Tagly Privacy Policy
Effective Date: January 2026 Last Updated: January 2026
Introduction
Tagly ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our expense tracking and financial management application.
Please read this privacy policy carefully. By using Tagly, you consent to the practices described in this policy.
Information We Collect
Information You Provide
- Account Information: Username, email address, and password (stored as a secure hash)
- Organization Information: Organization name and membership details
- Transaction Tags and Notes: Categories, comments, and receipt images you add to transactions
Information from Financial Institutions (via Plaid)
When you connect your financial accounts through Plaid, we receive: - Account Information: Account names, types, and masked account numbers - Transaction Data: Transaction amounts, dates, merchant names, and categories - Card Information: Last 4 digits of card numbers for transaction matching
We do not receive or store your bank login credentials. Plaid handles all credential authentication securely.
Automatically Collected Information
- Usage Data: How you interact with the application
- Device Information: Browser type and version
- Log Data: Server logs for security and debugging purposes
How We Use Your Information
We use your information to: - Provide and maintain the Tagly service - Sync and display your financial transactions - Allow you to categorize and tag transactions - Generate reports and exports of your financial data - Authenticate your identity and secure your account - Communicate with you about service updates - Comply with legal obligations
Data Storage and Security
Encryption
- Passwords: Hashed using bcrypt with unique salts
- Plaid Access Tokens: Encrypted using Fernet (AES-128) encryption
- Data in Transit: All communications encrypted with TLS 1.2+
- Data at Rest: Stored in encrypted databases
Access Controls
- Role-based access control limits data access
- Organization-based isolation ensures you only see your data
- Multi-factor authentication available for enhanced security
Information Sharing
We do not sell your personal information.
We may share your information in the following circumstances: - With Your Consent: When you explicitly authorize sharing - Service Providers: With trusted third parties who assist in operating our service (e.g., Plaid for financial data) - Legal Requirements: When required by law, regulation, or legal process - Business Transfers: In connection with a merger, acquisition, or sale of assets
Third-Party Services
- Plaid: We use Plaid to connect to your financial institutions. Plaid's use of your data is governed by the Plaid End User Privacy Policy.
Data Retention
We retain data for as long as needed to provide the service, maintain security records, and satisfy legal or accounting obligations. Retention periods vary by data type and legal requirements.
Your Rights and Choices
You have the right to: - Access: Request a copy of your personal data - Correction: Request correction of inaccurate data - Deletion: Request deletion of your account and associated data - Disconnect: Remove connected financial accounts at any time - Export: Download your transaction data in CSV format
To exercise these rights, contact us at: [email protected]
Data Deletion
If you request account deletion or data removal, contact us and we will review the request based on legal, contractual, and security requirements. In some cases, we may retain limited records that we are required to keep.
Cookies and Tracking
We use essential cookies for: - Session management and authentication - Security (CSRF protection)
We do not use third-party tracking or advertising cookies.
Children's Privacy
Tagly is not intended for users under 18 years of age. We do not knowingly collect personal information from children.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by: - Posting the new Privacy Policy on this page - Updating the "Last Updated" date - Sending an email notification for material changes
Contact Us
If you have questions about this Privacy Policy or our data practices, please contact:
Leonard Aziz Founder, Tagly Email: [email protected]
Additional Disclosures
California Residents
If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and the right to request deletion.
European Residents
If you are located in the European Economic Area (EEA), you may have rights under the General Data Protection Regulation (GDPR), including the right to data portability and the right to lodge a complaint with a supervisory authority.
This Privacy Policy was last updated in January 2026.