Privacy Policy

1. Who is responsible

TapYourShop, run from Pakistan, is responsible for the website and the service. For the content a shop puts on its own page (menu, prices, contact numbers) the shop is responsible.

2. Customers of a shop (people who tap or scan a card)

• No account, no name, no phone number, no email, no payment card details are asked for or stored.
• We count scans (time, which kind of tap or scan, the language) so the owner can see how many people use the page. The count carries no IP address and no device identifier.
• If a customer chooses to send a private note, we store the star rating, the topics they ticked and the note they typed. Please do not put personal details in the note. Only that shop’s owner can read it. Kept 2 years.
• A waiter, bill or water request stores the table, the kind of request, how the customer says they will pay and the bill total, with the time. No names or card numbers. Kept 400 days.
• Games between two tables send only numeric moves, no names and no chat. They are deleted within hours.
• We do not use advertising or tracking cookies and we do not sell data. The page may keep small settings on the customer’s own phone (for example the chosen language and whether the voice is on). Nothing is sent from there to us.
• Pressing the Google review, Maps, Instagram, Facebook or WhatsApp buttons opens that company’s site or app, which has its own privacy rules.

3. Shop owners, staff and administrators

• We store the email address you sign in with and, if you give them, your name and WhatsApp number. We use them to let you sign in and to contact you about the service.
• Sign-in uses one-time codes. We keep a record of sign-ins and of changes made in the owner and admin screens (the audit log) for 18 months, to protect your shop.
• Session cookies keep you signed in. They are strictly necessary, HttpOnly and secure; only a hash of the session is stored.
• If staff turn on phone alerts, we store the phone’s push address until they turn it off.
• Payments you make to us are recorded (date, amount, method, the period paid) for our accounts.

4. People who contact us (booking and call-back form)

• Every question on the form is optional. If you send the form we store what you typed (for example your name, phone or email, city, kind of shop and the links you shared) so that we can contact you.
• These enquiries are kept for 12 months and then deleted automatically. We can delete yours sooner on request.
• If you use “Send on WhatsApp” instead, the message goes through WhatsApp, which has its own privacy rules.

5. Who else handles data

• Cloudflare hosts the website and stores the database and files (Cloudflare, Inc.; servers around the world).
• A mail service sends our sign-in emails and, if you chose it, new-enquiry emails to us.
• If an owner reads a menu from a photo with AI, the photo is sent once to the AI provider (Anthropic) to read the text and is not stored by us. This is optional and only works when we have turned it on.
• If spoken voice is turned on and a phone has no voice of its own, the words to be read (menu names, fixed phrases, never anything a customer typed) may be turned into speech by Microsoft Azure Speech. Most phones read aloud with their own built-in voice, which sends nothing anywhere.
• We do not give personal data to anyone else unless the law requires it.

6. How long we keep data

• Scan counts and waiter/bill requests: 400 days. Private feedback: 2 years. Audit log: 18 months. Enquiries from the form: 12 months.
• Account details: while you use the service; removed when your shop is deleted.
• Backups of the database are kept for 35 days.

7. Your rights

• Ask what we hold about you, ask us to correct it, or ask us to delete it: message us on WhatsApp or use the Contact us page.
• Shop owners can download all their shop’s data in the app (Settings, Your data) and ask us to delete the shop and everything in it.
• If you are not happy with how we handled your data, tell us first; you may also complain to the data protection authority that applies to you.

8. Security

Secrets are kept outside the code, traffic uses HTTPS, one shop can never read another’s data, sign-in codes and session tokens are stored hashed, uploaded files are checked, and guest forms are protected against spam and abuse. No system is perfect; if we ever find a breach that affects you, we will tell you.

9. Children

The pages are made to be safe for children to use while waiting: no accounts, no chat, no names, no outside links in the games. We do not knowingly collect children’s personal data.

10. Changes

If we change this policy we will change the date at the top and, for important changes, tell shop owners directly.

11. Contact

Questions or requests about your data: use the Contact us page or message us on WhatsApp.