Privacy Policy

Tallio is a service of Hypermetron, GEMI number Manquant : [Numéro GEMI], VAT number Manquant : [Numéro de TVA], registered at Arnis 12, 115 28 Athens, Greece. Email: info@tallio.dev. Website: hypermetron.com.

We are the controller of the personal data described under visiting this site, using the dashboard, using the API and writing to us. Write to info@tallio.dev about anything in this policy.

This policy and our other legal texts are written in English. If a translation is ever published, the English text prevails.

• For people who visit this site, use the dashboard or write to us, we decide how their data is used: we are the controller.
• For the data vendors and merchants send through the API or the Shopify app, mostly about their customers, we act on their instructions: we are their processor, under our Data Processing Agreement. If you are a merchant’s customer, the merchant (or the software vendor it uses) is the controller; contact them first, and we help them answer you.

• The site uses no analytics, no advertising and no tracking. It sets no cookies.
• If you choose light or dark mode, the choice is kept in your browser’s local storage, on your device only.
• Our host, Vercel, processes your IP address and request details to deliver the pages and protect the service. This is our legitimate interest in running a secure site (GDPR Article 6(1)(f)).

When you sign in to the dashboard we hold:

• your email address, your sign-in account’s id and when you last signed in;
• your teams, your role in each, and, for a team created through sign-up, when its creator accepted our terms;
• invitations you send or receive, with the invited email address;
• an audit log of what each member does in a team (signing in, creating and revoking keys, inviting, removing and changing the roles of members, changing webhook settings, and viewing logged request bodies), with the member’s email address;
• one strictly necessary session cookie, __Host-tallio-dash, which keeps you signed in for at most 8 hours, or until 60 minutes without use.

You sign in with Google or with an email and password through Google’s Firebase Authentication, which also sends verification and password-reset emails. Your browser keeps no Firebase sign-in after the dashboard has opened your session.

We use this data to give you an account and run the contract with your company (Article 6(1)(b)), and to keep the dashboard secure and accountable (Article 6(1)(f)).

• API keys are stored only as a hash.
• For each request we log its method, path, status and timing, a keyed hash of the client’s IP address (never the address itself), the user agent, and the request and response bodies, encrypted at rest with credentials removed. Calls to providers and webhook deliveries are logged the same way.
• These logs exist so you and we can debug and support your integration. The bodies, the IP hash and the user agent are removed after 90 days; the request’s method, path, status and timing stay.
• Rate limiting also works from a keyed hash of the IP address, kept only while a limit window is open.

The legal basis is our legitimate interest in running, securing and supporting the service (Article 6(1)(f)).

A document can name a buyer and carry their tax id, address, email and phone, with the order lines and totals. A merchant’s connection carries its provider credentials. We process this data only to issue and track the merchant’s documents, as the Data Processing Agreement sets out:

• Provider credentials are encrypted with a key per vendor, which is itself protected by Google Cloud KMS in Frankfurt. They are never returned by the API.
• The full document, with its parties, is removed 90 days after the document is settled. We keep its metadata (type, status, number, registration number and totals) for the vendor’s records.
• We keep no fiscal archive. The merchant’s provider issues, signs and archives each document as the tax law requires.

If you email us, we keep your message and our reply for as long as we need them to help you and follow up, on the basis of our legitimate interest in answering you, or of a contract you have with us or ask to enter (Article 6(1)(b) and (f)).

We do not sell personal data or use it for advertising. The services in the table at the end of this page receive it, each only for the purpose shown. Our sub-processors work under data processing terms with us.

Everything we run is hosted in the EU, apart from Vercel’s global caching of the site’s static pages and Firebase Authentication, which runs on Google’s global infrastructure and may process sign-in data in the United States. Google’s data processing terms cover such transfers with the European Commission’s standard contractual clauses.

• API request, provider call and webhook bodies, and the personal data in them: 90 days.
• A document’s full content, with its parties: 90 days after the document is settled.
• Provider credentials: deleted 30 days after the connection is disconnected.
• Dashboard sessions: a session ends after 8 hours, or 60 minutes without use, and its record is deleted a day after the 8 hours.
• Invitations: 3 days for an owner, 14 days for other members, removed once they expire unused.
• A dashboard user who belongs to no team any more: removed 30 days after their last sign-in or their last membership change, whichever is later.
• A member’s email on a team’s audit log: removed after 365 days. The entry stays, without it.

You have the right to access your personal data, to correct it, to have it erased, to restrict or object to its processing, and to receive it in a portable form. Write to info@tallio.dev. We may ask you to confirm who you are, and we answer within one month.

• Dashboard users: when we erase your account, we delete your memberships, your sessions and your user record, and remove your email address from the teams’ audit logs. Your sign-in account in Firebase Authentication is held for us by Google; ask, and we delete it too.
• A merchant’s customers: at the request of the vendor or merchant, we remove a customer’s data from the stored documents, the logs and the event history. A document’s metadata stays for the vendor’s records, and the provider keeps the issued document as the tax law requires.
• Shopify stores: the Tallio Shopify app erases the customer and shop data it holds when Shopify sends a customer or shop erasure request.

Data travels over TLS and is encrypted at rest by our database host. On top of that, provider credentials are sealed with a key per vendor, logged request and response bodies are encrypted, and secrets and personal data are redacted from our application logs. More on our security page.

Please tell us first, so we can put it right. You may also complain to the Hellenic Data Protection Authority, 1-3 Kifisias Avenue, 115 23 Athens, www.dpa.gr, or to the authority where you live or work.

When this policy changes, we update this page and its date. We tell team owners by email of a material change at least 30 days before it takes effect.