Privacy Policy

Our two roles

As a service provider to your firm: the client contact details and documents you put into BlackTally belong to your firm. Your firm decides how that data is used; we process it on your firm's behalf and under its instructions to provide the Service. If you are a client of a firm that uses BlackTally, please direct privacy requests to that firm.

As a business: we also handle information about the firms and users who sign up — for billing, support, security, and improving the Service. This policy describes both.

Information we collect

• Account & firm data: name, email, firm name, team members, and settings.
• Billing data: handled by Stripe. We receive subscription status and limited details (e.g. last-4, plan); we do not store full card numbers.
• Client data you provide: your clients' names, email addresses, phone numbers, and the documents they upload.
• Communications: reminders sent and their delivery status, inbound replies, and support messages.
• Usage & device data: log data and privacy-friendly analytics to operate and secure the Service.
• Attribution: a first-touch marketing cookie (bt_attr) and UTM parameters, to understand where signups come from.
• Marketing enquiries: if you request a free resource or run the Deadline-Risk Scan on our marketing site, we store the email address you gave us along with the answers you entered, so we can send you what you asked for.

How we use information

• Provide, maintain, and secure the Service and its features.
• Send reminders and notifications to your clients on your behalf.
• Process payments and manage subscriptions.
• Provide support and communicate about the Service.
• Send you the resource or report you requested, and a short follow-up sequence about BlackTally. Every one of those emails carries a working unsubscribe link, and unsubscribing ends them immediately.
• Detect, prevent, and address abuse, fraud, and security issues.
• Comply with legal obligations.

AI processing

Some features use AI (via Anthropic) to draft reminder messages and assist your workflow. Content sent for AI drafting is processed to generate the output and is not used to train models. The Service works with AI features disabled; the deterministic core does not depend on them.

How we share information

We do not sell your data or your clients' data, and we do not use client documents to train AI. We share data only with service providers ("sub-processors") that help us run the Service:

• Cloudflare — hosting, database (D1), and document storage (R2).
• Stripe — payment processing and billing.
• Resend — outbound and inbound email.
• Twilio — SMS reminders and inbound texts.
• Anthropic — AI drafting (no training on your data).

We may also disclose information to comply with law, enforce our terms, or protect rights and safety, and in connection with a merger or acquisition (with continued protection of your data).

Client documents

Uploaded documents are stored in Cloudflare R2, encrypted at rest, and transmitted over HTTPS/TLS. Each document is receipted (SHA-256, source channel, timestamp). No-login upload links are per-request, expiring, write-only, and rate-limited. Documents are accessible only to the firm they belong to.

Cookies & analytics

We use a small number of cookies — essential cookies for signing in, and a first-touch attribution cookie set on .blacktally.com. We use privacy-friendly analytics (Cloudflare Web Analytics) that does not use cross-site tracking cookies.

Email & SMS choices

Clients can opt out of text reminders at any time by replying STOP (and opt back in with START); we honor opt-outs and stop sending SMS to that number. Email reminders include the context of who is asking. Firms control the cadence of reminders to their clients.

Data retention & deletion

We retain firm and client data for as long as your account is active. You can export your full account as JSON and any request as a PDF at any time, and you can delete your firm and its data yourself from Settings — documents are removed from storage. After account deletion we remove data in the ordinary course, subject to limited retention required by law or for legitimate business records (e.g. billing).

Security

We use HTTPS/TLS in transit, encryption at rest, encrypted secrets, and scoped access. No system is perfectly secure, but we work to protect your data and support your own safeguards. See our Trust & security page for details.

Your rights

Depending on your location, you may have rights to access, correct, delete, or export personal data, or to object to certain processing. Firms can exercise most of these directly in the app; for others, contact us. If you are an end client of a firm, contact that firm, which controls your data.

Children

The Service is for businesses and is not directed to children under 18. We do not knowingly collect data from children.

International

We operate on Cloudflare's global network; data may be processed in the United States and other countries. We take steps to protect it consistent with this policy.

Changes & contact

We may update this policy; material changes are reflected in the "Last updated" date above. Questions or requests: support@blacktally.com.