Tools and automation
GDPR Tally
In an indie stack, Tally is used for Forms. Entity cited: Tally BV. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 4, 2026. Verified on October 4, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Tally
Yes. Public Data Processing Agreement. It cites categories of sub-processors (hosting, payment, communication) without naming them one by one.
Stated role
Tally BV is controller of account and usage data of form creators. For responses, the creator is controller and Tally is processor.
Personal data
Name, email, password hash, optional industry, position, and discovery channel, card information, VAT number, features used, preferences, responses of which the creator is controller, visit data recorded by cookies.
Sub-processors of Tally
The GDPR page publishes a named list: Google Cloud (hosting and storage), Cloudflare (storage, DNS, bot protection), SendGrid, Stripe, Sentry, Missive, Mixpanel, Tinybird, UserJot, Plausible, Cello, Google AI Studio, and turbopuffer. Several processing activities there are indicated as opt-in (files, email notifications, payment, referral, AI assistant). The DPA, for its part, cites only categories.
Transfers outside the EU
Hosting / location
Account data is stored on servers in the European Union. Tally states that all form data is stored in Europe.
EU–United States Data Privacy Framework
Official search for “Tally.so” and “Tally BV”: no participant. A “Tallyfy, Inc.” entry concerns another company. Tally BV: not registered.
Cookies
A cookie is a small file sent by Tally's server and placed on the computer. The information stored there can be read only by Tally, and only during the visit to the site.
Typical use, written by StackLégal and not by the vendor: Forms.
History
Last update: October 4, 2026.
Sub-processors: named list from the GDPR page, in place of "not disclosed".
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 4, 2026.
Frequently asked questions
Is Tally a processor within the meaning of the GDPR?
Tally BV is controller of account and usage data of form creators. For responses, the creator is controller and Tally is processor.
What DPA does Tally publish?
Yes. Public Data Processing Agreement. It cites categories of sub-processors (hosting, payment, communication) without naming them one by one. https://tally.so/help/data-processing-agreement
Which further sub-processors does Tally publish?
The GDPR page publishes a named list: Google Cloud (hosting and storage), Cloudflare (storage, DNS, bot protection), SendGrid, Stripe, Sentry, Missive, Mixpanel, Tinybird, UserJot, Plausible, Cello, Google AI Studio, and turbopuffer. Several processing activities there are indicated as opt-in (files, email notifications, payment, referral, AI assistant). The DPA, for its part, cites only categories. https://tally.so/help/gdpr
Where does Tally state that it processes data, including outside the EU?
Account data is stored on servers in the European Union. Tally states that all form data is stored in Europe.
Is Tally registered under the EU–United States Data Privacy Framework?
Official search for “Tally.so” and “Tally BV”: no participant. A “Tallyfy, Inc.” entry concerns another company. Tally BV: not registered.
Which personal data does Tally mention?
Name, email, password hash, optional industry, position, and discovery channel, card information, VAT number, features used, preferences, responses of which the creator is controller, visit data recorded by cookies.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.