1. Who we are
Tallify is a software product of BlueBird Digital (Pty) Ltd (registration number 2020/844054/07), 479 Kincardine Estate, 156 Zinnia Road, Kyalami, Gauteng, 2196, South Africa ("we", "us"). Our Information Officer is Michael Warren Eales, reachable at michael@tallify.co.za.
2. Two kinds of personal information
Website visitors. This website collects no personal information beyond what your browser sends to load a page (IP address and request logs held by our hosting provider for security) and what you type into the free trial form (your name, practice name, FSP number, work email and the system your practice uses now), which we use only to arrange the call and the trial. The pages load their fonts from Google Fonts, so your browser also asks Google's servers for them. We advertise Tallify with Google Ads, so every page loads Google's advertising tag (Google tag, gtag.js): it sets Google cookies that tell us which ads lead to a visit and to a free trial sign-up, and Google receives your IP address, your browser's details and the pages you visit. When you send the trial form we tell Google only that a sign-up happened, never what you typed. Google handles that information under its own privacy policy (policies.google.com/privacy); you can turn off personalised ads at adssettings.google.com or block the cookies in your browser, and the site works the same without them. We do not use embedded social media.
Practice deployments. Tallify is installed either on infrastructure controlled by the financial services provider ("the practice") that licenses it, or, where the practice chooses, as a separate installation of its own (its own database, documents, backups, services, settings and sign-in) on a server in South Africa that we operate ("hosted by Tallify"). That server can also run other installations; no installation shares its database, documents, backups or sign-in with another. In both cases client personal information processed inside a deployment is processed by the practice as responsible party. On a practice's own infrastructure we have no access to that information unless the practice specifically requests support and grants access for that purpose. For a hosted deployment we act as the practice's operator under a written operator agreement, only on its instructions, and we keep the installation, its backups and its logs in South Africa.
3. What a Tallify deployment processes
Within a practice deployment, the software processes client information the practice already holds or captures: identity and contact details, financial position, insurance cover, investment holdings, advice records and communication history. This information stays on the practice's installation: on a server the practice controls or, for a practice hosted by Tallify, on the installation we run for it in South Africa. Clients also give information to a deployment directly, in the ways below.
The onboarding link. A practice can send a client a personal link to its client pages. Only a fingerprint (hash) of the link is stored, and the link expires after 30 days unless the practice sets another period, or sooner if the practice sends a newer one. Through the link the client signs the practice's disclosure letter, completes the fact find and sends a copy of their ID and proof of address.
The online fact find. The answers a client types, through the link or through the practice's public sign-up page, are kept on the installation as the practice's record, with a copy of the practice's fact-find spreadsheet filled in from them. An adviser reviews them before they are added to the client's record.
The electronic signature record. Before a client signs the disclosure letter online, a one-time code is emailed to the address on the practice's record. The deployment then keeps the signed letter with a record of the signing on its last page: the name and ID number signed with, how the link reached the client (emailed by the practice, or copied by the adviser and passed on), the address the code went to, when the completed letter was shown and when it was signed (in South African time and in UTC), the IP address and browser used, how the signature was made (drawn, typed, or a picture uploaded), the words the client ticked to accept, and SHA-256 fingerprints (hashes) of the blank letter and of the completed letter. A fingerprint of the final signed file is kept with the record. The client can download a copy at once and is emailed one. The practice keeps the signed letter, never a separate copy of the signature.
ID and proof of address. A photo or PDF the client sends through the link is filed with the client's documents under identity and FICA. These files are not sent to any language model.
Client messages. A WhatsApp message or email a client sends to the practice is kept with the client's record. A reply may be drafted for the adviser from a de-identified copy (section 4), and nothing is sent until a person at the practice approves it (section 5). A fact find or other document a client sends this way can become an intake for the adviser to review.
4. Use of external processing
No identifiable data leaves the practice. A deployment uses Claude, a language model from Anthropic PBC, to read de-identified facts and draft advice documents, client communications and the adviser's weekly cover briefing, and to read the free-text answers of a fact find that the installation's rules could not read, after identity is removed (a practice may choose rules only). Before any request to Anthropic, code on the practice's installation removes names, identity numbers, dates of birth, contact details and addresses, and scrubs those values from free text. A check then looks for identity once more and stops any request that still carries it. Anthropic receives figures and circumstances, not an identifiable person, under commercial terms that exclude training on the data, and names are put back on the practice's installation. These de-identified requests may be processed outside South Africa. The practice is responsible for naming Anthropic in its own POPIA processing records.
Language models that run on the practice's installation itself build the search index, check free text for names before anything is sent to Anthropic, read an Astute CCP report the adviser uploads, and read the assisted channel (photos, PDFs, Word documents and typed notes sent over WhatsApp or uploaded in the console). They run on the installation and send nothing out, and the adviser must check every figure read through the assisted channel before it is committed. The onboarding fact find does not depend on them. A graphics card is needed only for the assisted channel; without a model running, the names check and the CCP reader fall back to code, and a draft goes ahead on the code's own removal of identity and the check above.
Other third parties in the path of a deployment, each named so that a practice can list them:
- Twilio Inc. and Meta Platforms (WhatsApp) carry all WhatsApp messages to and from the practice's number, including notes advisers send in, messages from clients, and every message a deployment sends from it, such as the replies and notices the practice approves and the messages that go at once (section 5). They see the message and the phone numbers. A practice that connects its own WhatsApp Business number uses Meta directly; otherwise the number is one Tallify runs through Twilio.
- GoDaddy Operating Company, LLC carries all the email a deployment sends and receives through Tallify's mailboxes (such as advice@tallify.co.za, which the deployment reads over IMAP) and through a practice's or adviser's mailbox hosted at GoDaddy, including email to and from clients (the onboarding pack, signing codes, signed copies and receipts, and every notice and reply the practice approves), drafts and notifications to advisers, sign-in codes and email approvals. It sees the emails sent and received, with attachments. Mail through a practice mailbox at another provider (such as Google Workspace or Microsoft 365) is carried by that provider instead.
- Cloudflare, Inc., for a hosted deployment reachable over the internet, runs the tunnel to the server and the DNS, and its network terminates the encrypted connection (TLS) and re-encrypts it on the way to the server. The console and client pages of that deployment pass through Cloudflare's network in transit; Cloudflare does not store their content. A deployment reached only over a private network does not send its traffic through Cloudflare.
- Tailscale Inc. provides the private network used to reach consoles that are not on the public internet, and relays incoming WhatsApp webhooks to the server. Traffic stays encrypted end to end, so Tailscale sees network metadata, not content.
The full list, with what each party sees, is in clause 6.3 of our terms of use.
5. Client communications and consent
A deployment sends communications the practice starts (fund alerts, birthday greetings, review reminders, market updates and similar notices) only to clients whose consent to receive them has been recorded by the practice. Advice documents, and every message drafted for a client (including a reply to a message the client sent), wait until a person at the practice has approved them. A practice may choose to let a kind of WhatsApp notice, such as a birthday greeting, go without approval; none does by default. The practice's templated emails (the onboarding pack, the review sheet, the client's copy of the signed letter, a note that a fact find or document has arrived, the welcome email) wait for a person's approval too. The only message that goes at once is the one-time signing code. Clients may withdraw consent at any time by contacting their practice; once the practice records the withdrawal, no new notice and no WhatsApp reply is drafted for them, and anything already waiting is not sent.
6. Retention
Practices retain advice records for the period required by the FAIS Act and the General Code of Conduct (currently five years from the date of the advice). Backups are retained by the practice under its own policy. This website retains hosting logs for no more than 90 days.
7. Security
A practice's console is reached over a private network or, for a hosted practice, over the internet behind the Tallify sign-in. Logins are authenticated and role-based, failed attempts are rate limited, and a practice can require a sign-in code sent by email. Every change is recorded in an audit log, and transport is encrypted. The client pages need no login: the onboarding link is personal and expires, signing the letter needs a one-time code sent to the client's email, and the public sign-up page is rate limited. On the server we operate for hosted practices, client data and its backups sit on an encrypted volume. On a practice's own server, backups are encrypted at rest where its infrastructure supports it.
8. Your rights
Under POPIA you may request access to, correction of, or deletion of personal information held about you, and you may object to processing or lodge a complaint with the Information Regulator (inforegulator.org.za). For information held by a practice using Tallify, direct your request to that practice. For this website, contact our Information Officer at the address above.
9. Changes
We will post any changes to this policy on this page with a new effective date.