Privacy & security
Your connections, handled with care.
What happens to data when someone taps your card, what we never keep, and how it's protected. The privacy policy is the full version; this is the plain one.
When someone taps your card
We count the tap, not the person.
Each tap, scan or view records what you need to see how your card is doing, and nothing that follows anyone around.
- Recorded
- Which profile and card, the kind of event, a coarse device type and an approximate country and region.
- Not stored
- The visitor's IP address. There's no column for it; it's only used, hashed, to stop abuse.
- No tracking
- No ad networks and no cross-site tracking. Our own counting uses no cookie.
- Their choice
- If a visitor sends you their details, they decided to. That record belongs to you.
Your data, your control
Yours to take, change or delete.
Export anytime
Download your leads as CSV from the dashboard whenever you like.
Close your account
Do it yourself in Settings. Your cards stop opening at once, and you can change your mind.
Erase on request
We delete profiles, leads and analytics for you, and return physical cards to inventory.
Kept no longer than needed
Individual analytics events are deleted automatically after thirteen months.
Never sold
We don't sell personal data — yours, or that of the people you meet.
Where it lives
The database and files are hosted in the United States.
Security
Protected in the database itself.
Row-level security
Access is enforced by the database, so an account can only read its own rows, even if the app asked for more.
Two-factor sign-in
Available to every account. Passwords are hashed by our authentication provider and never visible to us.
Encrypted in transit
Every connection to TapQip is encrypted.
Payments on Stripe
Card details are entered on Stripe and never pass through our servers.
Who else touches it
The companies that process data for us.
Each one, what it's for, and what it's given. Some only come into play when you switch them on for your own card.
| Company | What for | What it's given |
|---|---|---|
| Supabase | Database, authentication and file storage | Everything the product stores: accounts, profiles, leads, analytics and billing records. |
| Vercel | Application hosting and content delivery | Requests to the site, including IP address and user agent, as any web host receives them. |
| Stripe | Payments and subscriptions | Name, email and payment details, which are entered on Stripe and never pass through our servers. |
| Resend | Transactional email | The recipient's address and the contents of the message being sent. |
| Apple, Google | Wallet passes | The name, title and contact details printed on the pass, when a cardholder chooses to add one. |
| Google Analytics | A cardholder's own visitor analytics — only if you switch it on | Page views on that cardholder's public card only, and only while they have supplied their own measurement ID. |
| Google Calendar | A cardholder's own calendar, for meeting booking — only if you switch it on | Busy and free times read from that calendar, and the details of meetings booked with the cardholder written to it as events, only while they have connected it. |
From the privacy policy, last updated 16 October 2026.
Questions about your data?
Write to support@tapqip.com. We'll help, rather than send you looking for a form.