase items.
Website visitors — anyone who browses tallytill.com, whether or not they have an account.

We make the Service available to merchants in the countries offered to them during registration. TallyTill is operated from the United States, and the information described in this policy is stored and processed on servers in the United States. If you use the Service from outside the United States, your information is transferred to and processed in the United States. The regional rights section below sets out the additional rights that apply depending on where you are.

2. Information We Collect

From Merchants (account holders):

Name and email address (used for account creation, receipts, and support).
Business name and optional branding assets (logo, colors).
Payment configuration — the merchant's connected payment-provider account (e.g., a Stripe account identifier) used to process card and Cash App Pay transactions, plus any optional payment handles the merchant chooses to enable. We do not store raw card numbers or bank credentials.
Device identifiers for kiosk registration.

From Shoppers (at the point of sale):

Cart and transaction data — items selected, quantities, prices, and totals.
Receipt email address, if a shopper voluntarily requests an email receipt.
Cart photos — images captured by the kiosk camera during checkout events (for example when an item is scanned or selected, when a cart is abandoned, or when the cash drawer is opened without a sale). These are pictures of whatever is in front of the camera, which often includes the shopper. They are stored with the transaction session.
ID-check records — only where a merchant sells age-restricted items and has turned ID checks on. The birth date and expiry are read from the ID's barcode in the device's own browser; those values themselves are never sent to us and never stored. What is recorded with the sale is that a check happened, when, and the role of the staff member who did it. See the next item for the separate setting that stores a photograph.
Photographs of an ID — only where the merchant has additionally turned on "Keep a Picture of the ID", which is off unless they choose it. Where it is on, the till stores a photograph of the ID with the sale, alongside a photograph of the person at the counter. Be aware of what that image contains: the barcode on a driver's licence encodes the holder's name, date of birth, address and licence number. Retention for these images is described in Section 8.
Voice input — if the merchant enables the optional voice assistant, shopper speech captured by the device microphone during a voice interaction (see Section 5).

From website visitors (tallytill.com):

IP address: we record the IP address your request came from. We use it to understand where traffic originates, to tell one visitor's activity apart from another's, and to identify automated traffic and attempts to probe or attack the site. We do not use it to build advertising profiles, and we do not sell it.
The page requested, the referring website (reduced to its domain), and any campaign tags in the link you followed (for example, the utm_source in an advertisement link).
A coarse device category inferred from your browser's user-agent — desktop, mobile, tablet, or automated bot. We do not store the user-agent itself.
A rotating, one-way identifier used to count unique visitors. It is derived from your IP address and browser using a secret that changes every day, so it cannot be reversed and cannot be matched to you across different days.
Our own cookies: we set two first-party cookies, tt_attr and tt_src, which record how you first arrived (the advertisement, campaign, or referring site). They last 30 days, are readable only by our server, and exist so we can tell which marketing efforts work.
Third-party analytics and advertising: our website loads Google Analytics 4 and the Meta (Facebook) advertising pixel. These are operated by Google and Meta, set their own cookies, and receive your IP address, the pages you view, and the actions you take on our site. We use them to measure our advertising. See Section 6 for what this means for your data, and Section 9 if you are a California resident.
Session recordings and heatmaps: our marketing website uses Microsoft Clarity, operated by Microsoft. It records how you use our public pages, such as clicks, scrolls, and mouse movement, and can replay a visit; sensitive text such as form entries is masked by default. It sets its own cookies and receives your IP address and the pages you view. We use it to see where visitors get stuck and to improve the site. It runs on our public marketing pages only, not on signed-in account pages or on merchant kiosks.
Videos: on our home and features pages, videos are YouTube embeds in YouTube's privacy-enhanced mode (youtube-nocookie.com) that load only when you open or play them, by pressing play or "See it" on a card that has a video; until you do, your browser makes no request to YouTube. Videos inside our guide articles load from YouTube's privacy-enhanced domain when they scroll into view. Either way, once a video loads, YouTube receives your IP address and may set its own storage under its own privacy policy.

Automatically collected:

Device identifiers and basic usage telemetry to support diagnostics and improve the Service.
Camera frames used for product identification. Barcodes and QR codes are read on the device; when a merchant uses AI-assisted identification, a captured frame is transmitted to our servers and our AI vision provider for analysis (see Section 5).
Device location (GPS): the approximate or precise geographic coordinates of the kiosk at the time a sale is recorded. Location is attached to the transaction record and used solely for transaction audit, fraud prevention, and to validate or resolve payment disputes. It is not used for advertising or shopper tracking.

3. How We Use Your Information

To authenticate merchant accounts and deliver the Service.
To identify products in the camera field of view and add them to the shopper's cart.
To present payment options and generate QR codes for card, Cash App Pay, and any other payment methods the merchant has enabled.
To operate the optional voice assistant that answers shopper questions.
To send email receipts requested by shoppers, via Azure Communication Services.
To provide merchants with sales reports, transaction history, and reconciliation tools.
To detect and prevent fraud and to investigate or resolve payment disputes (including using the recorded transaction location).
To communicate with merchants about their account, billing, and Service updates.
To measure website traffic, understand which marketing brings visitors to us, and detect automated traffic and attempts to probe or attack the site.

4. Payments

Card and Cash App Pay transactions are processed by our third-party payment provider (Stripe) through the merchant's connected account. Full payment card numbers, bank account numbers, and wallet credentials are handled directly by the payment provider under its PCI-compliant systems — TallyTill does not receive or store them. A platform fee is applied to processed transactions. Cash and check payments are handled directly between the shopper and the merchant.

5. Artificial Intelligence, Camera, and Voice Data

TallyTill uses AI for product identification and, optionally, a voice assistant:

Barcode & QR scanning (on-device): Barcodes and QR codes are detected locally on the device and are not transmitted.
AI product identification (cloud): When a merchant uses the "Identify with AI" action, a captured camera frame is transmitted to our servers and to our AI vision provider (Microsoft Azure OpenAI) to identify the product. Frames are processed to return a result and are not used to train third-party models under our providers' default terms.
Voice assistant (optional, microphone): When a merchant enables the voice assistant, shopper speech is transcribed and the text is sent to our servers and to Anthropic (to generate a reply) and Microsoft Azure (to synthesize the spoken response). Transcription is performed by the device's browser or operating system, which may send the audio to its vendor's own speech-recognition service (for example, Google's, on Chrome or Android devices) and process it under that vendor's privacy policy. Voice audio and transcripts are processed transiently to answer the question and are not retained for advertising.

Cart photos captured during a shopping session are stored on the merchant's device and, if the merchant has enabled cloud sync, uploaded to our servers and associated with the transaction record for that session.

6. Data Sharing

We do not sell, rent, or trade personal information. We may share information only with:

Service providers: Stripe (payment processing), Microsoft Azure (hosting, AI product identification, speech synthesis, email delivery), and Anthropic (voice-assistant replies). These providers receive only the data necessary to perform their services and are bound by appropriate data-processing agreements.
Website analytics and advertising: Google (Google Analytics 4), Meta (the Facebook advertising pixel), and Microsoft (Clarity session recordings and heatmaps) receive website-visitor information — including IP address, pages viewed, and referring links — when you browse tallytill.com. This applies to our marketing website only; it is not present on merchant kiosks, and it is not present on signed-in account pages. These companies use that data under their own privacy policies, and Meta may use it to measure and target advertising.
Legal compliance: If required by law, court order, or government request, or to protect the rights, property, or safety of TallyTill, its merchants, or others.

You can limit this by using your browser's tracking protection or an ad blocker, or through Google's and Meta's own advertising controls.

7. Text Messaging (SMS) Receipts

Where SMS receipts are available, a shopper may choose to receive a one-time text message containing the receipt for their purchase. SMS receipts are strictly optional and are never a condition of purchase or of using the Service: the shopper must enter their own mobile number at checkout and give express consent by ticking a standalone, unchecked consent box before any text is sent. Message and data rates may apply. Reply STOP to opt out or HELP for help; STOP requests are honored automatically.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are not shared with any third parties. TallyTill uses the mobile number solely to deliver the requested receipt (and, for pending payments, a confirmation of that same transaction) and does not use it to market to shoppers. As with other receipt contact details, the merchant the shopper bought from can see the contact information entered at its own checkout and handles it under its own privacy policy.

8. Data Retention

Transaction records and account information are retained indefinitely until the merchant deletes their account or requests deletion of specific records by contacting us at privacy@tallytill.com. Merchant accounts and all associated data are purged upon confirmed account deletion.

Cart photos are deleted automatically after 90 days by default. A merchant on a paid plan may set a shorter or a longer period. On the free Stand plan 90 days is a maximum they cannot raise. Photos attached to a transaction the merchant has marked disputed are held while it stays disputed, again subject to the Stand maximum.

Photographs of an ID are the exception: they are not deleted on a schedule. They exist to be produced later if someone asks whether a check took place, so evidence that quietly expires would defeat the purpose. They are removed when the merchant's account is deleted, or sooner if the merchant or the ID holder asks us to delete specific records at the address above.

Shopper receipt email addresses are retained only for the duration needed to deliver the email and are not stored beyond that transaction. Voice audio and transcripts are not retained beyond the interaction.

Website-visit records — including the visitor IP address described in Section 2 — are deleted automatically on a rolling schedule. The retention window is 365 days by default; records older than the window are purged by an automated nightly job. Data held by Google and Meta is retained under their own policies, not ours.

9. Your Regional Privacy Rights

This policy applies wherever you are. The rights below depend on your region and apply in addition to the rest of this policy.

California (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

Right to Know: You may request a summary of the categories and specific pieces of personal information we have collected about you.
Right to Delete: You may request deletion of personal information we hold about you, subject to certain exceptions.
Right to Opt-Out of Sale: We do not sell personal information. No opt-out mechanism is required, but you may still contact us to confirm.
Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA right.

To submit a request, email privacy@tallytill.com with the subject line "California Privacy Request." We will respond within 45 days.

United Kingdom and European Economic Area (UK GDPR and EU GDPR)

If you are in the United Kingdom or the European Economic Area, you have the following rights over personal data we hold about you:

Access: You may ask for a copy of the personal data we hold about you.
Rectification: You may ask us to correct personal data that is inaccurate or incomplete.
Erasure: You may ask us to delete personal data we hold about you, subject to certain exceptions.
Restriction and objection: You may ask us to limit how we use your personal data, or object to a particular use.
Portability: You may ask for the personal data you provided to us in a machine-readable form.
Complaint: You may complain to your national data protection authority. In the United Kingdom that is the Information Commissioner's Office (ico.org.uk).

As described in Section 1, we operate from the United States and your personal data is transferred to and processed there.

To exercise any of these rights, email privacy@tallytill.com with the subject line "Data Protection Request." We will respond within one month.

10. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it promptly.

11. Security

We use industry-standard technical and organizational measures (TLS in transit, AES-256 encryption at rest for credentials) to protect information. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top. For material changes, we will notify merchants via email. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

For privacy questions, data requests, or to exercise your rights:

Email: privacy@tallytill.com
Mail: Software Development Services, LLC, 360 Central Avenue, Suite 800, St. Petersburg, FL 33701