Privacy Policy

Tappa ("Tappa", "we", "our", or "us") provides an NFC-based digital business card and networking service through the Tappa mobile application and the tappa.me website (together, the "Service"). Tappa is the "data controller" responsible for the personal data described in this policy.

This Privacy Policy explains how we collect, use, share, and protect your personal data, and the rights you have. We are committed to processing your data lawfully, fairly, and transparently.

We comply with the Nigeria Data Protection Act 2023 (the "NDPA") and the Nigeria Data Protection Regulation 2019 (the "NDPR"), and, where they apply to you, the EU General Data Protection Regulation (the "GDPR") and the UK GDPR. If you do not agree with this policy, please stop using the Service.

Questions or requests about your data can be sent to fixit@tappa.me or via tappa.me/contact.

Information you provide directly: • Account data: your name, email address, and a password (which we store only in hashed form via our authentication provider). • Profile data: job title, company, phone number, website, social and payment links, username, profile photo, and banner image that you choose to add. • NFC device data: the names, types, and tag identifiers you assign to the NFC cards, rings, stickers, or tags you register. • Payment data: when you subscribe or shop on the web, payment is processed by Paystack; on mobile, by the Apple App Store or Google Play. We receive transaction status, plan, and limited billing metadata. We never receive or store full payment card numbers. • Support and communications: messages you send us through the in-app support chat (including our AI assistant), the contact form, or email. • Gunther chat: the messages you send to Gunther, the AI character in the app, and its replies. If you send a photo, it is used to write the reply and is not stored. If you rate or report a reply, we keep that feedback. • Gunther introductions: connection requests you send or receive through Gunther, including the message written with them, and whether they were accepted, declined or reported. • Gunther memory (optional, off by default): if you turn it on, short notes Gunther saves about you (for example your goals or what you are working on) so it can recall them in later chats.

Information collected automatically: • Usage data: features you use, screens you visit, profile view counts, and NFC tap counts associated with your account. • Device and technical data: device type, operating system and app version, access times, error and log data, and IP address. • Security data: a bot-protection token generated by Google reCAPTCHA on the website. • Push notification tokens, if you enable notifications.

NFC data: We read NFC tags only when you actively initiate a scan within the app. We never read NFC data in the background. Content you scan is processed on your device to display results and is not transmitted to us unless you take an action on it (such as opening a Tappa profile).

Under the NDPA, NDPR, and (where applicable) the GDPR, we only process your personal data where we have a lawful basis to do so:

• Performance of a contract: to create and manage your account, display your public profile, and provide the features you request. • Consent: for optional activities such as marketing emails, push notifications, and choosing which profile fields to make public. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out. • Legitimate interests: to secure the Service, prevent fraud and abuse, debug problems, and improve our features, balanced against your rights and freedoms. • Legal obligation: to comply with applicable law, tax, accounting, and lawful requests from authorities.

We do not carry out solely automated decision-making that produces legal or similarly significant effects on you. Where we process the data of a child or any sensitive category of data, we rely on explicit consent (including verifiable parental or guardian consent for minors).

We use your personal data to: • Create, secure, and manage your account and profile. • Display your public profile when someone views your Tappa link or taps your NFC device. • Provide analytics on profile views and NFC device taps. • Process subscriptions and shop orders (via Paystack, Apple, or Google). • Provide customer support, including responding through our AI assistant and human team. • Provide Gunther chat. To reply, Gunther uses your message, the earlier messages in your chat, your name and the work details on your Tappa card, your plan and level, your company workspace (if you belong to one) and, only if you turned it on, your Gunther memory. When you ask about people you know, Gunther searches your own connections (names, job titles, companies, industries, how you met and your notes) and never sees their phone numbers or email addresses, or anyone else's connections. • Suggest people through Gunther (Gunther introductions). If you turn on "Show me in search", other Tappa users can find you by username, and Gunther can suggest you to someone looking for a person with your role or skills. A suggestion shows your first name and last initial, your photo, the job title and company on your Tappa profile (only if you show them publicly), how many connections you have and how many you share. It never shows your username, contact details or location. Suggestions are ranked by how well your job title fits, how many connections you have, mutual connections, how complete your profile is and how recently you used Tappa. Sending introductions is a Tappa Pro feature. If someone sends you a request, you see their name, work details and message, and you choose to accept, decline or report it. Only if you accept do you both appear in each other's connections, with the details your Tappa profile shares publicly. You can turn "Show me in search" off at any time, and Gunther stops suggesting you within a few minutes. Users under 18 are never suggested and cannot send introductions. • Send transactional messages (verification, password reset, receipts, security notices). • Send optional product updates and marketing, where you have consented. • Detect, prevent, and investigate fraud, abuse, and security incidents. • Improve the Service through aggregated, and where possible anonymised, analytics. • Comply with our legal obligations.

We do not sell your personal data, and we do not use it for third-party or cross-context behavioural advertising.

We share personal data only with the service providers ("data processors") that help us run the Service, under contracts that require them to protect your data and use it only on our instructions:

• Google Firebase / Google Cloud (Google LLC / Google Ireland): authentication, database (Cloud Firestore), file storage, push messaging, and reCAPTCHA. • Vercel Inc.: hosting of the tappa.me website. • Paystack: payment processing for web subscriptions and shop orders. • Apple App Store and Google Play: subscription billing on mobile. • Resend: sending transactional and account emails. • Anthropic (Claude): powering our AI support assistant and Gunther chat. When you use either, the content of your messages (and any photo you send Gunther), together with the context described in section 4, is processed to generate a reply. Anthropic does not use this data to train its models. Please do not share sensitive personal data in the chat.

Some of these providers are located outside Nigeria and the European Economic Area (for example, in the United States). When we transfer personal data across borders, we rely on a lawful transfer mechanism, such as an adequacy decision, Standard Contractual Clauses, the provider's binding data protection commitments, or your explicit consent, so that your data continues to be protected to NDPA and GDPR standards.

We may also disclose personal data where required by law, to enforce our Terms, or to protect the rights, safety, and property of Tappa, our users, or the public.

When you create a Tappa profile, the fields you choose to make public (such as name, photo, job title, company, contact details, and links) become publicly accessible at your profile URL (tappa.me/yourusername).

You control what appears on your public profile. You can update or remove any field at any time from within the app, and you can set different visibility for individual NFC devices. Removing a field removes it from your public profile immediately.

Your profile URL may be indexed by search engines. If you delete your account, your profile is removed and the URL becomes unavailable, although cached copies may persist briefly in third-party search indexes outside our control.

The tappa.me website uses only strictly necessary cookies and local storage, for example to keep you signed in, to secure forms (reCAPTCHA), to remember a referral code, and to store your cookie choices. We do not use advertising cookies or cross-site tracking pixels. Analytics and marketing cookies are opt-in and off by default; if we ever introduce them, they will run only after you allow them. See our Cookie Policy at tappa.me/cookies for the full list, and use the "Cookie preferences" control in the footer to review or change your choices at any time.

You can control or delete cookies through your browser settings. Disabling strictly necessary cookies may prevent parts of the Service from working.

We retain your account and profile data for as long as your account is active. If you delete your account, we delete your profile data, uploaded images, and associated analytics within 30 days, except where we are required to retain certain records (for example, transaction records for tax and accounting) for the period required by law.

Support messages are retained for as long as needed to resolve your query and for a reasonable period afterwards. Gunther chat messages are deleted automatically after 30 days, and you can clear your chat at any time from the chat menu. Photos you send Gunther are not stored. Gunther memory is kept until you delete it: you can see every saved note, delete any of them, or turn memory off (which deletes them all) from the chat menu. Ratings and reports you give a Gunther reply, with the reply and your message before it, are kept for up to 180 days so our team can review them and improve Gunther. Gunther searches for people on Tappa are kept for 7 days so you can look through the results, then deleted. Introduction requests are kept until you delete your account; a request nobody answers expires after 30 days. Reports about an introduction are kept for up to 12 months for review. Deleting your account deletes your Gunther chat, memory, searches and introduction requests. Log and security data is retained for up to 90 days. Aggregated or anonymised statistics that cannot identify you may be retained for service improvement.

Subject to the conditions and exemptions in the NDPA, NDPR, and (where applicable) the GDPR, you have the right to:

• Access: obtain confirmation of, and a copy of, the personal data we hold about you. • Rectification: have inaccurate or incomplete data corrected. • Erasure: request deletion of your account and associated data ("right to be forgotten"). • Restriction: ask us to limit how we process your data in certain circumstances. • Portability: receive your data in a structured, commonly used, machine-readable format. • Objection: object to processing based on our legitimate interests, and to direct marketing at any time. • Withdraw consent: withdraw any consent you have given, at any time.

To exercise any of these rights, email fixit@tappa.me. We may need to verify your identity, and we will respond within 30 days (extendable where the law permits). Exercising your rights is free unless the request is manifestly unfounded or excessive.

You also have the right to lodge a complaint with a supervisory authority. In Nigeria, this is the Nigeria Data Protection Commission (NDPC). In the EEA or UK, you may complain to your local data protection authority (in the UK, the Information Commissioner's Office).

The Service is intended for users aged 16 and over. Where you are below the age of digital consent that applies in your country (but at least 13), you may use Tappa only with the verifiable consent of a parent or guardian. Under the NDPA, a child is a person under 18, and the processing of a child's data requires parental or guardian consent. For users under 18, Gunther only helps with Tappa and light, age-appropriate conversation, and Gunther memory is not available.

We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data without the required consent, contact us at fixit@tappa.me and we will delete it promptly.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, loss, or destruction. These include encryption of data in transit (TLS), database access controls (Firebase Security Rules), hashed credential storage, least-privilege access for our team, and optional two-factor authentication on your account.

No method of transmission or storage is completely secure. While we work hard to protect your data, we cannot guarantee absolute security, and you are responsible for keeping your password confidential.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission (and, where the GDPR applies, the relevant supervisory authority) without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to you, we will also notify you without undue delay.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through an in-app or on-site notice. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy, wish to exercise your rights, or want to reach our data protection contact, please contact us:

Email: fixit@tappa.me Website: tappa.me/contact

Supervisory authority (Nigeria): Nigeria Data Protection Commission (NDPC), ndpc.gov.ng.

We aim to acknowledge privacy enquiries within 5 business days and to resolve them within the timeframes required by law.