Privacy notice

A. Information You Provide to Us

• Account Registration Data: name, business email address, job title, corporate telephone number, organization name, and password credentials created during sign-up.
• Billing and Administrative Data: corporate billing address, payment details, tax identifiers, and billing contact information processed through our third-party payment processors.
• Customer Support and Communications: the content of messages, feedback, support tickets, and correspondence you send to us.

B. Customer Data Uploaded to the Platform (Processor Context) When a Customer uploads records to the Service for financial reconciliation, we process files that may contain personal information regarding Customer’s employees and plan participants, including:

• Enrollment Records: employee names, identification numbers, coverage tier, enrollment dates, and benefit election choices.
• Payroll Registers: employee identifiers, payroll period details, and benefit deduction amounts.
• Carrier Billing Statements: billing line items, coverage status, and premium cost allocations.

Important note on health data. Customer Data must not contain Protected Health Information (PHI) unless a fully executed Business Associate Agreement (“BAA”) is in force between Customer and the Company. Where a BAA is executed, PHI handling is governed by the BAA and by HIPAA.

C. Information Collected Automatically

• Log and Usage Data: IP address, browser type, operating system, hardware characteristics, referring URLs, pages viewed, time spent, clickstream data, and timestamps.
• Security and Verification Audit Logs: server-side records capturing sign-in events, checkbox acceptance states, permission changes, and API calls.
• Cookies and Tracking Technologies: essential session cookies and functional tokens required to keep you authenticated, secure your tenant, and retain workflow preferences.

The public website at tallyvant.com sets no cookies, runs no analytics, carries no advertising pixel and loads no third-party tag; both of its typefaces are served from the site itself. The session cookies described above belong to the authenticated platform, which is a separate deployment.

Subprocessors and Service Providers. We share data with third-party vendors who assist us in operating the platform, including cloud infrastructure hosting, database management, billing processing, and security monitoring. The public website is hosted by Vercel. All subprocessors are bound by written data processing addenda providing equivalent privacy controls, and a current list is available on request.

Customer Administrators. If your account was provisioned by your employer or broker, account administrators within that organization can access your profile, user logs, and workspace activity.

Legal Obligations and Safety. We may disclose information where required by law, court order, subpoena, or government regulation, or where we believe in good faith that disclosure is necessary to protect our legal rights, investigate fraud, or defend against legal claims.

Corporate Transactions. If we are involved in a merger, acquisition, corporate reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to standard confidentiality protections.

Account and Billing Records. Retained for the duration of Customer’s active subscription plus seven (7) years following termination, to satisfy tax, accounting, and legal audit obligations.

Customer Data (Reconciliation Files). On contract termination or workspace deletion, Customer Data is available for export for thirty (30) days. After that window it is permanently deleted or de-identified within sixty (60) days, except for residual backup copies, which are overwritten on a standard thirty-day rotation.

Verification and Acceptance Logs. Audit records documenting Terms acceptance, IP addresses, and authority representations are retained for six (6) years following account closure, to defend against contract disputes and statutory claims.

Encryption. Data is encrypted in transit using Transport Layer Security, and at rest using AES-256 encryption across database backends. Database backups are encrypted with AES-256-GCM using a key supplied by the operator.

Tenant Isolation. The platform enforces row-level security in the database together with least-privilege grants, so that no Customer can read or reach another Customer’s data. The application requires a TLS-verified database connection and fails to start rather than falling back to an unverified one.

Access Control. Internal access to production data is restricted on the principle of least privilege and requires multi-factor authentication.

What is implemented, and what is deliberately not claimed, is set out in full on our security page. The Company holds no SOC 2 report, no HIPAA attestation and no independent third-party security audit, and the product is pre-production.

A. California residents (CCPA / CPRA). If you reside in California, you have the right to:

• Know and access: request details about the categories and specific pieces of personal information we have collected about you.
• Delete: request erasure of your personal information, subject to statutory retention exceptions.
• Correct: request correction of inaccurate personal information.
• Non-discrimination: we will not discriminate against you for exercising your privacy rights.

Service provider affirmation. Under the California Consumer Privacy Act, the Company acts as a Service Provider with respect to Customer Data. We do not “sell” or “share” Customer Data, and we do not retain, use, or disclose it outside the direct business relationship established by our Terms of Use.

B. UK, EU and Australian residents. If you are located in the European Economic Area, the United Kingdom, or Australia, you have rights under the GDPR, UK GDPR, or Privacy Act 1988, including access, rectification, erasure, restriction of processing, data portability, and the right to lodge a complaint with your local Data Protection Authority.

To exercise any of these rights, email privacy@tallyvant.com. If your request relates to data contained in a file uploaded by your employer, we will forward it to that employer, which is the controller of that data.

The Company is headquartered in the United States and operates global infrastructure. Personal information collected globally may be transferred to, stored, and processed in the United States, Canada, or other jurisdictions where our cloud service providers maintain servers. We put appropriate safeguards in place for those transfers, such as Standard Contractual Clauses or equivalent contractual transfer mechanisms.

We may update this Notice to reflect changes in legal requirements, operational practices, or platform features. Where changes are material, we will notify registered account administrators by email or by prominent platform notice at least thirty (30) days before the effective date, and update the effective date at the top of this document.

• CPvL Enterprise, Inc.
• Attn: Data Privacy Officer / Legal Department
• Privacy requests: privacy@tallyvant.com
• Legal enquiries: legal@tallyvant.com

A registered postal address for service has not yet been published here. A reviewed version of this Notice should state one.