Legal
Privacy Policy
Last updated: October 1, 2026
This Privacy Policy explains how COSTTRAIL INC (“we”, “us”) handles information when you use Tally2BI, including the website at tally2bi.com, the Tally2BI web application and the Tally2BI Bridge for Windows (together, the “Service”).
1. The short version
- Your Tally books stay on your computer. The Bridge stores a copy of your Tally data (ledgers, vouchers, balances, stock) in a local database on the computer where it is installed. Reports are computed there and read by your browser directly. We do not receive, store or process this accounting data on our servers.
- When you ask a question in plain English, the text of the question is sent to us so we can identify which report you mean.
- We do not sell personal information and we do not use your data to train AI models.
2. Who is responsible
For personal information about you as an account holder, COSTTRAIL INC is the data controller. Questions, access requests or complaints: support@costtrail.io. Mailing address: COSTTRAIL INC, 1900 Pleasant Street, Noblesville, Indiana 46061-0813, USA.
3. Information we collect
| Category | Examples | Source |
|---|---|---|
| Account information | name, email, company (optional), password (stored only as a salted hash by Amazon Cognito) | You, during sign-up |
| Authentication and session | session tokens, IP address, user-agent, sign-in timestamps | Automatically on use |
| Questions you ask | the text of plain-English questions and the report we matched them to, kept as your chat history | You |
| Saved settings | saved views and schedules (report names, filters, company names), paired-device records (device id, computer name, Bridge version) | You; the Bridge |
| Billing information | token purchases, invoices, billing country; card details are handled by our payment partner | You; Lemon Squeezy |
| Product telemetry | tokens consumed, feature usage counts, error logs, timings | Automatically on use |
| Support communications | messages you send through the contact form or by email | You |
Information that stays on your computer and is not collected by us: your Tally company data and the local Bridge database, the device key the Bridge generates, and Bridge log files (unless you choose to send them to us for support).
4. How we use information
- Provide, maintain and secure the Service and your account.
- Interpret your questions and return the matching report, using your recent questions as context.
- Meter token usage, process purchases, and send transactional emails (verification codes, password resets, receipts).
- Detect and prevent fraud, abuse and security incidents.
- Improve reliability and performance using aggregated, de-identified metrics.
5. Legal bases
- Contract: to deliver the Service you signed up for.
- Legitimate interests: security, fraud prevention and service improvement, balanced against your rights.
- Legal obligation: tax, accounting and responding to lawful requests.
- Consent: optional communications, which you can withdraw at any time.
6. AI processing
To understand questions, we use large language models hosted on Amazon Bedrock (Anthropic Claude family). Only the question text and your recent question history are sent — never your accounting data. Providers process requests on an inference-only basis under terms that prohibit using them to train models. We do not train models on your data.
7. Who we share information with
- Amazon Web Services (US) — hosting, databases, sign-in (Amazon Cognito), email (Amazon SES) and AI inference (Amazon Bedrock).
- Lemon Squeezy (US) — our payment partner and merchant of record for token purchases.
- Professional advisors — legal, accounting and audit firms, under confidentiality.
- Authorities — when required by law or to protect rights, safety or property.
We do not sell personal information and we do not share it for cross-context behavioural advertising.
8. International transfers
The Service is hosted in the United States. If you use it from outside the US, the limited personal information described above is transferred to and processed in the US, with appropriate safeguards where required.
9. Retention
We keep account information for the life of your account and a reasonable period afterwards for legal, tax and audit purposes. Question history, saved views and device records are deleted when you delete them or close your account. Token usage and billing records are retained for up to 7 years. Data on your own computer stays under your control — uninstalling the Bridge and deleting its data folder removes it.
10. Security
We use TLS 1.2+ in transit, encryption at rest, least-privilege access, audit logging and monitoring. The Bridge listens only on your own computer and signs its responses with a per-device key. No method of transmission or storage is perfectly secure; we will notify affected customers of a confirmed incident without undue delay.
11. Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, port your data, and withdraw consent. California residents have additional rights under the CCPA/CPRA. To exercise any right, email support@costtrail.io. We respond within the timeframes required by law.
12. Children
The Service is not directed to children under 16, and we do not knowingly collect their personal information.
13. Cookies
We use strictly necessary cookies and browser storage to keep you signed in and remember preferences such as light or dark mode. We do not use advertising cookies.
14. Changes
We may update this Policy. Material changes will be posted here with a new “Last updated” date and, where appropriate, communicated by email or in-product notice.
15. Contact
COSTTRAIL INC, 1900 Pleasant Street, Noblesville, Indiana 46061-0813, USA. Privacy: support@costtrail.io.