TallyBridge by Comsky

Privacy Notice

Notice version 2026-08-31 · Last updated 31 August 2026
Applies to the TallyBridge mobile app (in.co.comhard.tallybridge), the TallyBridge web app, and the TallyBridge desktop connector.

TallyBridge reads accounting data from your own TallyPrime installation and makes it available to you on your phone and in a browser. This notice explains what we hold, why, who else sees it, how long we keep it, and how you can get a copy of it or have it deleted.

The short version

Your Tally data is synced only after you install our connector on your own computer and pair it with your account. The connector reads from Tally and sends outward; it never writes to your books unless you explicitly use a write-back feature.
We do not use advertising or third-party analytics SDKs in the mobile app. We do not sell or rent personal data, ever.
The only two permissions the app ever prompts you for are notifications, and your fingerprint or face to unlock it. It never asks for your location, contacts, camera or microphone.
Your accounting data includes personal details about your customers and suppliers. For that data you are in charge and we act on your instructions — see Who is responsible for what.
You can export everything we hold, or ask us to delete it, from inside the app — see Your rights.

Who we are

TallyBridge is published under the Comsky brand. The service is operated by Comhard Technologies Pvt. Ltd. (“Comhard”, “we”, “us”), registered office 4th Floor, Tower C, Embassy, Galaxy Business Park, A 44-45, Block A, Industrial Area, Sector 62, Noida, Uttar Pradesh 201309, India.

Under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) we are a Data Fiduciary for the personal data of the people who hold TallyBridge accounts, and a service provider acting on your instructions for the personal data contained in the accounting records you choose to sync. You are the Data Principal in respect of your own personal data.

What data we hold

1. Account and device data (about you)

Data	Where it comes from	Why we hold it
Email address	You, at sign-up	It is your login. We sign you in by emailing a one-time code, so we cannot operate the account without it.
Full name, organisation name	You, at sign-up	To address you, and to name your organisation in the app and on invoices.
Phone number (optional)	You	Account recovery and, if you turn them on, alerts.
Password, if you set one	You	Stored only as an `argon2id` hash. We never hold, and cannot recover, your actual password. One-time login codes are hashed the same way.
Sign-in records: IP address, browser/app user-agent, time	Automatically, on each sign-in	To let you see and revoke your own sessions, and to detect unauthorised access. This is a security record, not analytics.
Device platform, device name, app version, push token	Your device, when you allow notifications	To deliver the alerts you have enabled to the right device, and to diagnose version-specific faults.
Audit log of actions taken in your account	Automatically	A tamper-evident record of who changed what. Required to answer security and compliance questions later.

2. Accounting data from your TallyPrime company

This is synced only by the TallyBridge desktop connector, which you install on your own machine and pair with your account using a key you generate. It reads TallyPrime over Tally's own local XML interface and sends the following outward to your account:

Company — name, GSTIN, state, and the date your books begin.
Ledgers and parties — name, accounting group, GSTIN, state, postal address, contact person, phone number, email address, and opening and closing balances.
Stock items — name, unit, HSN/SAC code, GST rate, closing quantity and value.
Vouchers — date, voucher type and number, narration, party name, reference, and whether the voucher is cancelled or optional; together with each debit and credit line, each inventory line (quantity, rate, godown), and bill-wise details (bill date, credit period, due date, outstanding balance).
e-Invoice details, where you have generated them in Tally — the IRN, acknowledgement number and date, and the digitally signed QR code issued by the Invoice Registration Portal.

This includes personal data about other people. A ledger for a customer or supplier can carry an individual's name, address, phone number and email address. You decide what is in your books and what you sync. We process it only to provide the service to you, and we do not use it for any purpose of our own.

3. What we do not collect

The mobile app requests no location, contacts, camera, microphone or calendar access at all. It contains no advertising SDK, no cross-app tracking and no third-party product-analytics SDK, and we do not collect an advertising identifier.

Android's app listing shows a longer list of permissions than the two the app actually prompts you for, because the libraries it is built on declare them. For completeness, these are the others and what they are for: storage access, used when you save or share an invoice PDF; vibration, wake-lock and home-screen badge counts, used to deliver notifications; network-state, to tell whether you are online; and the Google Play install referrer. We do not use any of them to read your files or to build a profile of you.

If you unlock the app with a fingerprint or with Face ID, the biometric check happens entirely on your device and is performed by the operating system. Your fingerprint or face data is never sent to us and we never see it — the app receives only a yes or no.

Who is responsible for what

There are two layers, and it matters which one a given record sits in:

Your account data (the first table above) — we are the Data Fiduciary. This notice is our notice to you, and the rights below are exercised against us.
Your accounting data (the second list above) — you are in charge of it. Where it contains personal data about your customers, suppliers or staff, you are the Data Fiduciary towards those people and we process it only on your instructions. If one of your customers asks you to delete their data, you do that in Tally; the change reaches us on the next sync.

Why we process it, and on what basis

Purpose	What it covers	Basis
Running your account	Signing you in, syncing your Tally data, showing reports, generating invoices, keeping the service secure and available, and billing you.	Necessary to provide the service you asked for.
Alerts and reminders	Notifying you about overdue receivables, low balances and the specific alerts you configure.	Your consent, per alert. Turn them off at any time.
Product analytics	Understanding which features are used so we can improve them.	Your consent. Withdrawable, separately from the rest.
Marketing	Emails or messages about TallyBridge features and offers.	Your consent. Withdrawable, separately from the rest.
Benchmarking	Contributing aggregated, de-identified figures to industry comparisons.	Your consent, off unless you switch it on.
Legal and tax records	Retaining invoices and records we are required by law to keep.	Compliance with law.

Each consent is recorded separately, stamped with the version of this notice it was given against, and can be withdrawn on its own without affecting the others. Withdrawing consent for the “running your account” purpose means closing the account, because the service cannot function without it.

We do not sell, rent or trade personal data. We share it only with the service providers below, only to the extent each one needs, and only for the purposes in the table above.

Provider	What reaches them	When
Anthropic (Claude API)	The question you type, and a sample of up to five rows of the result of your own query — which can include party names and amounts. It powers the “ask a question” feature. Your data is not used to train their models.	Only when you use the AI question feature. If you never use it, nothing is ever sent.
Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service)	A device token and the notification itself. We keep notification text short and avoid putting figures in it where we can.	Only if you allow notifications.
Our email delivery provider	Your email address and the message — for example your one-time sign-in code.	When we email you.
Our hosting provider	Operates the servers the service runs on. They do not access the data for their own purposes.	Always.

We may also disclose data where we are legally required to, or to establish or defend a legal claim. If TallyBridge is ever transferred to another company, this notice travels with the data and we will tell you before anything changes.

Processing outside India. The AI question feature and the push services above are operated from outside India, so using them involves a transfer abroad. Everything else stays in the infrastructure we operate. We do not transfer data to any territory the Government of India has restricted.

How long we keep it

While your account is open — we keep your account data and your synced accounting data so the service works. Synced data is replaced, not accumulated: re-syncing a voucher updates the existing record.
One-time sign-in codes — valid for 10 minutes, then unusable, and they cannot be replayed.
Sign-in and audit records — kept as a security record for as long as they are needed to investigate an incident.
After you ask us to delete — we give at least 48 hours' notice and complete deletion within 90 days of the request, across both our main database and our analytics store.
Invoices and records we must keep by law — retained for the statutory period even after deletion of the rest.

How we protect it

Passwords and one-time codes are stored only as argon2id hashes with a server-side secret. The connector's pairing key is stored hashed too; we cannot read any of them back.
Every record carries the identifier of the organisation it belongs to, and every query is filtered by it, so one customer's data cannot be returned to another.
The desktop connector connects outward to us. It does not open a port and nothing needs to reach into your network. It reads from Tally; it writes back only when you use a feature that says it will.
You can require a fingerprint or Face ID to open the mobile app, and your sign-in tokens are held in the device's hardware-backed secure store, not in ordinary app storage.
Sessions can be listed and revoked, and privacy actions are written to an append-only audit log.

No system is perfectly secure. If a breach affects your personal data we will notify you and the Data Protection Board without delay, and in any event within 72 hours of becoming aware of it, and tell you what happened and what to do.

Your rights, and how to use them

Under the DPDP Act you can:

Right	How
Get a copy of your data (access and portability)	In the app, or by emailing us. We return everything we hold for your organisation as a structured file.
Correct or complete it	Account details are editable in the app. Accounting details are corrected in Tally and reach us on the next sync.
Have it erased	Request deletion in the app or by email. You get at least 48 hours' notice, and we finish within 90 days. You can cancel a pending request during the notice window.
Withdraw consent	Each purpose can be switched off on its own, as easily as it was switched on.
Nominate someone	You may nominate a person to exercise these rights on your behalf if you die or become incapacitated. Email us to record a nomination.
Complain	Write to our Grievance Officer below. If we do not resolve it, you may complain to the Data Protection Board of India.

We answer rights requests within 30 days. We may need to verify who you are first — not to obstruct you, but because handing your data to someone impersonating you would be the worse failure.

Deleting your account. Ask us to erase your account and we will delete your account data and all accounting data synced from your Tally company, except records the law requires us to keep. Removing the app from your phone does not by itself delete anything from our servers.

Your duties as a Data Principal

The DPDP Act also asks something of you: do not impersonate anyone else when giving us data, do not suppress material information when it is required, and do not file a false or frivolous complaint. Please also keep the accounting data you sync accurate — we report what your books say.

Children

TallyBridge is a business accounting tool and is not directed at children. We do not knowingly create accounts for anyone under 18, and we do not profile children or show them advertising. If you believe a child has an account, tell us and we will remove it.

Changes to this notice

When we change this notice we update the version and date at the top. If a change materially affects how we use your personal data, we will tell you in the app or by email and, where the law requires it, ask for your consent again. Every consent we hold is recorded against the notice version it was given under, so it is always clear which text you agreed to.

Contact us

Privacy queries — comhardapps@gmail.com
Grievance Officer — Alok Verma, CPO, comhardapps@gmail.com
Post — Comhard Technologies Pvt. Ltd., 4th Floor, Tower C, Embassy, Galaxy Business Park, A 44-45, Block A, Industrial Area, Sector 62, Noida, Uttar Pradesh 201309, India

Write to us in English or Hindi. We acknowledge privacy queries within 7 days and resolve grievances within 30 days.

The short version

Who we are

What data we hold

1. Account and device data (about you)

2. Accounting data from your TallyPrime company

3. What we do not collect

Who is responsible for what

Why we process it, and on what basis

Who else sees your data

How long we keep it

How we protect it

Your rights, and how to use them

Your duties as a Data Principal

Children

Changes to this notice

Contact us