Privacy Policy

a) Your account data. Name, email address and profile picture. If you sign in with Google, we receive them from your Google account (scopes openid, email and profile). If you still use an email address and password, the password is stored encrypted by our authentication provider and we never see it.

b) Google Business Profile data. If you connect your business profile, with your express authorisation (scope https://www.googleapis.com/auth/business.manage) we access:

• The list of business accounts and listings you manage: name, address, phone number, website, Google Maps identifier and coordinates.
• The reviews of those listings: the author's name and public photo, rating, text, date and the owner's reply, if any.
• The cover photo of the listing, to display it in your dashboard.

The only write action we perform on your Google profile is publishing or editing the reply to a review, and only when you click «Publicar en Google» (Publish on Google). We do not modify your listing, delete reviews or publish anything on our own initiative.

c) Subscription and billing data. The plan you have subscribed to, the tax and shipping details you provide (name or company name, tax ID (NIF), address, phone number) and your payment history. Your card details are processed directly by Stripe; we neither see nor store them.

d) Sales contact data. If you fill in a form or leave us your name and phone number when signing up, we use them to assist you and for sales follow-up.

e) Usage data. Pages visited, device and browser, and measurement and advertising cookies (see the Cookie Policy). When a customer of your business scans a Tapi, we record the visit (date, browser and IP address) to provide you with statistics and to prevent abuse.

• To create and maintain your account and identify you when you sign in.
• To show you in your dashboard the reviews and statistics of your businesses (average rating, distribution, response rate and response time).
• To generate, when you ask for it, a suggested reply to a review using artificial intelligence, and to publish it on Google when you confirm it.
• To allow the members you invite to your business to view and reply to its reviews.
• To manage your subscription, payments, invoices and the shipping of your Tapi devices.
• To respond to your enquiries and send you communications about the service.
• To compile website usage statistics with Google Analytics, if you accept analytics cookies.
• To measure the performance of our advertising campaigns on Meta (Facebook and Instagram).
• To ensure the security of the service and comply with legal obligations (for example, tax obligations).

Tapi's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We only use Google data to provide and improve the dashboard features that you see and use (viewing and replying to reviews, statistics).
• We do not sell that data or use it for advertising, to build user profiles or to make credit or insurance decisions.
• We do not transfer it to third parties except to the providers needed to deliver the service (section 5), where required by law or with your consent.
• No one at Tapi reads your Google data unless you give us permission to help you with an issue, it is necessary for security purposes or it is required by law.
• We do not use data obtained from Google APIs to develop, improve or train generalized artificial intelligence or machine learning models.

• Performance of the contract: providing the service you subscribe to, including the access to your Google Business Profile that you authorise.
• Consent: connecting your Google account and commercial communications. You can withdraw it whenever you wish.
• Legal obligation: invoicing and retention of accounting records.
• Legitimate interest: security of the service, prevention of abuse and responding to those who contact us.

We do not sell personal data. We only share it with providers that help us deliver the service, which process it on our behalf under a data processing agreement:

• Supabase — database and authentication (servers in the European Union).
• Vercel — hosting of the website and our API.
• OpenAI — only when you ask for an AI reply: we send it the text and rating of that review and the author's first name. Under its API terms, OpenAI does not use this data to train its models.
• Google — sign-in and Google Business Profile, to read your listings and reviews and publish the replies you confirm.
• Stripe — subscription payments and invoicing.
• Meta — measurement of advertising campaigns (Meta pixel on the website and Conversions API when you sign up). We never send it data obtained from Google.
• ClickUp — internal management of sales contacts (name, email address and phone number).
• Zoho Mail — sending service emails.

Data obtained from Google: it is only received by Supabase and Vercel (to store it and show it to you) and OpenAI (only the text, rating and first name of the review you decide to reply to with AI). The other providers never receive Google data.

Some of these providers are located in the United States. In those cases, the transfer is covered by the EU-U.S. Data Privacy Framework or by standard contractual clauses approved by the European Commission.

• Your account and Google Business data, for as long as your account is active.
• If you revoke Tapi's access to your Google account, we stop using your access tokens as soon as Google notifies us and we do not sync your data again.
• If you ask us to delete your account, we delete your data, including the data obtained from Google, within a maximum of 30 days.
• Invoices and tax data, for the period required by law (generally 6 years).
• Sales contacts, until you ask us to delete them.

You can withdraw Tapi's access to your Google account at any time at myaccount.google.com/connections. From that moment on we will stop syncing your reviews. To delete your account and all your data, email us at info@tapinfc.com.

All information is encrypted in transit (HTTPS/TLS) and stored encrypted at rest on our database provider's servers. Access to data is restricted by permissions: each user can only see the businesses they own or are a member of. Google access tokens are stored on protected servers and are used only for the functions described. We review these measures periodically.

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability by writing to info@tapinfc.com. We will reply within one month. If you consider that we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

Tapi is a service for businesses and is not aimed at children under 16. We do not knowingly process their data.

If we make material changes to this policy we will notify you by email or in the dashboard. The date of the last update appears at the top of this page.