Security and Data Handling
How Morning Tally protects the call and sales data you trust us with
Morning Tally ("Morning Tally") produces daily, weekly and monthly sales and call reports from data in your phone system and your system of record. This page explains how we access, use, protect and delete that data. The binding commitments are in our Master Services Agreement and Data Processing Agreement, which every customer signs.
1. How we connect to your systems
1.1Read-only access. We ask for read-only access to your phone system and system of record wherever those systems offer it. We do not create, change or delete records in your systems unless you authorize a specific action in writing in your Order Form.
1.2Credentials you control. You create the credentials from your own accounts, so you can see them and revoke them at any time. Revoking them stops the reports until access is restored.
1.3Credential storage. We store credentials only in encrypted, access-controlled storage. We never keep them in code, email, chat or documents, and we ask you never to send them by plain email.
2. What we collect and why
2.1We retrieve only the fields needed for the reports in your Order Form: call logs and outcomes, call transcripts and the phone system’s own call summaries, and the order, quote, invoice or case records that tie calls to revenue.
2.2We use your data only to produce and deliver your reports and to support and secure the service. We never sell it, share it for advertising, combine it with other customers' data, or use it to contact your customers or callers.
3. How we use artificial intelligence
3.1Our reports are prepared with AI-assisted analysis from a third-party AI provider that we use under commercial terms. Those terms prohibit the provider from training its models on the data we send.
3.2Your data is never used to train or fine-tune any AI model, by us or by our providers.
3.3Call transcripts are treated as data to be analyzed, never as instructions to our system.
3.4Every customer quotation that appears in a report is checked against the source transcript before the report is sent, and headline totals are recalculated from your own systems. Estimated figures, such as an amount a caller mentions, are marked with a tilde (~).
3.5Because reports are prepared with AI-assisted analysis, please check important facts against your own records before relying on them. Each recipient receives a short welcome email that says the same.
4. Keeping customers separate
Each customer’s data is stored and processed separately. Automated checks run before every delivery to stop one customer’s data or report from reaching another customer’s recipients.
5. Protection in transit, at rest and at the desk
5.1Data is encrypted in transit with TLS 1.2 or higher and encrypted at rest.
5.2Multi-factor authentication is required on every account that can reach customer data.
5.3Access is limited to the people who run the service, each bound in writing by confidentiality and security duties. Work devices use full-disk encryption, automatic screen lock and current security updates.
5.4Every scheduled report run is monitored daily, and failures raise an alert the same morning.
6. Retention and deletion
| Data | When we delete it |
|---|---|
| Call recordings and transcripts | Within 90 days after the report that covers them is delivered, except short quotations that appear in delivered reports |
| Your credentials | Within 5 business days after the service ends or after you ask |
| All other customer data | Within 30 days after the service ends; backup copies expire within a further 30 days |
| Free sample report files | Within 30 days after the sample report is delivered, whether or not you become a customer |
We send a written certificate of deletion on request.
7. If something goes wrong
7.1We keep a written incident response plan and test it at least once a year.
7.2If we confirm a security incident affecting your data, we notify you within 72 hours, explain what happened and what data was involved, and give you the information you need for any notices of your own.
8. Program and oversight
8.1We maintain a written information security program, modeled on the FTC Safeguards Rule, with a named person responsible for it. We review it and our risk assessment at least once a year.
8.2We review each service provider that handles customer data before we use it and at least once a year after that, and we give customers advance notice before adding or replacing one.
8.3We carry technology errors and omissions insurance and cyber liability insurance. A certificate of insurance is available on request.
9. Your obligations
Call recording laws differ by state, and some states require every party’s consent. You are responsible for recording notices and consents on your calls, including telling callers that calls may be reviewed with automated tools. We give every customer a short guide with suggested greeting wording.
10. Questions and security reviews
Send security questionnaires and questions to [email protected]. Customers receive our Data Processing Agreement, our current list of service providers that process customer data, and a summary of our security program as part of signing.
Morning Tally, Knoxville, Tennessee