Privacy policy

1.Who we are

This policy explains how Tarn Software Ltd (“Tarn”, “we”, “us”) collects, uses and protects personal information when you visit our website, start a trial or use the Tarn cash-flow forecasting service (the “Service”).

Tarn Software Ltd is the controller of the personal information described here, except where we process data on behalf of a business customer, in which case that customer is the controller and we act as its processor or service provider. Our address is 2 Fremont Street, Floor 4, San Francisco, CA 94105. You can reach us about privacy at any time at hello@example.com.

2.Information we collect

Information you give us

• Account details: your name, work email, company name, role, team size and password (stored only as a salted hash).
• Billing details: billing contact and address. Card details are collected and stored by our payment processor; we see only the card brand, last four digits and expiry date.
• Communications: messages you send us, walkthrough requests and support conversations.

Financial data you connect

When you connect a bank, ledger, payroll or billing tool, we receive account names, balances, transactions, scheduled payments, invoices and payroll totals. Bank connections are made through a regulated bank-data provider using read-only access. We never receive or store your online banking username or password.

Information collected automatically

• Usage data: pages and features used, actions taken in the Service, and the date and time of each visit.
• Device data: browser type, operating system, IP address and approximate location derived from it.
• Cookies: described in section 11.

3.How we use information

We use personal information to:

• provide the Service, including building your forecast, scenarios, alerts and weekly emails;
• keep your connections synchronised and detect errors in imported data;
• process payments and send receipts and service notices;
• answer questions, run walkthroughs and provide support;
• keep the Service secure, prevent fraud and enforce our Terms;
• improve the Service using aggregated, de-identified usage information; and
• send product news, if you have agreed to receive it. You can unsubscribe at any time.

We do not sell personal information, we do not use your financial data for advertising, and we do not use the contents of your connected accounts to train machine-learning models.

4.Legal bases for processing

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases:

• Contract: to provide the Service you signed up for.
• Legitimate interests: to secure and improve the Service and to communicate with business customers, balanced against your rights.
• Consent: for optional marketing emails and non-essential cookies. You can withdraw consent at any time.
• Legal obligation: to keep financial records and respond to lawful requests.

5.Bank data and read-only access

Tarn’s access to your financial accounts is limited to reading information. The Service cannot initiate payments, move money, or change anything in your bank account.

Connections are made through our bank-data provider, which authenticates you directly with your bank. Most banks ask you to renew consent every 90 days. You can disconnect any account at any time from Settings, then Connections, and we stop collecting new data from it immediately.

6.How we share information

We share personal information only with the following, and only as needed:

Each service provider is bound by a written contract that limits use of the data to providing services to us. We may also disclose information if required by law, to protect the rights and safety of our users, or as part of a merger or acquisition, in which case we will notify you before your information becomes subject to a different policy.

7.International transfers

Tarn stores data in the United States. Where we transfer personal information from the EEA, the UK or Switzerland, we use the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism, together with additional safeguards where required.

8.How long we keep information

• Account and financial data: for as long as your account is open. When you close your account, we delete it within 30 days.
• Trial accounts: deleted 30 days after a trial ends if you do not choose a plan.
• Billing records: kept for seven years to meet tax and accounting obligations.
• Backups: encrypted backups roll off within 35 days.

9.Security

We protect information with encryption in transit (TLS 1.2 or later) and at rest (AES-256), single sign-on and multi-factor authentication for staff, role-based access controls, logging and regular third-party penetration tests. Staff access to customer financial data is limited to support cases you open, and every access is logged.

No system is perfectly secure. If we become aware of a breach that affects your personal information, we will notify you and the relevant authorities as the law requires. More detail is on our security page.

10.Your rights and choices

Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, and to withdraw consent. Most of this you can do yourself in Settings. For anything else, email hello@example.com. We respond within 30 days and will not discriminate against you for exercising your rights.

California residents

Under the California Consumer Privacy Act, as amended, you have the right to know what personal information we collect, use and disclose, to request deletion and correction, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined by the law. You may use an authorised agent to make a request on your behalf.

If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

11.Cookies

We use strictly necessary cookies to keep you signed in and to secure the Service. With your consent, we also use analytics cookies to understand how the website is used. We do not use advertising cookies. You can change your choice at any time by clearing cookies for this site or adjusting your browser settings.

12.Children

The Service is meant for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children.

13.Changes to this policy

We will post any changes on this page and update the date at the top. If a change is material, we will tell account owners by email at least 30 days before it takes effect.