Legal

Privacy policy

Last updated: 20 September 2026

This policy explains how Tappivo collects, uses, stores and protects personal data when you use the Tappivo platform — the website at tappivo.com, the customer dashboard, and the short-URL redirection service behind Tappivo NFC and QR touchpoints (https://tappivo.com/t/<token>).

1. Who we are (data controller)

The data controller for the Tappivo platform is TabSphere LTD, a company registered in England and Wales, trading as Tappivo.

Controller: TabSphere LTD (trading as Tappivo)
Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Company number: 16534288
Privacy contact: support@tappivo.com
Security contact: security@tappivo.com

2. The data we process

2.1 Account data

When you register for a Tappivo account we process:

your email address (used for sign-in and service communications);
your display name;
authentication session records managed by our authentication provider.

2.2 Business data

When you onboard a business we process the information you supply about it:

trading name, business category, website URL and business contact details;
location (trading address) details you enter;
destination URLs you configure for your touchpoints (for example your Google review page), together with their platform verification status;
product requests, support tickets and support messages you send us.

2.3 Interaction events (touchpoint analytics)

When someone taps an NFC touchpoint or scans a QR code, our redirection service records an interaction event so the business owner can see how their touchpoints are used. An interaction event contains:

the date and time of the interaction;
which touchpoint, location and destination was involved;
the browser user-agent string and referring URL supplied by the visitor's browser (each truncated to 1,000 characters);
classification flags produced by our analytics pipeline: a suspected-bot flag (where the user-agent matches well-known scanner, prefetcher or monitoring patterns) and a deduplication marker for rapid repeat interactions from the same coarse device signal.

We do not store raw IP addresses. Our analytics use only coarse, non-personally-identifying signals. Interaction counts are not unique-visitor counts, and we do not attempt to identify the individual who tapped or scanned a touchpoint.

3. What we use the data for (purposes and lawful bases)

Under the UK GDPR we rely on the following lawful bases:

Performing our contract with you (Article 6(1)(b)): providing the platform, provisioning and configuring your touchpoints, operating redirection, and providing customer support.
Legitimate interests (Article 6(1)(f)): securing the platform (including abuse prevention, bot classification and rate limiting on the tap redirection service), producing aggregate interaction analytics for business owners, and improving the service. We balance these interests against your rights and minimise the data involved.
Legal obligations (Article 6(1)(c)): retaining records where UK law requires it (for example accounting records).

4. Cookies and similar technologies

Tappivo uses strictly necessary authentication and security technologies to keep users signed in and protect the service. We also offer optional Google Analytics on the public website to understand aggregate website usage and improve Tappivo. Optional analytics is not loaded until the visitor chooses to allow it, and rejecting analytics does not prevent normal use of Tappivo. Visitors can revisit their analytics preference using the cookie preferences control. See our Cookie Policy for more information.

5. Who processes data on our behalf (subprocessors)

We use the following service providers to operate the platform:

Supabase — hosted database, authentication and storage. Account, business and interaction data is stored in our Supabase project.
Vercel — hosting and content delivery for tappivo.com, including the tap redirection edge route.
Google Analytics — optional website analytics, loaded only after the visitor allows analytics through Tappivo's preference control.

6. International transfers

Our subprocessors may process data outside the United Kingdom. Where personal data is transferred to a country that is not covered by a UK adequacy regulation, we rely on appropriate safeguards (such as the UK International Data Transfer Agreement or the UK addendum to EU standard contractual clauses) made available by those providers.

7. How long we keep data (retention)

Account and business data — kept for as long as your account is active, and deleted or anonymised within a reasonable period after account closure, except where we must keep records to meet legal obligations.
Interaction events — kept as operational analytics for the business concerned. They contain no raw IP addresses and no direct identifiers.
Support tickets and messages — kept while your account is active so we can maintain continuity of support.

8. Your rights

Under the UK GDPR you have the right to access your personal data, to have it rectified or erased, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on consent. To exercise any of these rights, email support@tappivo.com.

You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk or by telephone on 0303 123 1113. We would appreciate the chance to resolve your concern first, so please contact us in the first instance.

9. Security

We protect the platform with row-level tenant isolation in the database, least-privilege access controls, and audited administrative operations. See our security page for a summary. To report a vulnerability, email security@tappivo.com.

10. Changes to this policy

We may update this policy from time to time. The "last updated" date above shows the current version. Material changes will be flagged on this page before they take effect.