Privacy policy

Last updated: [DATE]

Draft. This is a starting template, not legal advice. Fill in the bracketed details and have it reviewed before the site goes live.

Who we are

Tapfolio is run by [YOUR NAME / COMPANY NAME, company number if any], [ADDRESS], Northern Ireland. We are the controller of the personal data described here. We serve customers in the United Kingdom and Ireland, so we follow the UK GDPR and, for customers in Ireland, the EU GDPR. ICO registration number: [ICO REF]. [EU representative: name and address, if one is required.] Contact us about privacy at [PRIVACY EMAIL].

What we collect

  • Enquiries: the name, business name, email, phone number and message you send through our order form.
  • Orders: delivery address and order details. Payments are handled by [PAYMENT PROVIDER, e.g. Stripe]. We never see or store your full card number.
  • Your account and profile: your login email, and the details you choose to publish on your card's profile page, such as your name, job title, phone, email, website, address, social links, photo or logo, and any payment links or bank details you add so customers can pay you. We never take or handle payments ourselves.
  • Card taps: when someone taps or scans a card we record the time and the type of device (iPhone, Android or computer). We do not store IP addresses or use tracking cookies.

Why we use it

  • To reply to your enquiry and give you a quote (our legitimate interest in responding to you).
  • To make, send and support your card and run your profile page (to perform our contract with you).
  • To keep records for tax and accounting (legal obligation).

We do not sell your data or use it for advertising.

Your public profile

Your profile page is public by design: anyone who taps or scans your card, or has the link, can see it and save your details. Only add details you are happy to share. You can edit or hide any field, or ask us to take your profile down, at any time.

Who we share it with

Only the services we need to run Tapfolio: Supabase (database and logins), Vercel (hosting), [CARD SUPPLIER: receives only the card web address to encode, plus your artwork], [PAYMENT PROVIDER] and [EMAIL PROVIDER]. Some may process data outside the UK under approved safeguards.

How long we keep it

Enquiries that do not lead to an order: [e.g. 12 months]. Customer and order records: [e.g. 6 years, for tax purposes]. Profile data: while your profile is active, then deleted [e.g. 30 days] after you ask us to close it.

Your rights

You can ask to see, correct, delete or move your data, or object to how we use it. Email [PRIVACY EMAIL] and we will respond within one month. If you are unhappy with how we handle your data, you can complain to the data protection regulator where you live: in the UK (including Northern Ireland), the Information Commissioner's Office; in Ireland, the Data Protection Commission.

Cookies

We use a cookie only to keep you signed in to your dashboard. We do not use cookies for tracking or advertising. [Update this, and add a consent banner, if you add analytics that use cookies.]