This page explains what information The Usual Accountant ("TUA") holds about you and how we look after it. The product is operated by Ryon, a sole proprietorship registered in India (GSTIN 36AVBPV6074H1Z7, office at 4th Floor, 6-3-456/A/20/402, Maruthi Grandeuer Apartments, Behind Model House Lane, Dwarkapuri Colony, Hyderabad, Telangana 500082).
We have written this for you, not for a lawyer. If anything is unclear, write to us at [email protected] and we will explain.
1. Who this applies to
This page applies to anyone who visits theusualaccountant.com, creates an account, is invited to an existing workspace by an account holder, or whose Tally Prime data flows through our service because an account holder synced it.
2. What we collect
We keep the list short and predictable. Each item is collected for a specific reason and kept only for as long as we need it.
Your account. Your email, your name if you tell us, the user identifier from our sign-in provider, a one-way hash of your password if you set one, and your multi-factor settings.
Your workspace. A workspace identifier, the plan you are on, the billing status, your business name if you provided one, and the country you picked at signup.
Connections. Hashes of the tokens that let your Windows app and your connected AI clients talk to us, the names you give those connections, and when each one was last used. We never store the original tokens, only their hashes.
Tally accounting data. Vouchers, ledger entries, masters, GST details, trial balance, profit and loss, balance sheet, and stock summary. We receive this only when you tell the Windows app to sync, and only for the companies you choose.
Operational logs. The IP address of incoming requests, browser or client user agent, the action performed, what it acted on, and the time. We use these to investigate problems and block abuse.
Contact form and waitlist. Messages you send through the contact form (category, email, body) and waitlist entries (email, where you signed up from, IP, user agent).
Cookie preference. A single first-party cookie that remembers what you accepted or declined. The cookie holds no identifier other than your choices.
Website help bot.If you open the small chat bubble in the bottom-left corner of any public page and ask a question, we send the text of your messages to Anthropic in the United States so their Claude model can write a reply. The chat history is also kept in your browser's local storage so it survives a page refresh. The bot has no access to your account, your Tally data, or your sign-in. Using the bot is optional. If you would rather not send anything to Anthropic, use the contact form at /contact instead.
3. Why we hold it
We use your information to do four things and nothing more.
Run the product. Subscriptions, sync commands you trigger, queries from your AI clients, and the support you ask for all need the items in section 2 to work.
Keep it safe. We watch for fraud, throttle abusive traffic, and audit what happened when. The information in operational logs is what makes that possible.
Be open about cookies. We use Microsoft Clarity to see how pages are used and the Google Ads tag to measure which of our ads bring useful visitors. By using the site you agree to these, as described in our Cookie Policy. We do not sell your data or personalise advertising to you, and you can block or clear these cookies in your browser settings at any time.
Comply with our records duties. Indian tax law and accounting rules require us to keep certain audit and invoice records for a fixed time. We keep those for the minimum the rule requires, and no longer.
4. Where the data lives
Every database and backup that holds your information sits on a server located in India. We do not move the main store outside India. This is a deliberate choice and matches the promise we make on the marketing site.
A small number of external services handle limited pieces of information outside India. The full list, with what each one receives, is at /policy/sub-processors. Where one of these services is outside India, we pick providers with their own published safeguards and review them before we connect.
Two specific things leave India: messages you type into the website help bot go to Anthropic in the United States, and our identity provider Clerk also sits in the United States. Both are listed at /policy/sub-processors. Your Tally data and your workspace stay in India.
5. How we protect it
Every request between your browser, your Windows app, your AI client, and our servers travels over TLS 1.2 or 1.3 with modern cipher suites. Older protocols are switched off at the edge.
Each workspace has its own database file. Our query path opens these files with a read-only handle so writes cannot happen by accident. Both the main database and every workspace database are encrypted at rest with SQLCipher. The encryption key for each workspace is derived from a master key we keep outside the code.
We store tokens and webhook secrets only as SHA-256 hashes. We log every state change with who did it, when, from what IP, and what browser or client they used. Sign-in and sync endpoints are rate-limited on the server.
Workspaces are isolated in two places. The application attaches the workspace identifier to every query, and the on-disk layout gives each workspace its own database file. We have written tests that try to break this isolation on purpose so we catch any leak.
For the full technical picture, see /policy/security.
6. Who can view your data
Your workspace database is encrypted at rest. Opening it needs a key. The key is held inside our infrastructure so the product can do its job, which means answering the questions you and your connected AI clients send, running the syncs you trigger, and producing the invoices Razorpay sends you.
Without that key, the file on disk is unreadable bytes. The key never leaves our infrastructure and is not stored alongside the databases it unlocks.
Privileged actions on your workspace, including any direct query from an AI client and any download of your own logs, write a row in the audit log with the time, the action, the IP, and the identifier of whatever triggered it. The audit log is part of the copy you can download from the Account closure tab.
7. How long we keep it
Account information stays for as long as your account is active. If you ask us to close the account, we soft-delete the workspace and keep it for thirty days. During that window you can sign back in and pick up where you left off. After thirty days the workspace database and the related account records are hard-deleted.
Audit log entries are kept for at least twelve and at most thirteen months. The minimum matches what Indian rules require. The maximum is enforced by an automatic sweeper that runs every night and removes anything older.
Contact form conversations are kept for ninety days after the conversation closes. Waitlist entries stay until you ask us to remove them, or until we close the waitlist programme. The cookie preference sits in your browser for thirteen months, after which we ask again.
8. What you can do
You have a few things you can do at any time, and we respond to verified requests as quickly as we can.
Get a copy. You can download a copy of everything we hold about you from Account Settings › Account closure › Download my logs. The file is in a machine-readable format you can open in a viewer or pipe to a spreadsheet.
Correct things. You can edit profile fields directly in Settings. For anything that is not editable through the interface, write to us and we will correct it.
Close your account. Use the Contact support to close account button on the Account closure tab. We handle deletion by hand so we can cancel your Razorpay subscription, verify it is you asking, and clean up your sign-in identity in one pass.
Change your cookie choices. Open the cookie preferences at /cookies and update what you accepted. Changes apply from that point forward.
Ask us for help. Write to [email protected]. That mailbox is read by a real person.
9. Who we share it with
We do not sell your information. We share it only with the external services listed at /policy/sub-processors, each of which has its own published privacy terms, and with regulators or law enforcement if we are required to.
If you connect an AI client to your workspace, that client receives whatever slice of your accounting data it needs to answer the questions you ask. The data leaves our servers and enters the AI provider's infrastructure under their own privacy terms. We do not send anything to an AI provider on our own. The link only happens when you ask a question.
10. Talk to us
General product questions go to /contact. Privacy questions go to [email protected].