Privacy policy

What we record on each read (tap)

When someone scans one of your NFC or QR tags, or opens one of your links, we store an anonymous record of that read with:

• Date and time of the read.
• Source: whether it came via NFC, QR, or directly.
• Approximate country, derived from the connection (not the exact address).
• Operating system and browser, for the device breakdown.
• A salted hash of the IP: we apply a one-way cryptographic function. It helps estimate unique visitors, but we never store the IP in the clear and it can't be reversed back to the original address.

We don't record the name, phone number, or any personal data of whoever scans. A link's public stats page (if you enable it) shows only aggregated totals and breakdowns, never individual data.

Your account data

If you create an account, we store:

• Your email (to sign in and contact you about account matters).
• Your name, if you enter it (optional).
• Your plan (Free or PRO) and its status.
• The links, tags, and inventory sessions you create, with their content (destination, title, counted codes).

What we use the data for

• Running the redirector, the tools, and inventory.
• Giving you the stats for your own links.
• Preventing abuse (phishing, malware) and protecting the service.
• Answering your questions and notifying you of important changes.

We don't use your data for advertising or share it with advertisers. There are no third-party tracking cookies: just the session cookie that keeps you signed in.

Who processes the data

Tapfy relies on infrastructure providers that act as processors on our behalf:

• Supabase: database and authentication. That's where your account, your links, and the read records live.
• Vercel: hosting and content delivery network (CDN) for the site and the redirector.
• Paddle: processes PRO payments made on the web and issues the receipt. If you buy from the app, the payment is processed by Apple or Google. We don't store your card details.

Your store's customer data (Shopify)

When you build an order or process a return or exchange from the Shopify embedded app, Tapfy reads and uses customer data (name, email, phone, shipping address) solely for that operation in Shopify.

Tapfy does NOT store this data: it is processed in transit and travels to/from Shopify without being saved to our database, logs, or cache. End-customer data retention: zero. We handle Shopify's compliance webhooks (customers/data_request, customers/redact, shop/redact).

Bot protection (Cloudflare Turnstile)

To protect our public forms (such as the waitlist) from automated spam, we use Cloudflare Turnstile, a CAPTCHA that works invisibly, without showing you challenges or tracking you. You can see how Cloudflare handles that data in Cloudflare's Turnstile Privacy Addendum.

How long we keep it

Account data is kept for as long as your account exists. Read records are stored to give you a stats history; if you delete a link, its reads are deleted too. You can request full deletion whenever you want.

Your rights

Regarding your data, you can:

• Access it and request a copy.
• Correct anything that's inaccurate.
• Delete your account and all its associated data.
• Export your links and counts.

To exercise these rights, write to us at privacidad@tapfy.app from your account email.

Minors

Tapfy is a tool for businesses and professional use; it is not aimed at minors and we don't knowingly collect data from them.

Changes to this policy

If we change anything relevant, we update the date above and, if it's significant, we notify you by email. Continued use of the service implies acceptance of the current version.

Contact

Tapfy is a product of CyV Uruguay SAS (RUT 219289990010), Paysandú 1401, Montevideo, Uruguay. Any questions about privacy: privacidad@tapfy.app. See also our terms of service.