Privacy Policy

Last updated: 11 October 2026

1. Who We Are

Tapcarry ("Tapcarry", "we", "us", "our") is a digital loyalty platform operated by:

Nicklas Sharma, Holzmeisterstrasse 24, Top 93, 5071 Salzburg, Austria — support@tapcarry.com

Nicklas Sharma acts as the data controller within the meaning of the EU General Data Protection Regulation (GDPR / Regulation (EU) 2016/679) for personal data processed through the Tapcarry platform.

2. What Tapcarry Does

Tapcarry provides brick-and-mortar businesses (cafés, restaurants, retail stores and similar) with a B2B SaaS platform to run digital stamp-card loyalty programmes via Apple Wallet and Google Wallet. No app download is required by end-customers.

Tapcarry interacts with two distinct groups of people:

(A) Business operators — companies or individuals who subscribe to Tapcarry and operate loyalty programmes for their customers.
(B) End-customers — consumers of those businesses who receive and use digital stamp cards via Apple Wallet or Google Wallet.

The rights and data-handling rules for these two groups differ, and this policy explains both clearly.

3. Data We Collect

3.1 Business Operators (Admins)

When you create and use a Tapcarry account on behalf of a business, we collect:

Your name and email address
Your business name and any business details you provide
Subscription and billing information — payment card details are handled exclusively by Paddle.com Market Limited (our Merchant of Record) and are never stored by Tapcarry
Account activity logs (login timestamps, feature usage)
Your email communication preferences: whether you have consented to marketing email, when that decision was last changed, and whether your address has bounced or been unsubscribed. We keep this record so we can prove we only send marketing email to people who asked for it, and so we can tell you when we are unable to reach you
Dashboard usage analytics, only if you have accepted analytics cookies (see Section 3.3): while you are logged in, the analytics data is linked to a random internal account identifier, together with your brand's internal ID, your subscription plan, your sign-up date and your interface language. We never send your name, email address or business name to our analytics provider. This data is deleted when you delete your account

3.2 End-Customers (Stamp Card Recipients)

When a business operator runs a loyalty programme through Tapcarry, their customers may receive a digital stamp card delivered via Apple Wallet (on iPhone) or Google Wallet (on Android and desktop browsers). In connection with this, we may process:

Name and/or email address, if provided by the business operator or directly by the customer
Stamp card activity: stamps issued, rewards redeemed, pass interactions
Wallet pass delivery metadata. What this consists of depends on which wallet the customer uses, because the two platforms work differently:
- Apple Wallet: a device identifier and a push notification token, supplied by Apple when the customer adds the pass. We store them solely so that we can send a silent, empty-payload push that prompts the device to fetch an updated pass. They are the only way to reach an issued Apple pass.
- Google Wallet: an identifier for the pass object we create on Google's servers. There is no device identifier and no push token — updates are written directly to that object over Google's API and the customer's device is never addressed. Saving a pass does, however, require the customer to be signed in to a Google account, and Google processes that account under its own privacy policy.

Important: For end-customer data, Tapcarry acts as a data processor on behalf of the business operator, who is the data controller for their own customers. Business operators are responsible for maintaining a lawful basis for collecting their customers' data and for informing those customers in accordance with GDPR Articles 13 and 14.

3.3 Automatically Collected Data

When you visit the Tapcarry website or use the platform, we automatically collect:

Website usage statistics via PostHog, only if you click "Accept" in our cookie banner. With your consent, PostHog records the pages you visit, the referring page, your browser, operating system and device type, your screen size, and an approximate location (country/city) derived from your IP address. Your IP address itself is not stored. To recognise repeat visits, PostHog stores a random, pseudonymous identifier in a first-party cookie and in your browser's local storage. On our homepage and our card-designer page (/design) only, we also make session recordings: a reconstruction of how the page looked and how you scrolled, moved and clicked while on it, so we can see where visitors get stuck. Everything you type into form fields is masked and never leaves your browser, recording stops as soon as you leave those two pages, and no other page — in particular nothing inside the dashboard — is ever recorded. Recordings are kept for up to 30 days. We strip query parameters (such as email addresses or login links) from page addresses before they are sent, and no cross-site tracking takes place. On our homepage and our card-designer page (/design) we additionally record which elements you click (the element's label, type and position on the page). We also build click and scroll heatmaps for a small number of pages, including the loyalty-card designer in the dashboard; heatmaps record only positions on the page, not what is shown there. If you are a business operator and are logged in, your use of the dashboard is linked to your account as described in Section 3.1. Analytics is never active on the stamp-card sign-up pages used by end-customers. Collection is based on your consent under GDPR Article 6(1)(a), which you may withdraw at any time through "Manage cookies" in the website footer or, when logged in, the "Analytics cookies" switch under Settings → Preferences.
A strictly necessary session cookie set by our authentication provider (Supabase) to keep you logged in. This cookie contains no personal data beyond a session identifier and is deleted when you log out or your session expires.

4. How We Use Your Data

We use the data we collect to:

Create and maintain your Tapcarry account
Deliver, operate, and improve the loyalty programme service
Process payments and manage your subscription (via Paddle)
Send transactional communications: account confirmations, password resets, pass update notifications
Send service communications to business operators: planned maintenance and outages, security notices, changes to these policies or our terms, and billing notices. These are necessary to operate your account and are not marketing
Send optional marketing communications to business operators: product updates, new feature announcements, and offers. These are sent only where you have given consent, which you may withdraw at any time — see Section 9
Understand how our website is used, through consent-based, pseudonymous analytics
Comply with Austrian tax, accounting, and legal obligations
Respond to support enquiries and GDPR requests

Apart from the optional marketing communications described above, we do not use your data for advertising, profiling, or automated decision-making that produces legal or similarly significant effects. We do not build advertising profiles, we do not target you based on your behaviour on the platform, and we never share your address with third-party advertisers.

Purpose	Legal basis
Account creation and service delivery	Art. 6(1)(b) — performance of a contract
Payment processing and billing	Art. 6(1)(b) — performance of a contract
Transactional communications	Art. 6(1)(b) — performance of a contract
Service communications (outages, policy changes, billing)	Art. 6(1)(b) — performance of a contract; Art. 6(1)(f) — legitimate interest in keeping account holders informed
Marketing communications (product updates, announcements, offers)	Art. 6(1)(a) — consent, withdrawable at any time
Website analytics (PostHog)	Art. 6(1)(a) — consent, withdrawable at any time; Section 10
Tax and accounting records	Art. 6(1)(c) — compliance with a legal obligation
Stamp card delivery and pass updates	Art. 6(1)(b) — contract between operator and Tapcarry; Art. 6(1)(f) — legitimate interest of the operator
Responding to GDPR requests	Art. 6(1)(c) — compliance with a legal obligation

6. Third-Party Service Providers

We share data only with the following carefully selected processors, and only to the extent necessary to provide the service:

Provider	Role	Data location	Transfer safeguard
Supabase, Inc.	Database hosting and authentication	eu-west-3 (Frankfurt, Germany)	EU-based processing — no transfer
Paddle.com Market Limited	Payment processing / Merchant of Record	UK / Ireland	UK adequacy decision; Standard Contractual Clauses
Vercel Inc.	Platform hosting	EU servers; US-headquartered company	Standard Contractual Clauses (SCCs)
PostHog, Inc.	Website analytics (only with your consent)	EU (Frankfurt, Germany); US-headquartered company	EU-based processing; Standard Contractual Clauses (SCCs)
Apple Inc.	Apple Wallet pass delivery	USA	Standard Contractual Clauses (SCCs)
Google LLC	Google Wallet pass delivery	USA	Standard Contractual Clauses (SCCs)
Resend (Plus Five Five, Inc.)	Email delivery — transactional, service, and marketing email	USA	Standard Contractual Clauses (SCCs)

We do not sell, rent, or trade your personal data to any third party.

7. Data Retention

Data type	Retention period
Business account data (admin profiles, business info)	Retained while your account is active
End-customer stamp card data	Retained while the business operator account is active
Data after subscription cancellation	Retained until you explicitly delete your account
Data after account deletion	Permanently deleted within 30 days of account deletion
Session recordings of the homepage and /design (PostHog)	Up to 30 days
Website and dashboard analytics data (PostHog)	Up to 12 months; data linked to a business operator account is deleted when the account is deleted. The analytics cookie expires after 12 months or when you withdraw consent
Email delivery and consent logs	Retained while your account is active, and kept after account deletion only where needed to honour an unsubscribe or suppression request
Billing records	Up to 7 years to comply with Austrian tax law (§ 132 BAO)

Note on cancellation vs. deletion: Cancelling your subscription does not delete your account or data. Your data is retained so you can reactivate your account at any time. To permanently delete your data, you must use the Delete Account function in your account settings.

8. International Data Transfers

Your data is primarily processed within the European Economic Area (EEA). Where transfers to third countries occur (e.g. to Vercel, PostHog, Apple or Google, which are US-headquartered), we ensure appropriate safeguards are in place, specifically the Standard Contractual Clauses (SCCs) approved by the European Commission under GDPR Article 46(2)(c).

You have the following rights in relation to your personal data:

Right	What it means
Right of access (Art. 15)	Request a copy of the personal data we hold about you
Right to rectification (Art. 16)	Ask us to correct inaccurate or incomplete data
Right to erasure (Art. 17)	Ask us to delete your data ("right to be forgotten")
Right to restriction (Art. 18)	Ask us to limit how we process your data
Right to data portability (Art. 20)	Receive your data in a structured, machine-readable format
Right to object (Art. 21)	Object to processing based on legitimate interests
Right to withdraw consent (Art. 7(3))	Where processing is based on consent, withdraw it at any time without affecting prior processing

To exercise any of these rights, contact us at support@tapcarry.com. We will respond within 30 days. We may ask you to verify your identity before processing your request.

Withdrawing consent for marketing email. You can turn marketing email off at any time, without contacting us, in two places: the "Product emails" switch under Settings → Preferences in your dashboard, or the unsubscribe link at the bottom of any marketing email. Withdrawing consent takes effect immediately and does not affect processing carried out before you withdrew it. Note that turning off marketing email does not stop service communications (outages, policy changes, billing) — those are sent on the basis of our contract with you, not consent, and are necessary to operate your account.

You also have the right to lodge a complaint with the Austrian Data Protection Authority: Österreichische Datenschutzbehörde (DSB), Barichgasse 40–42, 1030 Vienna, Austria — dsb.gv.at | dsb@dsb.gv.at

10. Cookies

Tapcarry sets the following cookies:

Cookie	Purpose	Duration	Consent required?	Legal basis
Session cookie	Authentication — keeps you logged in to your account	Session / until logout	No — strictly necessary	Art. 6(1)(b) GDPR
Language preference cookie	Remembers your preferred language (English, German, or Dutch)	1 year	No — strictly necessary	Art. 6(1)(f) GDPR
Cookie consent record (`cookie-consent`, local storage)	Records whether you have accepted or declined analytics	Until you change it or clear your browser data	No — strictly necessary to record your consent decision	Art. 6(1)(c) GDPR
Analytics cookie (`ph_<project>_posthog`, cookie and local storage)	PostHog analytics: a random pseudonymous identifier used to recognise repeat visits	12 months	Yes — only set after you click "Accept"	Art. 6(1)(a) GDPR

A note on PostHog analytics: PostHog is not loaded into a tracking state, and no analytics cookie is set, until you click "Accept" in our cookie banner. If you reject, no analytics data is collected. You can withdraw your consent at any time by clicking "Manage cookies" in the website footer and choosing "Reject", or, when logged in, by turning off "Analytics cookies" under Settings → Preferences — this stops collection immediately and deletes the PostHog identifier from your browser. Withdrawal does not affect the lawfulness of data collected before it.

Apart from the consent-based analytics cookie described above, we do not use advertising, tracking, remarketing, or profiling cookies.

11. Data Processing Agreement for Business Operators

If you are a business operator using Tapcarry to manage loyalty programmes for your own customers, you are acting as a data controller for your customers' personal data. Tapcarry acts as your data processor for that data.

By agreeing to our Terms of Service, you also agree to our Data Processing Agreement (DPA), which governs how Tapcarry processes end-customer data on your behalf in accordance with GDPR Article 28.

The Data Processing Agreement is incorporated into Tapcarry's Terms of Service as Schedule A, available at Terms of Service. By accepting the Terms of Service, business operators also accept the DPA.

12. Children's Data

Tapcarry is a B2B platform intended for use by businesses and their adult representatives. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us immediately at support@tapcarry.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, or legal requirements. When we make material changes, we will notify you by email or by posting a notice on the Tapcarry dashboard at least 14 days before the changes take effect.

The "Last updated" date at the top of this document indicates when it was last revised. Your continued use of Tapcarry after changes take effect constitutes acceptance of the revised policy.

14. Contact

For any questions, GDPR requests, or data protection concerns: