Pointer

Pointer

Privacy Policy

As of 18 October 2026

Version 1.4

Applies to users in the United Kingdom only

1. About This Policy

This Privacy Policy explains how Tally Labs (UK) Limited ("Pointer", "we", "us", or "our") collects, uses, stores, shares, and protects personal and business data when you use the Pointer mobile application and associated Services.

Pointer is committed to handling your data lawfully, fairly, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where we act as a data controller, we are responsible for your personal data. Where we act as a data processor on your behalf (for example, storing your customers' data that you input), you are the data controller.

Please read this policy carefully. By using the Services, you acknowledge that you have read and understood it.

2. Who We Are

Tally Labs (UK) Limited is the data controller for personal data collected in connection with your account and use of the Services.

Contact: info@pointerapp.co.

3. Data We Collect

3.1 Data You Provide Directly

  • Account registration data: name and email address from your sign-in (Google, Apple, or email), plus business name, business type, and address when you provide them during setup. We do not collect a mobile number as part of account registration
  • Business financial data: income and expense records, invoices, receipts, and related documents you upload or enter
  • Photos and files you capture or select (for example receipt images stored in our cloud storage)
  • Transaction and balance data imported when you connect a bank or payment account
  • Tax information you enter when you use tax or Making Tax Digital features (for example Unique Taxpayer Reference, National Insurance number, and VAT details)
  • Operational data you create when those features are available to you, such as inventory, orders, customer or supplier records, bookings, and staff details
  • Contact form details: email address, any name you provide, and your message, if you write to us through the website

3.2 Data Generated by Your Use of the Services

  • Usage data: how you interact with app features, session frequency, and feature engagement
  • Device and app data: device type, operating system version, app version, and device identifiers used to deliver notifications and protect the account (including Firebase Cloud Messaging tokens and App Check attestation). These identifiers are linked to your account; they are not anonymised
  • Log data: error logs, performance data, and diagnostic information
  • AI model inputs and outputs: receipt images, transaction text, and other business data sent to our AI processors to extract records and generate insights

3.3 Data Received from Third Parties

  • Transaction and balance data retrieved from Connected Accounts (bank and payment accounts you authorise)
  • Name, email address, and a provider user identifier from Google or Apple when you sign in with those services
  • Subscription and payment status from Apple when you subscribe on iPhone or iPad, and from Stripe when you subscribe on another platform

4. How We Use Your Data

4.1 To Provide and Operate the Services

We use your data to:

  • Create and manage your account
  • Provide bookkeeping, performance tracking, bank connections, and receipt capture, and, where those features are available to you, tax tools, inventory, POS, time management, orders, and bookings
  • Retrieve and process transaction data via Connected Accounts
  • Generate AI insights and recommendations based on your business data
  • Communicate with you about the Services, updates, and support matters

Legal basis: Performance of a contract with you (UK GDPR Article 6(1)(b)).

4.2 To Improve and Develop the Services

We use aggregated and anonymised data — including usage data and AI model interactions — to understand how the Services are used and to develop new features. Where possible, we anonymise this data so it cannot be linked back to you as an individual.

We use automated processing and machine learning models to extract information (for example from a receipt photo) and to deliver personalised financial insights. Receipt images and relevant business records are sent to Google Vertex AI (Gemini) over an encrypted connection for that processing. We do not use your unanonymised business data, personal information, or proprietary transaction logs to train public or third-party foundation AI models. Any data used to improve our internal algorithm performance is strictly aggregated and anonymised.

Legal basis: Legitimate interests (UK GDPR Article 6(1)(f)) — improving our services for the benefit of all users.

4.3 To Comply with Legal Obligations

While your account is active, we may process data as required by applicable law or to help you keep records for HMRC and Making Tax Digital. Deleting your account removes those records from our systems as described in Section 6; it does not remove your own legal record-keeping duties.

Legal basis: Legal obligation (UK GDPR Article 6(1)(c)) and performance of a contract (UK GDPR Article 6(1)(b)).

4.4 Partner Offers

We do not currently share your identifiable business profile or financial data with lenders, suppliers, or other partners so they can make you offers. If we introduce that in future, we will ask for a separate opt-in first and update this policy.

Legal basis: not used at present. Any future sharing of this kind would be based on Consent (UK GDPR Article 6(1)(a)).

4.5 Aggregated and Anonymised Data

We may aggregate and anonymise usage and business data — removing personal and directly identifiable information — to improve product features and understand how the Services are used.

We do not currently sell personal data, or aggregated or anonymised business data, to third parties such as researchers, financial institutions, or market analysts. We do not currently provide aggregated industry benchmarks to partner suppliers.

Legal basis: Legitimate interests (UK GDPR Article 6(1)(f)) — improving our services.

4.6 Earlier website emails

If you gave us an email address on our website before the app was available, we store it only so we can tell you the app is available. We do not use that address for unrelated marketing. You can ask us to delete it at any time by emailing info@pointerapp.co.

Legal basis: Consent (UK GDPR Article 6(1)(a)).

4.7 Website Contact Form

If you send a message through the Contact us form on our website, we store your email address, any name you provide, and the message so we can reply. We do not use contact messages for marketing. You can ask us to delete a message at any time by emailing info@pointerapp.co.

Legal basis: Legitimate interests (UK GDPR Article 6(1)(f)) — responding to your enquiry.

5. Data Sharing

5.1 Service Providers

We share your data with third-party service providers who process it on our behalf to help us deliver the Services. These currently include Google (Firebase Authentication, Firestore, Cloud Storage, Cloud Functions, Cloud Messaging, App Check, and Vertex AI / Gemini) for hosting, authentication, file storage, notifications, fraud prevention, and AI processing; Yapily for Open Banking connections you choose to make; Apple for in-app subscription billing on iPhone and iPad; Stripe for subscription billing on other platforms; and Resend for transactional email. Apple and Google also receive the data needed when you sign in with those providers.

Processors may only use your data as instructed by us. Sign-in and payment providers may also process some data as independent controllers under their own policies.

5.2 Open Banking and Connected Account Providers

If you connect a bank or payment account, we share necessary data with regulated open banking providers to facilitate that connection. These providers operate under their own regulatory frameworks including the Payment Services Regulations 2017.

5.3 Partner Offers

We do not currently share your data with lenders, suppliers, or other partners for offers, as described in Section 4.4. We do not sell your individually identifiable data.

5.4 Sale of Data

We do not sell personal data. We do not currently sell or share anonymised aggregated business data with third-party data buyers.

5.5 Legal and Regulatory Disclosure

We may disclose your data to law enforcement, regulatory bodies (including HMRC), or other authorities where required by law, court order, or in connection with legal proceedings.

5.6 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, your data may be transferred to a successor entity. We will notify you of any such transfer and of any choices you may have regarding your data.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Services, resolve disputes, and enforce our agreements.

You remain responsible for keeping copies of business records you need for HMRC or other legal duties. Our Terms require you to maintain appropriate records independently of the platform. While your account is active we store the books and files you keep in the Services; we do not operate a six-year archive after you delete your account.

If you delete your account in the app (menu → Delete account, Account → Profile → Delete account, or Delete account on the subscription screen), we delete your sign-in, your user profile, owned business workspaces, uploaded files (including receipt images), bank-connection records we hold, and related data from our systems promptly. Deletion is not reversible and we do not keep a 60-day recovery archive. Invited users lose access to a workspace you owned. If you are an invited user, deleting your account removes your membership and sign-in; it does not delete the owner's books.

We may retain limited information needed to complete deletion, prevent fraud or abuse, or meet a legal obligation (for example payment records held by Apple or Stripe). Open Banking consents are revoked where we can.

Email addresses given on the website before the app was available are kept until we have sent the note that the app is available, or until you ask us to delete them, whichever is sooner.

Website contact messages are kept for as long as needed to handle your enquiry and for a short period afterwards, or until you ask us to delete them, whichever is sooner.

When data is no longer required, we delete or anonymise it.

7. Data Security

We implement appropriate technical and organisational security measures to protect your data against unauthorised access, loss, alteration, or disclosure.

Encryption in transit: user data sent between the app or website and our servers, and between our servers and service providers, is transmitted using TLS (HTTPS). We do not send user data over unencrypted HTTP.

Encryption at rest: user data stored in our cloud systems (Google Firebase / Google Cloud, including Firestore and Cloud Storage) is encrypted at rest by the provider using industry-standard encryption. This is not end-to-end encryption: we, and processors acting on our instructions, can access the data in order to provide the Services.

Access to accounts is protected by your sign-in credentials. We use Firebase security rules and App Check to reduce unauthorised access. Limited data stored only on your device (for example session state) is protected by your device operating system; we do not apply a separate encryption layer to on-device caches.

However, no method of electronic transmission or storage is completely secure. While we take the protection of your data seriously, we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) in accordance with our obligations under UK GDPR.

Limitation: Pointer's security obligations apply to data within systems under our control. We are not responsible for the security of data held by your bank or payment provider, or for breaches occurring at third-party open banking providers.

8. International Transfers

Pointer is a UK-based service. Our primary hosting and databases are provided by Google Firebase / Google Cloud, currently in the United States (including the us-central1 region). AI processing uses Google Vertex AI, which may be served from Google's global infrastructure. Other processors, including Stripe (payments) and Resend (email), may also process data outside the United Kingdom.

Where we transfer your data outside the United Kingdom, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the processor's equivalent lawful transfer mechanism, to protect your data in accordance with UK GDPR requirements.

9. Cookies and Tracking

The Pointer mobile application uses local storage and similar technologies for essential functionality, session management, and app performance. The Pointer website contact form does not use advertising cookies. A full Cookie and Tracking Technology Policy applicable to any Pointer web presence is available separately. The app does not serve third-party advertising cookies.

10. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

  • Right of access: to request a copy of the personal data we hold about you
  • Right to rectification: to request correction of inaccurate or incomplete data
  • Right to erasure: to request deletion of your data in certain circumstances
  • Right to restriction: to request that we restrict the processing of your data
  • Right to data portability: to receive your data in a structured, commonly used format
  • Right to object: to object to processing based on legitimate interests
  • Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time

To exercise any of these rights, please contact us at info@pointerapp.co, or delete your account in the app (menu → Delete account, Account → Profile → Delete account, or Delete account on the subscription screen) if you want us to erase the data we hold for that account as described in Section 6. We will respond to email requests within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. Children

The Services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.

12. Limitation of Liability for Data Matters

While we comply with UK data protection law and implement robust security measures, Pointer's liability in connection with any data-related matter — including data breaches, unauthorised access, or loss of data — is limited to the fullest extent permitted by law, and subject to the overall liability cap set out in our Terms of Service.

We are not liable for:

  • Any loss or damage arising from your failure to maintain the security of your account credentials
  • Data loss or corruption resulting from third-party service failures, open banking provider failures, or actions outside our reasonable control
  • Consequences arising from data you voluntarily share with or consent to us sharing with third parties

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, Services, or applicable law. Where changes are material, we will notify you via the app or by email before they take effect. Your continued use of the Services after the updated Policy takes effect constitutes your acceptance of those changes.

14. Contact Us

For any privacy-related questions, requests, or concerns:

Tally Labs (UK) Limited

Email: info@pointerapp.co

You also have the right to contact the Information Commissioner's Office (ICO) directly:

ICO: ico.org.uk | Helpline: 0303 123 1113