Privacy Policy

Last updated: 29 July 2026

1. Introduction

Tappt Ltd ("Tappt", "we", "us", "our") provides a smart NFC card and link-in-bio platform that lets creators share their social links, contact details and content through a single tap or profile link (the "Service"). This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the choices and rights you have.

This policy applies to our marketing site (tappt.io), our web app and dashboard (app.tappt.io), public profile pages (tappt.io/<handle>), our iOS and Android apps, and our NFC cards. By using the Service you agree to the collection and use of information as described here.

We are a company registered in England and Wales. Our registered address is 21 Montague Grove, Tockwith, York YO26 7AG, United Kingdom.

2. Information we collect

Account information

When you sign up, we collect your name, email address, chosen username/handle, and password (or, if you sign in with Google or Apple, the identifiers those providers give us). We never see or store your Google/Apple password.

Profile content

Anything you choose to add to your profile: bio, avatar and header media, links, social handles, gallery images, "Moments" posts, product listings, and design/theme preferences.

Contact exchange & lead form data

If you enable "Exchange Contact" or lead forms, we store the details visitors voluntarily submit to you (name, email, phone, company, notes, and any custom fields you configure). This data belongs to you as the profile owner and is visible in your Connections/Leads dashboard.

NFC card & device data

Each physical card carries a unique code. When it's tapped or scanned, we log the timestamp, approximate location (derived from IP address), device/browser type, and which of your personas it resolved to — so you can see analytics on your dashboard.

Usage & analytics data

We automatically collect profile views, link clicks, card taps, referral attribution, and similar interaction events to power your Analytics page. We use standard web technologies (IP address, user agent, cookies) to do this.

Payment information

Payments for Tappt Pro subscriptions and NFC card purchases are processed by Stripe and/or Shopify. We do not store full card numbers on our servers. If you enable payouts (Stripe Connect) or accept tips/product sales, Stripe collects the verification information required to pay you.

Support & communications

If you contact support or submit a ticket, we keep a record of the conversation, including any files you attach, so we can help you and improve the Service.

3. How we use your information

• To create and operate your account, profile and personas
• To process NFC card orders, subscriptions, tips, product sales and referral payouts
• To show you analytics about your own profile's performance
• To send transactional emails (verification, receipts, password resets, abandoned-onboarding reminders)
• To send marketing communications where you've opted in, and let you unsubscribe at any time
• To detect, prevent and investigate fraud, abuse, and violations of our Terms
• To provide customer support
• To improve and develop the Service, including new features
• To comply with legal obligations

4. Our legal basis for processing (UK/EU users)

Where UK GDPR or EU GDPR applies, we rely on: performance of a contract (running your account and the Service you signed up for), legitimate interests (securing the Service, preventing fraud, improving our product), consent (marketing emails, optional cookies), and legal obligation (tax and accounting records for payments).

5. How we share information

We do not sell your personal data. We share information only with:

• Service providers who process data on our behalf, under contract: Supabase (database & authentication), Stripe (payments, subscriptions, payouts), Shopify (NFC card orders and checkout), Resend (transactional email), and Vercel/Cloudflare (hosting and content delivery).
• Other users, when you choose to make information public — your profile, Moments, and any content you set to public visibility are visible to anyone with the link, and (if enabled) in the Tappt Discover feed.
• Visitors to your profile, in the case of data you as a profile owner collect from them via Exchange Contact / lead forms — that data is shared with you, the profile owner, not with other Tappt users.
• Legal & safety — where required to comply with the law, respond to lawful requests, or protect the rights, property or safety of Tappt, our users, or the public.
• Business transfers — if Tappt is involved in a merger, acquisition, or asset sale, your data may be transferred as part of that transaction, subject to this policy.

6. Cookies & tracking

We use essential cookies to keep you signed in and remember your preferences (like light/dark theme). We use limited analytics to understand aggregate usage of the marketing site and to attribute NFC card referral codes. We do not use third-party advertising trackers. You can control cookies through your browser settings, though disabling essential cookies may break parts of the Service.

7. Payments & connected accounts

If you connect a Stripe account to receive payouts (referral commissions, tips, or product sales), Stripe acts as an independent data controller for the verification and banking information it collects from you directly during onboarding — see Stripe's Privacy Policy. Card purchases and Pro subscription checkout may be processed via Shopify — see Shopify's Privacy Policy.

8. Data retention

We keep your account and profile data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within a reasonable period, except where we're required to retain it for legal, tax, fraud-prevention or dispute-resolution purposes (for example, order and payout records).

9. Security

We use industry-standard safeguards including encrypted connections (TLS), row-level security on our database, and restricted access to production systems. No method of transmission or storage is 100% secure, and we can't guarantee absolute security, but we work to protect your data and respond quickly to any incident.

10. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data (most profile data you can edit yourself in the dashboard)
• Delete your account and associated personal data
• Export your data
• Object to or restrict certain processing
• Withdraw consent for marketing at any time
• Lodge a complaint with your local data protection authority (in the UK, the ICO)

To exercise any of these rights, contact us at the email below.

11. Children's privacy

Tappt is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we'll delete it.

12. International transfers

Our service providers may process data outside your home country, including in the United States. Where this happens, we rely on appropriate safeguards such as Standard Contractual Clauses, consistent with UK/EU data protection law.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you by email or an in-app notice. The "Last updated" date at the top shows when this policy was last revised.

14. Contact us

Questions about this policy or your data? Email us at privacy@tappt.io, or write to:

Tappt Ltd
21 Montague Grove
Tockwith
York YO26 7AG
United Kingdom