Privacy Policy

This policy applies to the TapTally customer mobile app, TapTally websites, the owner portal at portal.taptally.ca, generated customer links that may use go.taptally.ca, and related services we provide for digital loyalty cards, stamp tracking, reward redemption, and business dashboards.

Businesses that create loyalty programs through TapTally are responsible for the offers they publish and for giving their customers any additional notices required for their specific loyalty program.

• Business and account information: business name, owner or staff name, email address, phone number, login credentials, plan details, business profile, and support messages.
• Loyalty program information: reward rules, stamp counts, locations, QR/NFC links, staff permissions, redemption notes, and program settings.
• Customer profile information: name, email address, phone number, date of birth, optional profile photo, authentication provider identifiers, and customer identifiers needed to open or recover an account. The mobile app uses the system photo picker only after the customer chooses to add or replace a photo.
• Customer loyalty information: enrolled cafés and locations, saved loyalty cards, stamp and reward progress, visit history, redemption activity, and loyalty-program interactions.
• Customer support information: support category, subject, message, contact details, platform, app version, build number, and related café context submitted through Support & Feedback.
• Notification information: Expo push token, mobile platform, app version, notification preferences, and delivery information needed to send reward updates and opted-in café offers.
• Payment and billing information: subscription status, invoices, billing contact details, and payment processor records. We do not intend to store full payment card numbers on TapTally servers.
• Technical, map, and usage information: IP address, device/browser type, pages viewed, approximate location derived from IP, error logs, diagnostics, analytics events, map interactions, and security signals. With permission, the mobile app processes precise device location to show the user on the café map.

• Create and manage business accounts, staff access, loyalty cards, stamps, rewards, and customer links.
• Provide the owner portal, customer card pages, QR/NFC flows, support, troubleshooting, and account notifications.
• Send opted-in reward updates and café offers. Users can change notification preferences or disable notifications in device settings.
• Prevent fraud, misuse, duplicate accounts, unauthorized access, and abuse of loyalty rewards.
• Measure product performance, improve onboarding, understand repeat-visit behavior, and decide which MVP features to build next.
• Process subscriptions, billing, taxes, receipts, plan changes, renewals, cancellations, and failed payment notices.
• Comply with legal obligations, enforce our terms, and respond to lawful requests from courts, regulators, or government authorities.

TapTally is designed around Canadian private-sector privacy principles, including accountability, identifying purposes, meaningful consent, limiting collection, limiting use and retention, safeguards, openness, individual access, and challenging compliance.

We seek to explain what we collect, why we collect it, who we share it with, and what choices are available. Where express consent is required by applicable law, we will seek express consent. Consent may be withdrawn where legally and contractually possible, though withdrawal may limit access to parts of TapTally.

If you provide your phone number for TapTally owner portal onboarding or account verification, we use it to send one-time verification codes and account security messages. Message frequency varies based on onboarding and account verification activity. Carrier message and data rates may apply.

SMS opt-in data and consent are used only to provide TapTally verification and account security messaging. We do not sell, rent, share, or transfer SMS opt-in data or consent with third parties for marketing or promotional purposes.

You can reply STOP to stop receiving verification texts or HELP for help. If you opt out of verification texts, some account access or recovery features may not work until another verification method is available or you opt back in.

We do not sell personal information. We may share information with service providers and partners only as needed to operate TapTally.

• Cloud hosting, database, authentication, storage, security, and infrastructure providers.
• Payment processors, subscription management tools, accounting providers, and tax tools.
• Analytics, product monitoring, email, support, and customer communication tools.
• Professional advisors, insurers, auditors, law enforcement, regulators, or courts where required or appropriate.
• A business account and its authorized staff, where a customer joins that business's TapTally loyalty program.

When a customer joins a loyalty program through a business using TapTally, that business and its authorized staff may see the customer's name, optional profile photo, email address, phone number, date of birth, loyalty-card status, stamps, visit history, reward progress, and redemption activity needed to operate and support that program. A profile photo is not public and is shown through short-lived access links only to the customer and authorized staff of businesses the customer has joined.

Businesses must use customer information only for lawful loyalty, rewards, support, and customer-service purposes. Businesses should not upload information to TapTally unless they have the right to do so.

If location permission is enabled, the mobile app uses precise device location locally to center the map, show the customer's position, and display nearby café locations. TapTally does not send or store the device's precise GPS coordinates in the TapTally customer database.

Apple Maps or Google Maps components may process location, IP address, device and SDK information, map interactions such as panning and zooming, crash information, and diagnostics under their own platform and service terms. Android's Google Maps SDK may generate a pseudonymous Maps SDK identifier and process this information to operate and improve Google's services.

TapTally may use cookies, local storage, and similar technologies for essential site functionality, authentication, security, analytics, and product improvement. Analytics helps us understand page views, button clicks, device type, referral source, approximate geography, and feature usage.

You can control cookies through your browser settings. Disabling some cookies may affect portal sign-in, saved sessions, or product functionality.

• Active business accounts: retained while the account remains active and as needed to provide TapTally.
• Customer loyalty data: retained while needed for the loyalty program, business reporting, fraud prevention, legal compliance, or a reasonable backup period.
• Deleted customer accounts: direct profile information, the stored profile photo, authentication identities, push-token associations, and user-linked support messages are deleted or de-identified. Active cards are archived and available rewards are voided.
• Limited retained records: de-identified loyalty transactions, security, fraud-prevention, dispute, legal, tax, and backup records may remain for a reasonable period where necessary.
• Aggregated or anonymized data: may be retained to improve TapTally, measure product performance, and understand business trends without identifying an individual.

We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, collection, use, disclosure, copying, modification, disposal, or destruction.

No internet service can be guaranteed perfectly secure. Businesses and staff are responsible for keeping credentials confidential and limiting staff access to people who need it.

TapTally does not sell personal information, use third-party advertising trackers, or track customers across other companies' apps and websites for advertising. Café offers sent through TapTally are first-party loyalty communications controlled through notification preferences.

TapTally may process and store information in Canada, the United States, or other countries where our service providers operate. When information crosses borders, it may be subject to the laws of that jurisdiction.

We use contractual, technical, and organizational measures designed to keep service providers accountable for the personal information they process for TapTally.

Subject to applicable law, you may request access to your personal information, correction of inaccurate information, withdrawal of consent, deletion where available, and information about how we handle your data.

To exercise privacy rights, contact hello@taptally.ca. We may need to verify your identity before responding.

TapTally customers can also review the dedicated account deletion instructions, including how to request deletion without reinstalling the mobile app.

Where Quebec's private-sector privacy law or another substantially similar provincial privacy law applies, additional rights and obligations may apply, including rights related to access, rectification, portability, withdrawal of consent, de-indexation or cessation of dissemination in certain cases, and privacy impact assessments for certain projects.

TapTally's designated privacy contact is reachable at hello@taptally.ca.

TapTally is intended for local businesses and their customers. We do not knowingly create TapTally business owner accounts for children under 13. If a loyalty program is used by a minor, the business operating that program is responsible for any notices or consents required for its customer relationship.

If we become aware of a breach of security safeguards involving personal information under our control, we will assess the incident and notify affected individuals, businesses, privacy regulators, or other parties where required by applicable law.

We may update this Privacy Policy as TapTally evolves. The updated version will be posted on this page with a new last-updated date.

For privacy questions, contact hello@taptally.ca. For general business questions, contact hello@taptally.ca.