Privacy Policy

1. Who operates the service

TallyPeak POS is a hosted point-of-sale and business-management service. The intended operator is Aleric Peaks Ventures. Its registered legal name, address and designated privacy contact are awaiting verification before these terms become final.

For account and service administration data, the operator decides how information is used. For records a subscribing business enters about its employees or customers, that business generally decides the purpose of processing, while TallyPeak provides the service that processes those records on its instructions. Each party's exact responsibilities depend on the circumstances and applicable law.

2. Information we handle

Depending on how you use TallyPeak, we process the following categories of information:

• Account and verification details: name, email, credentials managed through our authentication provider, email-verification and login metadata.
• Business records: business name, contacts, locations, staff memberships, roles, invitation details and company profile information.
• Operational records: products, SKUs, prices, stock movements, sales, receipt content, taxes, returns, cash closeouts and expenses entered into the system.
• Subscription and support information: selected plan, trial status, submitted payment references, administrative approvals and information shared when requesting assistance.
• Basic technical data necessary to operate and protect the service, such as session cookies, error information and infrastructure logs.

3. Why we process information

We use this information to register and authenticate users, create and secure business workspaces, provide checkout and inventory tools, generate receipts and reports, enforce subscription limits, communicate service messages, investigate misuse and meet applicable legal obligations.

A business using TallyPeak is responsible for deciding what customer or employee information it is legally permitted to enter, and for providing any notices or permissions required for its own operations.

4. Service providers and international processing

TallyPeak currently uses third-party infrastructure and service providers to support authentication, database and file storage, application hosting, email delivery and encrypted backup storage. This includes Supabase, Vercel, Resend where configured, and Google Drive for encrypted backup archives.

These providers may process or store data outside Ghana. Appropriate contracts, safeguards and the actual hosting and transfer arrangements must be reviewed and documented before general launch. We do not sell customer business records as an advertising list.

5. Payments and financial data

During the current pilot, paid subscriptions are activated after independent verification of payments made through approved external payment channels. The application may store the payment reference, method, amount and approval record. It is not currently a card vault or an integrated Mobile Money checkout service.

Businesses should avoid adding payment credentials, national ID numbers or other unnecessary sensitive information to free-text product or support fields.

6. Cookies and account security

Essential cookies and similar session technologies are used to keep users signed in and protect their workspaces. The operator must review whether any non-essential analytics or advertising cookies are active and, if so, update this notice and obtain any required consent.

We use access controls and other technical and organisational measures intended to protect information. Encrypted backups form part of our recovery arrangements. No internet-based service can guarantee zero risk.

7. Retention, access and deletion

Records are kept while required to operate an account and to meet applicable business, tax, legal or security obligations. Detailed retention periods, end-of-service export steps and deletion timelines must be approved and disclosed before this policy is finalized.

A trial ending does not automatically mean every underlying record is immediately deleted. Access to transaction functions may be restricted when a subscription is inactive. Where a subscribing business controls a person's information, privacy requests relating to those records may need to be addressed by that business first.

8. Your choices and rights

Subject to Ghana's Data Protection Act, 2012 (Act 843), individuals may have rights to seek information about processing, access personal data, request corrections and raise objections in qualifying circumstances. A request will be assessed against applicable legal duties and the rights of others.

To exercise a privacy right or raise a concern, contact the operator using the designated privacy contact that must be supplied before public launch. Individuals may also contact Ghana's Data Protection Commission (dpc.gov.gh).

9. Changes to this notice

We will identify the date of any finalized policy, and update this page when our practices or applicable requirements change. Material changes should be communicated appropriately to affected users.

Privacy contact and review

Contact details awaiting confirmation. The business must publish an active privacy contact before accepting public customers. For now, please see our Contact page for the current pilot status.