Privacy Policy

Effective: March 24, 2026

TapVend LLC (“TapVend,” “we,” “us”) operates the TapVend platform at tapvend.app. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.

1. Information We Collect

From Vendors (Account Holders)

• Email address (used for authentication via one-time passcode)
• Full name
• Organization name and details
• Stripe account connection (managed by Stripe)
• Product information, images, and shop details you create
• Device push notification tokens (used to deliver order alerts to the TapVend Vendor mobile app)

From Customers (Ordering)

• Name and email address (provided at checkout for receipt delivery)
• Order details (items, quantities, total, pickup time)

We do not collect or store credit card numbers, CVVs, or other payment card data. All payment processing is handled entirely by Stripe.

From the TapVend Vendor Mobile App

• Camera access (used solely for scanning ticket QR codes, no images are stored or transmitted)
• NFC data (used solely for Tap to Pay card payments, processed entirely by Stripe, not stored by TapVend)
• Push notification tokens (used to deliver order alerts)

Automatically Collected

• IP address (used for rate limiting only, not stored long-term)
• Basic request metadata for security and abuse prevention

We do not use cookies for tracking or advertising. We do not use analytics services. The only client-side storage is localStorage for shopping cart persistence (web) and AsyncStorage for session persistence (mobile app).

2. How We Use Your Information

• To provide and operate the TapVend platform
• To send authentication emails (magic links via Resend)
• To send order confirmation and receipt emails to customers
• To send staff invitation emails
• To enforce rate limits and prevent abuse
• To process payments through Stripe Connect

We do not sell, rent, or share your personal information with third parties for marketing purposes.

3. Third-Party Services

We use the following third-party services to operate TapVend:

• Supabase — database hosting and authentication
• Stripe — payment processing (subject to Stripe’s Privacy Policy)
• Resend — transactional email delivery
• Vercel — application hosting
• Upstash — rate limiting (Redis)
• Expo — push notification delivery for the mobile app

Each service processes data in accordance with their own privacy policies. We only share the minimum data necessary for each service to function.

4. Data Storage & Security

Your data is stored in Supabase (PostgreSQL) with row-level security policies enforced at the database level. All data is transmitted over HTTPS. We implement CSRF protection, rate limiting, and input sanitization across the platform.

5. Data Retention

• Vendor accounts: retained while your account is active. Upon account deletion, data is retained for 30 days before permanent removal.
• Order data:retained as long as the vendor’s account is active, for bookkeeping and dispute resolution.
• Customer email/name: stored only as part of order records. We do not create customer accounts or profiles.

6. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Export your data in a standard format

To exercise any of these rights, contact us at support@tapvend.app.

7. Children’s Privacy

TapVend is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Material changes will be communicated via email to account holders.

9. Contact

Questions or concerns about this policy? Contact us at support@tapvend.app.