Privacy policy

Who we are

TapKue is run by [legal entity name], trade licence [licence number], at [address].

You can reach us at [contact email].

What we collect

We collect only what we need to run TapKue.

• Account details: your email address and your business name.
• What you type into your pages, for example names, job titles, phone numbers, email addresses, websites and links. Anyone who taps your card can see what you put on a page.
• Tap events: each time someone taps a card, we record which card, when, the type of phone (iPhone, Android, desktop or other), the country and the emirate. These records are anonymous. We never store the IP address or the browser details (user agent) of the person who tapped.
• Rate-limit data: when someone signs in or enters a claim code, we turn their IP address into a one-way hash. We use the hash only to limit repeated attempts. We do not store the address itself.
• Payment details: when Business billing starts, Stripe collects them. [What billing data we keep.]
• Technical logs: our hosting providers may keep short logs that include IP addresses. [Log retention, to be confirmed with each provider.]

Why we use it

• To let you sign in, claim your card and choose what it opens.
• To open the right page when someone taps your card.
• To show you how many times your cards were tapped.
• To protect TapKue from misuse, for example repeated guesses of claim codes.
• To take payment for the Business plan and to answer your questions.

[Legal basis for each purpose, to be confirmed by legal review.]

Who else handles your data

We plan to use these providers to run TapKue. They handle data for us, only for these purposes.

• Vercel: hosts the website and the card pages.
• Supabase: stores our database and handles sign-in.
• Stripe: takes payments for the Business plan.
• Resend: sends emails from TapKue.

Agreements and legal requests

[Status of the processor agreements with each provider.]

We may share data when the law requires it. [Details, to be confirmed by legal review.]

Where your data is kept

Our database is hosted in Mumbai, India. Our providers may handle data in other countries too. [Provider locations.]

Safeguards for data that leaves the UAE: [safeguards].

How long we keep it

We keep account data while your account is open, and for [retention period] after it closes.

We keep tap events for [retention period].

Your rights

You can ask us to:

• give you access to the data we hold about you;
• correct data that is wrong;
• delete your data;
• stop using your data because you withdraw your consent.

To make a request, write to [contact email]. We will answer within [response time].

[Legal review to confirm how the UAE Personal Data Protection Law (Decree-Law 45 of 2021) applies.]

Cookies

We use only the cookies that keep you signed in. We do not use advertising or tracking cookies.

Changes to this policy

We will post any change on this page and update the date at the top. [How we tell account holders about important changes.]