Privacy Policy

1.1The controller is the operator of the Taply Pay website and dashboard. For privacy requests, email support@taplypay.app with the email address of your Account.

1.2If we appoint a data protection officer or an EU/UK representative, we will publish those details on this page.

1.3Payment networks, Apple, Google, wallet applications, and third-party sync or funding interfaces are separate organisations. Their privacy notices apply to data they collect as controllers or processors when you use their products.

2.1This Policy covers the public website, registration, login, dashboard, cards, transactions, settings, support chat, admin-facing lead logs we generate from your use, and cookies or local storage on your device.

2.2It does not cover third-party websites we link to, merchant checkouts, Apple Wallet, Google Wallet, or the third-party modal used to sync a wallet or top up—except for the limited data those flows send back to us (for example a success or failure signal).

2.3If you are in a country that requires a local language version, a translation may be provided. If it conflicts with the English text, the English text prevails unless mandatory law says otherwise.

3.1Identity and account data: name or name derived from email, email address, password (stored in hashed or equivalent protected form in the product store), date of birth if you provide it for the 18+ check, language preference, and Account timestamps.

3.2Card data we generate for you: card product type (Everyday or Transfers), label, last four digits, expiry, brand, status, limits, balances, and, when you reveal them in the dashboard, the full number and security code. Treat those values as payment credentials.

3.3Wallet data: the fact that a Wallet is synced (a marker such as “synced”), not your recovery phrase and not private keys. We do not need a public address to mark a Card as synced. A third-party sync provider may process wallet identifiers on their side.

3.4Transaction data: merchant name or description, category, amount, fee, cashback, status, timestamps, and related Card identifiers.

3.5Usage and technical data: pages viewed in the product, onboarding step, events such as registration, login, card issue, wallet connect, top-up open or attempt, and spend; IP address; user-agent; approximate time; and similar device data sent by your browser.

3.6Support data: messages you send in chat, optional email if you are not logged in, and agent replies.

3.7Device storage: Account, Card, and session data may be kept in browser local storage on your device as well as on our servers, so the dashboard can work between visits.

3.8We do not intentionally collect special-category data (health, religion, biometrics as defined under GDPR). Do not send that data in support chat.

4.1Directly from you: registration, login, age check, settings, card actions, support chat, and forms.

4.2Automatically: cookies, local storage, logs, and events when you use the website and dashboard.

4.3From third-party interfaces: a signal that wallet sync or a funding attempt started or completed, without receiving your private keys.

4.4From payment networks or partners, if a Transaction, dispute, or freeze requires it.

5.1Where GDPR or UK GDPR applies, we rely on: performance of a contract (providing the Account, Cards, fees, and support); legitimate interests (security, fraud prevention, product improvement, defending legal claims), balanced against your rights; consent where we ask for it (for example optional cookies if we ever use them beyond what is necessary); and legal obligation where we must retain or disclose data.

5.2We use data to create and secure your Account, issue and operate Cards, apply published fees and cashback, show history, run onboarding, prevent abuse, answer support, improve the Services, and generate internal lead or funnel events (for example that a wallet was connected).

5.3We may use aggregated or de-identified data for statistics. We will not attempt to re-identify you from that data except as permitted by law.

5.4We do not use your data for automated credit scoring that produces legal effects about you. Automated fraud rules may decline a Transaction or freeze a Card; you can contact support to contest that.

6.1Processors who host, store, or transmit data on our instructions (for example cloud hosting, email, or support tooling), under contracts that require confidentiality and security.

6.2Wallet-sync and funding providers, when you open their interface. They may process IP address, device data, and wallet-related identifiers under their own notice.

6.3Apple, Google, card networks, acquirers, and merchants, to the extent needed to attempt a payment or add a Card to a phone wallet.

6.4Professional advisers, auditors, and prospective buyers in a reorganisation, under confidentiality.

6.5Competent authorities, courts, or networks when required or permitted by Applicable Law, or to protect users, us, or the public from harm.

6.6We do not sell personal data and we do not share it for third-party cross-context advertising.

7.1Servers, support, or processors may be located outside your country, including outside the EEA or UK.

7.2Where GDPR requires a transfer tool, we rely on an adequacy decision, standard contractual clauses, or another lawful mechanism. You can ask support@taplypay.app for more detail about the mechanism that applies to a processor.

8.1We keep Account and Card data while the Account is open and for a period after closure as needed for fees, disputes, security, and legal duties (for example tax or anti-abuse records).

8.2Support threads and lead/event logs are kept only as long as needed for those purposes, then deleted or archived in reduced form.

8.3Local storage remains on your device until you clear site data or log out in a way that wipes it. Clearing the browser does not always delete server-side records.

8.4To request deletion, email support@taplypay.app from your registered address. We may retain information the law requires, and we may refuse deletion that would prevent us collecting unpaid fees or investigating abuse.

9.1We use technical and organisational measures appropriate to the risk, including transport encryption (HTTPS), access control to admin tools, and hashing or equivalent protection of passwords in the product store.

9.2No method of transmission or storage is perfectly secure. You must protect your device, email, password, and Wallet. Anyone with your unlocked phone may see Card credentials in the dashboard.

9.3If we become aware of a personal-data breach likely to result in a high risk to you, we will notify you and, where required, the competent authority, in the manner and time the law requires.

10.1Where GDPR, UK GDPR, or similar law applies, you may have the right to access, rectify, erase, restrict, or object to certain processing, and to data portability.

10.2You may withdraw consent where processing is based on consent, without affecting earlier lawful processing.

10.3You may lodge a complaint with a supervisory authority in your country of residence, place of work, or place of the alleged infringement. We would like the chance to resolve the issue first at support@taplypay.app.

10.4To exercise rights, email support@taplypay.app. We may need to verify that the request comes from the Account holder. We will respond within one month, or explain if we need more time as the law allows.

10.5Some rights are not absolute. For example we may refuse erasure of records we must keep for fees, disputes, or legal obligation.

11.1We use strictly necessary storage to keep you logged in, remember language, and operate the dashboard (including local storage keys for Account state and locale).

11.2We do not currently use third-party advertising cookies. If that changes, we will update this Policy and, where required, ask for consent.

11.3You can block or clear cookies and site data in your browser. Doing so may log you out or reset language.

12.1The Services are for people aged 18 or over. We do not knowingly collect personal data from children.

12.2If you believe a minor has created an Account, contact support@taplypay.app. We will close the Account and delete data we are not required to keep.

13.1The website loads a third-party script that powers wallet sync and top-up. That script may set its own cookies or process IP and device data. Read that provider’s notice before you complete sync or funding.

13.2Apple Pay, Google Pay, Visa, Mastercard, and merchants process payment data under their rules. We do not control those processing operations.

13.3Links to other sites are not covered by this Policy.

14.1We may update this Policy. The date at the top of the page is the current version. Material changes will be indicated in the product or by email where reasonably practicable.

14.2Continued use after an update means you acknowledge the revised Policy. If you do not agree, stop using the Services and request Account closure.

15.1Privacy requests: support@taplypay.app.

15.2Do not send recovery phrases, private keys, or full Card numbers by email. Use last four digits when discussing a Card.