This Privacy Policy explains how TovTap, operated as a sole proprietorship ("TovTap", "we", "us", or "our"), collects, uses, and shares information when you visit our website, place an order, or interact with one of our NFC tap products. TovTap makes physical "Review us on Google" NFC tap stands, and previously tap cards, for small business owners such as cafes, salons, and shops. We are a US-based business, and we care about keeping your personal information safe and using it responsibly.
By using our website or products, you agree to the practices described in this policy. If you do not agree, please do not use our services.
Information we collect
We collect information in a few different ways, depending on how you interact with us:
- Contact and account details. When you sign up, subscribe to updates, or contact us, we collect information such as your name, email address, and business name. If you choose Google sign-in, we receive basic Google profile information (your name and email) to create and access your account.
- Order and shipping details. When you place an order, we collect your shipping address, billing details, the items you ordered, and any notes you provide.
- Payment information. Payments are processed by our payment provider, Stripe. TovTap never sees or stores your full card number. Stripe handles your card data directly under its own security standards, and we only receive limited confirmation details such as whether a payment succeeded.
- Tap analytics. When someone taps one of your TovTap cards, we log the visit so we can show the business simple analytics. This includes a hashed IP address, coarse geo location (country and city), and device information (whether it is a phone, tablet, or computer, along with the browser and operating system family). We also record what happened during that visit: the star rating chosen, whether the visitor went on to Google to leave a review, whether they sent private feedback instead, and roughly how long the review page stayed open. We record how the visitor arrived, meaning the referring website address if the browser sends one. We record how the page itself performed, such as how long it took to respond and become usable, and we count any errors the page hit while it was open, so we can tell a slow or broken page apart from a customer who simply changed their mind. We do not collect precise location, we never ask your browser or device for your location, and we do not create a fingerprint of your device. We do set one small first-party cookie on the review page, which holds a random value for up to 24 hours. Its only purpose is to avoid counting the same person twice if they reload the page or tap again during the same visit. It is never used to follow you across other websites, it is not shared with anyone, and you can delete it in your browser at any time. We do not sell this data.
- Private feedback. If a customer chooses to leave private feedback through the card's review page instead of a public Google review, we collect that feedback and share it with the business the card belongs to.
- Site usage. We use Vercel for hosting and privacy-friendly analytics (Vercel Web Analytics) to understand aggregate site traffic, such as which pages are visited. We also keep our own record of visits to this website, which includes the page, the referring website, a hashed IP address, your country and city, your browser and device family, your screen size, time zone and language, and a random first-party identifier stored in a cookie for up to a year so we can tell a returning visitor from a new one. This applies to this marketing website only. It is never used on the review pages your customers see when they tap a card. We do not build a fingerprint of your device, we do not track you across other websites, and we do not sell any of it.
- Cookies and similar technologies. We use a small number of cookies and similar technologies to keep the site working, remember preferences, and measure basic usage.
How we use your information
We use the information we collect to:
- Process and fulfill your orders, including shipping products and sending confirmations.
- Provide tap analytics and private feedback to the business a card belongs to.
- Communicate with you about your order, respond to support requests, and send transactional email.
- Maintain, secure, and improve our website and products.
- Comply with legal obligations and enforce our terms.
We send transactional email (such as order confirmations and shipping updates) through our email provider, Resend. Marketing emails include an unsubscribe link; opting out of marketing does not affect transactional emails (order, shipping, and account messages).
How we share your information
We do not sell or share your personal information (as "sell" and "share" are defined by the CPRA). We share information only in the following ways:
- Service providers. We share information with trusted providers who help us run our business, including Stripe (payments), Supabase (database and authentication), Resend (transactional email), Vercel (hosting and analytics), Cloudflare (DNS and email routing), and shipping carriers (to deliver your order). These providers may only use the information to perform services for us.
- Businesses that own TovTap cards. Tap analytics and private feedback tied to a card are shared with the business that owns that card.
- Legal reasons. We may disclose information if required by law, to protect our rights, or to prevent fraud or harm.
- Business transfers. If TovTap is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction.
Cookies and analytics
We aim to keep tracking minimal. Vercel Web Analytics is designed to be privacy-friendly and does not build cross-site advertising profiles of you. You can control cookies through your browser settings, though disabling some cookies may affect how the site works.
Data retention
We keep personal information only for as long as we need it for the purposes described in this policy, such as fulfilling orders, providing analytics to businesses, meeting legal and accounting requirements, and resolving disputes. Tap analytics are kept for as long as the business is using TovTap, so that the business can compare this month with last year. They are stored without your IP address or any name attached: the IP address is replaced by an irreversible hash at the moment of collection and the original is never written down. When information is no longer needed, we delete or anonymize it.
Security
We use reasonable technical and organizational measures to protect your information, and we rely on established providers like Stripe and Vercel for sensitive processing. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data.
Your privacy rights
Depending on where you live, you may have rights over your personal information, such as the right to access, correct, or delete it. To make a request, email us at hello@tovtap.com. We may need to verify your identity before acting on a request.
California residents (CCPA)
If you are a California resident, you have specific rights under the California Consumer Privacy Act:
- The right to know what personal information we collect, use, and share.
- The right to request deletion of your personal information, subject to legal exceptions.
- The right to correct inaccurate personal information we hold about you.
- The right to opt out of the sale or sharing of your personal information. TovTap does not sell or share personal information (as "sell" and "share" are defined by the CPRA), so there is nothing to opt out of, but we honor this right.
- The right not to be discriminated against for exercising your privacy rights.
To exercise any of these rights, contact us at hello@tovtap.com.
Users outside the United States
If you are in the European Economic Area, the United Kingdom, or another region with data protection laws such as the GDPR, you may have additional rights, including the right to access, correct, delete, restrict, or object to certain processing, and the right to data portability. You may also lodge a complaint with your local supervisory authority. Contact us at hello@tovtap.com to exercise these rights.
Children
Our website and products are intended for business owners and are not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us so we can remove it.
International transfers
TovTap is based in the United States, and our providers may process and store information in the United States and other countries. If you access our services from outside the United States, you understand that your information may be transferred to and processed in the United States, where data protection laws may differ from those in your country.
Changes to this policy
We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. Significant changes may be communicated by email or a notice on our site. Continued use of our services after an update means you accept the revised policy.
Contact us
If you have questions about this Privacy Policy or how we handle your information, email us at hello@tovtap.com or write to us at 88 E San Carlos St, Unit 612, San Jose, CA 95112, United States.
This page is available in English only. The English version is the governing version.