Privacy Policy

Tappy (“we”, “us”, or “our”) operates the Tappy prepaid RFID wallet platform at rfxinvoice.cloud and related subdomains. This Privacy Policy explains how we collect, use, disclose, and protect information when you use our services.

By using Tappy you agree to the collection and use of information as described in this policy.

Business owners. When you create a Tappy account we collect your email address, business name, and authentication credentials. We also store your business configuration (tap discount rate, branding preferences, and subdomain slug).

Customers (card holders). We store the RFID card identifier, display name (if provided), wallet balance, and transaction history (top-ups, charges, and refunds) associated with each card. We do not require customers to create an account or provide an email address.

Automatically collected. We collect standard web-server logs including IP address, browser type, referring page, and pages visited. We use Cloudflare for hosting which may collect additional analytics data as described in Cloudflare's Privacy Policy.

• Operate and maintain the Tappy platform and your wallet.
• Process transactions (top-ups, charges, refunds).
• Provide your white-labelled customer portal.
• Send service-critical communications (e.g. security alerts).
• Detect and prevent fraud or abuse.
• Improve our product and infrastructure.

We do not sell, rent, or trade your personal information. We may share data with:

• Service providers that help us operate (e.g. Firebase for authentication and database, Cloudflare for hosting and CDN).
• Law enforcement when required by applicable law or to protect our legal rights.

We retain business account data for as long as your account is active. Transaction and wallet data are retained for the duration of the business relationship plus any period required by law. You may request deletion of your data by contacting us.

We implement industry-standard security measures including encrypted connections (TLS), Firebase security rules, and access controls. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

We use essential cookies and browser local storage for authentication sessions and user preferences. We do not use third-party advertising or tracking cookies.

Tappy is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the effective date. Continued use of Tappy after changes constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy, please reach out via the contact details provided in your Tappy dashboard or email us at the address listed on our website.