GDPR
Data privacy
Last updated 4 September 2026
Controller
Maximilian Leodolter
Austraße 31
2542 Kottingbrunn
Austria
Email: hello@tallyman.io
This notice describes how we process personal data on https://tallyman.io and in the tallyman product. Public signup is disabled; workspace accounts are created after a sales conversation.
What we process
- Demo requests: name, work email, company, optional message, and the time you submit the form. If you then book a slot, Calendly also processes the name and email you enter there.
- Accounts: name, email, optional job title and department, password hash (we never store a plaintext password), organization membership, and role.
- Workspace content: campaign briefs, suggested phrases, post copy, destination URLs, unique tracking codes, and files you upload (images, PDFs, or similar campaign assets).
- Visit events: when someone opens a unique tallyman link we store the post it belongs to, the time, and the HTTP referrer if the browser sends one. We do not store the visitor’s IP address in the product database. We do not ingest LinkedIn, X, or other social-network engagement.
- Emails we send: set-password and reset links, workspace invitations, and internal copies of demo requests to hello@tallyman.io.
Legal bases (Art. 6 GDPR)
- Contract (Art. 6(1)(b)): creating and operating a workspace, authentication, unique links, and visit counts.
- Legitimate interests (Art. 6(1)(f)): answering demo requests, securing the service, and keeping essential session cookies working. Our interest is to run and sell a B2B product; you can object at hello@tallyman.io.
- Consent (Art. 6(1)(a)): PostHog EU and Google Analytics, only after you accept cookies. You can withdraw that consent at any time via Cookie settings in the footer.
Processors and other recipients
We use other companies to run the product. They process data on our instructions, except where they act as independent controllers (noted below).
- Vercel Inc. — hosting, application logs, and Blob object storage for campaign files. Uploaded assets receive a public URL.
- Turso — libSQL database for accounts, workspaces, campaigns, posts, and visits.
- Plunk — transactional email delivery.
- PostHog EU — product analytics, only with cookie consent.
- Google Ireland / Google LLC — Google Analytics, only with cookie consent.
- Calendly — demo scheduling if you open the calendar embed. Calendly’s own privacy notice applies to that booking.
Some of these providers are in the United States or otherwise outside Austria / the EEA. Where that is the case, transfers rely on an adequacy decision or Standard Contractual Clauses, plus the provider’s own safeguards.
Retention
Workspace data stays until the customer asks us to delete the workspace or we terminate the account. Visit events stay with the related post. Demo-request emails are kept as ordinary business correspondence. Analytics data follows the retention set in PostHog and Google Analytics. Server logs on Vercel are kept according to Vercel’s platform defaults.
Your rights
You may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. Where we rely on consent, you may withdraw it without affecting processing that already took place. Email hello@tallyman.io.
You can also lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, dsb.gv.at.
No automated decisions
We do not make solely automated decisions that produce legal or similarly significant effects (Art. 22 GDPR).
Related documents
Product use is also described in our Terms. The operator details are on the Imprint.
This is an operator draft for tallyman.io, not legal advice and not a substitute for counsel-reviewed terms.