Privacy Policy

Last updated: September 2026

This Privacy Policy explains what personal data TAP IN HERE collects, why, on what legal basis, and what rights you have. It is written to meet the EU General Data Protection Regulation (GDPR) and the UK GDPR, alongside India's Digital Personal Data Protection Act 2023.

1. Who is responsible for your data

The controller of your personal data is Ambivert Technologies Private Limited, operating TAP IN HERE (tapinhere.com), Pune, Maharashtra, India. You can reach us at [email protected] for any privacy matter, including to exercise the rights described in section 7.

We are not established in the EU. Where we are required to designate a representative in the Union under Article 27 GDPR, their details will be published here.

2. What we collect, why, and on what legal basis

We collect only what the service actually needs. Each category below states its purpose and its lawful basis under Article 6 GDPR.

Account information

Your email address and a password (stored only as a salted scrypt hash — never in readable form). We do not offer Google, Apple or other third-party sign-in, so we receive no data from any identity provider.

Purpose: to create and secure your account. Legal basis: performance of a contract (Art. 6(1)(b)).

Profile content

Whatever you choose to publish: display name, username, headline, bio, location, category, phone, WhatsApp number, public email, links, and — on business profiles — products, services and customer reviews.

This information is public. A TAP IN HERE profile goes live at tapinhere.com/<username> the moment you claim your username. There is currently no setting that makes a profile private. You can hide your profile from the public Discover listing while keeping your page reachable by direct link or QR code, and you can edit or delete any field at any time.

Purpose: to publish the page you asked us to publish. Legal basis: performance of a contract (Art. 6(1)(b)). Anything you type into a public field is published because that is the purpose of the product, so please do not enter information you do not want to be public.

Usage analytics

We record page views, link clicks and QR scans for your own profile statistics. This is deliberately built to avoid identifying visitors:

• We never store IP addresses. Your IP is not written to our database at any point.
• Visitors are counted using a truncated hash of page, IP, user-agent and a salt that rotates every day. The same person visiting on two days produces two unrelated values, so we can count "unique visitors today" without building any cross-day profile of anyone.
• We store approximate country, region and city, derived at Cloudflare's edge — we never handle the IP that produced them.
• Every figure shown to a profile owner is aggregated. No owner can see an individual visitor.

Purpose: to give a profile owner audience statistics and to keep the service working. Legal basis: legitimate interests (Art. 6(1)(f)) — measuring our own service with pseudonymous, non-cross-site, first-party data, which we consider a minimal privacy impact. You may object at any time (section 7).

"My Network"

If you save another member to your network, we store that connection. If you are signed in and view another member's profile, we record that you visited it, once per day, so that the owner can see who came by. Only signed-in members are ever recorded this way — visits by logged-out people are never attributed to anyone.

Purpose: to provide the networking feature. Legal basis: performance of a contract (Art. 6(1)(b)).

Payments

Paid plans are bought through PayU, which handles the transaction on its own systems. We never see or store your card number or payment credentials. PayU acts as an independent controller for the payment itself and applies its own privacy notice.

Purpose: to sell you a plan. Legal basis: performance of a contract (Art. 6(1)(b)) and, for retaining records, legal obligation (Art. 6(1)(c)).

Security and abuse prevention

We keep session records, rate-limit counters and an administrative audit log, and we use Cloudflare Turnstile to tell humans from bots on sign-up, sign-in and review submission.

Purpose: to protect accounts and prevent abuse. Legal basis: legitimate interests (Art. 6(1)(f)).

3. What we do not do

• We do not sell personal data.
• We do not use advertising or cross-site tracking cookies, and we run no third-party analytics or advertising tags.
• We do not profile you or make automated decisions producing legal or similarly significant effects (Art. 22).
• We do not send marketing email you did not ask for.

4. Who processes data for us

We keep the list of processors deliberately short:

• Cloudflare, Inc. — hosting, database, edge delivery and bot protection. Acts as our processor under a data processing agreement.
• PayU — payment processing, as described above.

5. International transfers

We are based in India and our production database is currently hosted in the United States (Cloudflare's North American region). If you are in the EEA or UK, using TAP IN HERE therefore involves transferring your personal data outside your jurisdiction.

These transfers rely on the safeguards in Article 46 GDPR — Standard Contractual Clauses in our agreement with Cloudflare, together with Cloudflare's certification under the EU–US Data Privacy Framework. You may request a copy of the relevant safeguards from [email protected].

6. How long we keep it

• Account and profile data — for as long as your account exists. On deletion we remove it within 30 days, except where law requires us to keep a record.
• Sessions — revoked immediately on sign-out; expired sessions are purged automatically after 30 days.
• Analytics events — automatically deleted after 400 days.
• Payment records — retained as long as tax and accounting law requires.
• Administrative audit log — retained for the life of the account, as an accountability record of moderation actions.

7. Your rights

If the GDPR or UK GDPR applies to you, you have the right to: access your data; rectify it; erase it; restrict processing; object to processing based on legitimate interests, including our analytics; data portability; and to withdraw consent where processing relies on it, without affecting prior processing.

Exercise any of these by emailing [email protected]. We respond within one month, as Article 12(3) requires. We will not charge you or make you justify the request.

You also have the right to lodge a complaint with a supervisory authority — in the EEA, the data protection authority of your country of residence, work or of the alleged infringement; in the UK, the Information Commissioner's Office. You may do so without contacting us first.

8. Cookies

We set only strictly necessary cookies, and we therefore do not show a consent banner. See the Cookie Policy for the full list and the reasoning.

9. Security

Passwords are stored as salted scrypt hashes. All traffic is encrypted in transit (TLS, with HSTS). We apply a strict Content-Security-Policy, CSRF protection on every state-changing request, per-route rate limiting, and role-based access control on administrative functions. Data at rest is encrypted by our hosting provider.

No system is perfectly secure. If a breach affects your rights, we will notify the competent supervisory authority within 72 hours and inform you directly where Article 34 requires it.

10. Children

TAP IN HERE is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes

If we make a material change we will update this page and, where the change significantly affects you, tell you by email before it takes effect.

12. Contact

Privacy questions and rights requests: [email protected]. General support: [email protected].