How we handle your shop’s data

What Tally reads and copies, who can see it, and how it’s protected. Send security questions to support@backspinlabs.com.

Changes: Tally changes nothing in your Lightspeed account unless your owner turns changes on, and its tools never delete anything.
Separation: Each shop’s data is kept apart from every other shop’s and hosted in the EU, under EU privacy law.
Payments: Tally sees how a sale was paid and how much, never a card number or bank details.
Approval: A person approves every change, and every change is logged. So is every lookup, with who made it and from which AI assistant.
Revoking access: From Tally’s Settings or from Lightspeed, in about a minute.
Backups: An encrypted backup every night, to separate storage.

What Tally reads and what it can change

Tally reads your Lightspeed data. It changes nothing there unless your shop’s owner turns on changes in Settings, agreeing to the wording shown there. Changes stay off until then, and the owner can turn them off again.

With changes on, Tally changes only the kinds of records the owner allows, and only for the people the owner picks. Before each change, Tally shows it in full, before and after, to that person in their own AI assistant, which must send it back unchanged within 10 minutes. Tally can’t see what the assistant displays. People may use “always allow” for changes, but we recommend leaving it off: a change sent that way counts as approved by that person, even if they didn’t read it. Tally reads the record back from Lightspeed after each change. A change to many items at once is shown as a summary and a sample, and every item, before and after, is in a linked file. The change is then made item by item in the background, and each item is read just before it changes. A sale with an end date is approved once, with its dates, and its prices are put back at the end the same way. Its tools never delete anything in Lightspeed.

We turn on each kind of change only after checking it on a live account, with that shop owner’s written permission. A check may create test records and remove them, or change a record and change it back. If a check leaves a test value behind, we tell the owner. The check for work orders creates a test work order and removes it, and removal in Lightspeed is permanent. The terms describe each check.

Checked, so Tally Pro makes these changes itself:

Work orders
A status set on several work orders at once
Parts and labor on a work order
Transfers
Purchase orders
Prices
Costs
Reorder points
Item details
New items
Counts
Customer details
Customer tags

Not yet checked, so Tally says what to change and the person makes the change in Lightspeed:

Shipments received on an order

Lightspeed permissions and how Tally uses them

Permission	What Lightspeed allows with it	What Tally does
Sales history	View only	Reads sales, sale lines, and payments
Items and inventory	View only	Reads items, stock, and serial numbers
Customers	View only	Reads customers and account balances
Product costs	View and edit	Reads costs
Work orders	View, create, update, and archive	Reads work orders. With changes on, creates a work order and changes a work order’s note or status
Categories	View, create, update, and archive	Reads categories
Brands	View, create, update, and archive	Reads brands
Vendors	View, create, update, and archive	Reads vendors
Transfers	View, create, update, and archive	Reads transfers. With changes on, makes, sends, and receives a transfer, and archives a stuck transfer a person names
Purchase orders	View, create, and update	Reads purchase orders. With changes on, starts an open order or adds lines to one, and never marks it ordered, sent, or received
Special orders	View, create, and update	Reads special orders
Items and inventory, in full	View, create, update, and archive items and inventory	Asked for only if the shop turns this on. Then sets an item’s count at a store, and changes an item’s default cost, prices, and reorder point and level. Nothing else
Customers, in full	View, create, update, and archive customers	Asked for only if the shop turns this on. Then changes a customer’s tags, name, company, email, phone, and address. Nothing else
Employees	View, create, update, and archive employees	Asked for only if the shop turns on hours from the time clock. Reads time-clock hours and employee names. Nothing else

The first three permissions are view only. The next eight have no view-only form in Lightspeed, so they allow more than Tally uses: Tally changes work orders, transfers, and purchase orders only for a shop that has turned changes on, and uses the other five only to read. The last three are asked for only if the shop turns them on. Tally reads the time clock without changing it, and never creates a sale, an item, or a customer.

Each shop is kept apart

Every row of shop data is tagged with its shop, and every question is answered under a database account that can see only your shop’s rows.

Who can see what

Only people your shop adds can sign in, each with their own email address. There are no shared sign-ins, and an invite gives no access until it’s accepted.
Access to costs, customer details, and figures for named employees is set separately for each person. When one is off, that data never leaves our server in answer to that person’s questions. Owners and admins see all three.
No one, the owner included, can make a change in Lightspeed through Tally until the owner grants them the right for that kind of record. A right covers the whole shop.
Customer emails and phone numbers appear only when a question asks for them, or in a customer export the person downloads.
Access is checked on every question, so removing someone or changing their access takes effect immediately.
Each connected AI assistant is listed on Connections, where one click signs it out.

Backspin Labs runs the service. Server administration is limited to one person, who signs in with a key over a private network, never with a password. We access a shop’s data only when we need to run, support, or fix the service.

What we copy and what we don’t

We copy what Tally needs to answer your questions: stores, employees, items and stock, vendors, customers’ names and contact details, sales and how they were paid, work orders, transfers, purchase orders, and balances, within the history your owner allows (60 days unless you choose more). Time-clock hours are copied only if your owner turns them on. The privacy policy has the full list. We don’t copy:

Card numbers or bank details. Lightspeed doesn’t send them, so they never reach us.
Gift card numbers
Notes on customers
Customers’ street addresses or birth dates
Your Lightspeed password

Revoking access

One person or AI assistant. Remove the person on Team, or sign the assistant out on Connections. This takes effect on the next question.
The whole shop, in Tally. The owner uses Disconnect and delete in Settings.
The whole shop, in Lightspeed. Remove Tally’s access in Lightspeed. It takes about a minute and doesn’t involve us. After that, Tally can’t read anything new, and the copy is deleted as the privacy policy describes.

Report a security problem

If you find a way to see data that isn’t yours, sign in as someone else, or make Tally do something it shouldn’t, email support@backspinlabs.com with “security” in the subject and describe what you did and what you saw. Please don’t test against another shop’s data.

Technical details

Encryption

All traffic to Tally is encrypted in transit (HTTPS).
The database and the nightly backups are encrypted at rest.
Your Lightspeed connection is also encrypted separately and tied to your shop. The key that decrypts it is never in a backup.
Sign-in codes, session cookies, and the tokens your AI assistants hold are stored only as one-way hashes, so a copy of the database would not contain any of them.

Signing in

You sign in with a code we email you. It works once and expires within minutes, and there is no password to steal. Repeated wrong codes disable the code, and the owner of the email address is notified. A browser session ends automatically after a time, and sooner if unused. Access to your inbox is what proves it’s you, so protect it as you would the shop’s Lightspeed login.

Connecting an AI assistant

Each person connects their own AI assistant and signs in as themselves. The approval screen names the shop and where the sign-in returns to. Approve it only if you just started the connection yourself. We never send links to that screen, so don’t use one that arrives by email, text, or chat. Each time an assistant is connected, we email you and the shop’s owner with instructions for removing it.

Activity log

Each lookup is recorded in your shop’s activity log with who asked, from which AI assistant, what was looked up, and when. Tally sees the lookup the assistant makes, never the conversation. Each change made through Tally is recorded with the record before and after, who requested and approved it, and the outcome. The owner and admins can read both on the Activity page. What a person types to search for a customer by name, email, or phone is not kept in the log.

Credentials

Credentials Tally holds, such as your Lightspeed connection, stay on the server, are never shown to anyone, and are kept out of logs. Sign-in, download, and invite links are logged without the secret part of the link.

What the AI provider sees

Tally sends each answer to the AI assistant the person chose, such as Claude or ChatGPT, and so to the company that makes it. It also sends what your shop asked its AI apps to remember and, for a change, the full change to approve. An answer can include customer names and contact details if the person asking can see them. That company handles this data under its own terms and your settings with it. Some personal plans allow training on conversations unless that setting is off, so check it, or use a business plan. We don’t sell your data, use it for advertising, combine it with other shops’ data, or use it to train AI models.

Where it’s hosted

Tally and the copy of your shop’s data run at Hetzner in the European Union. The servers get security updates automatically. An encrypted backup runs every night to separate storage at Hetzner, also in the European Union. We have a written procedure for restoring from it and a command that carries it out. Lightspeed remains the system of record, so the copy of your Lightspeed data can be rebuilt from it.

Every shop’s data is stored and processed in the European Union, including for shops in the United States. There it is encrypted, kept apart from every other shop’s, and covered by EU privacy law. The data processing addendum and Disconnect and delete apply the same way, and the distance doesn’t slow answers.

Four outside companies handle your shop’s data for us: Hetzner, which hosts the servers and the backups; Resend, which delivers our email; Anthropic, whose AI tools we use to run, support, and fix the service; and Apple, whose iCloud Mail holds our inbox. Hetzner and Resend work under written data protection terms. Anthropic sees your data only when that work requires it, and model training on it is turned off. Apple holds our inbox under its iCloud terms, so please don’t email us customers’ personal details. The data processing addendum has the full list. Billing goes through Stripe, which never receives your shop’s Lightspeed data.

Cancelling and deleting data

Disconnect and delete, in Settings, is for the owner. It removes from our live system everything copied from Lightspeed, the details of changes made through Tally, and what your AI apps were asked to remember. It also disconnects every AI assistant and signs everyone else out. It keeps your shop’s name, your team list, and an outline of your activity, so the owner can sign in and reconnect. Your Lightspeed account isn’t affected.
The owner can cancel in Settings, under Billing, or by emailing support@backspinlabs.com. Service continues to the end of the month you paid for. Within 30 days of cancellation, we delete the copy of your Lightspeed data from the live system. When you cancel, or within 21 days after your service ends, you can ask for a file of your Activity log and record of changes. The rest of your shop’s records are deleted within 30 days after your service ends.
A backup made before a deletion still holds your data until it expires, which takes up to about seven months. If we ever restore from a backup, we repeat the deletion for every shop that had been deleted.

If something goes wrong

If we learn that your shop’s data was seen, taken, lost, or altered by someone who should not have had it, we email your shop’s owner without undue delay, and in any case no later than 72 hours after confirming it, with what happened, which data was involved, and what we are doing about it. Your shop decides whether and how to tell its customers, and we help.

Status and legal terms

The status page shows whether the service is up. The legal text is in our privacy policy, the terms, and the data processing addendum.