Draft — not yet reviewed by a lawyer. Replace every [SQUARE BRACKET] with your real details and have this checked before you take real customers.
This notice explains what linkTap does with personal data. It covers two different groups of people, and it matters which one you are.
[YOUR LEGAL ENTITY NAME], [ADDRESS], [COUNTRY]. Contact: [YOUR CONTACT EMAIL].
If you are a cardholder (you bought a linkTap card), we are the data controller for your account. If you tapped someone's card and left your details, the cardholder is the controller of those details and we act as their processor — so a request to delete them is best sent to that person, though we will help.
| Data | Why | Basis |
|---|---|---|
| Your email address (cardholders) | To sign you in and identify your account | Contract |
| Profile name, role, bio, avatar, links | To render your public page — you chose to publish these | Contract |
| Tap records: date, country, city, referring site, browser type | So a cardholder can see how their card is used | Legitimate interest |
| A cookie identifying your device across visits | To tell a repeat visit from a new one | Consent — asked before it is set |
| Name, email, phone and message you type into a capture form | So the cardholder can follow up with you | Consent — the tick box on the form |
| Notes a cardholder writes about a person they met | The cardholder's own record of a conversation | Legitimate interest of the cardholder |
| A one-way hash of your network address | To stop automated traffic and repeated requests being counted as taps | Legitimate interest |
City and country come from the network connection at the moment of the tap. We do not store your IP address: it is combined with a secret key and hashed, and only the hash is kept. The hash cannot be turned back into an address, and it is used for one thing — to recognise that two requests seconds apart came from the same place, so that a page fetched by a scanner, a crawler or a script is not recorded as somebody tapping a card. We do not use any advertising or cross-site tracking.
Two cookies, both first-party. Neither is used for advertising.
Declining does not limit the page. The tap is still counted for the cardholder, but it is not connected to your device or to any previous visit. To withdraw consent, clear cookies for this site and answer differently next time.
Typefaces are served from this website itself, not from Google Fonts or any other font service, so loading these pages does not disclose your IP address to a third party.
We do not sell personal data, and we do not share it with anyone else except where the law requires it.
Account and profile data for as long as the account exists. Tap records and captured contacts for [RETENTION PERIOD, e.g. 24 months] unless deleted sooner. A cardholder can delete a contact from their dashboard at any time, which removes it for good.
Under the UK GDPR and EU GDPR you can ask for a copy of your data, ask us to correct or delete it, object to processing based on legitimate interest, and withdraw consent at any time. Email [YOUR CONTACT EMAIL] and we will reply within one month. You can also complain to your data protection authority — in the UK, the ICO at ico.org.uk.