Privacy Policy

Complementary to Terms and Conditions v1.0
Effective Date: August 12, 2026 · Version 1.0

NOTE: This Privacy Policy is a companion document to the tapus Terms and Conditions of Use. Terms defined in the Terms and Conditions carry the same meaning here. This Policy explains what personal data we collect, why we collect it, how we use it, and what rights you have over it.

At tapus, we believe trust is the foundation of every exchange – and that extends to how we handle your personal information. This Privacy Policy explains in plain language exactly what data we collect from Tappers, how and why we use it, who we share it with, how long we keep it, and what rights you have. We do not sell your personal data. We never have and we never will.

This Policy applies to all users of the tapus platform, website, and mobile applications globally. Because tapus operates in both the United States (initially New York State) and will expand internationally, this Policy is designed to comply with the California Consumer Privacy Act (CCPA/CPRA), the General Data Protection Regulation (GDPR) of the European Union, and applicable US state privacy laws in effect as of 2026.

Section 1: Who We Are and How to Contact Us

Tapus Inc. is the data controller responsible for your personal data. We are the entity that determines the purposes and means of processing your personal information.

Privacy inquiries: support@tapus.co · Website: www.tapus.co · Response time: within 30 days of receipt.

Section 2: What Personal Data We Collect

2.1 Data You Provide to Us

When you create an account, use the Platform, or communicate with us, you provide us with personal data directly, including:

Full name (first name + last initial displayed publicly): kept for the duration of your account + 90 days after deletion
Email address: kept for the duration of your account + 1 year after deletion
Phone number (identity verification only – never shared with other Tappers): kept for the duration of your account + 90 days after deletion
City and general location: kept for the duration of your account
Profile photo (optional): kept until you remove it or delete your account
About me / bio text: kept for the duration of your account
Offer and request listings: kept for the duration of your account + 6 months after deletion
Messages sent via the Platform: kept for 2 years from the date of the message
Reviews and ratings you submit: kept for the duration of your account, may be anonymized after deletion
Support and contact communications: kept for 3 years from the date of communication

2.2 Data We Collect Automatically

When you use the tapus Platform, we automatically collect certain technical and usage data:

IP address (security, fraud prevention, geographic compliance): 90 days
Device type and operating system: 24 months
Browser type and version: 24 months
Pages visited and features used: 24 months (aggregated after 12 months)
Date and time of access: 12 months
Crash and error reports: 6 months
Cookie and session data: see Section 8

2.3 Data We Do Not Collect

tapus does not collect or require the following, and we strongly advise Tappers never to share this information on the Platform or with other Tappers:

Social Security numbers or national identification numbers
Payment card numbers, bank account details, or financial information of any kind
Government-issued identity documents (driver's license, passport)
Health or medical information
Sexual orientation or gender identity beyond what you voluntarily add to your profile
Information about children under the age of 18

Section 3: How and Why We Use Your Data

We only use your personal data for specific, legitimate purposes, and never for automated decision-making that produces legal or similarly significant effects on you:

Creating and managing your account: contract performance, essential to service
Enabling exchanges between Tappers: contract performance, core platform function
Sending account and security notifications: contract performance + legal obligation, essential
Verifying your identity via phone/email: contract performance, required for account
Improving the Platform through analytics: legitimate interests
Detecting and preventing fraud or abuse: legitimate interests, safety and security
Sending optional platform newsletters: consent, unsubscribe any time
Complying with legal obligations: legal obligation, required by law
Resolving disputes between Tappers: legitimate interests, community safety

Section 4: How We Share Your Data

4.1 What Other Tappers Can See

When you create a tapus profile, the following is visible to other Tappers: your first name and last initial (e.g., "Sarah M."), your general city or area (never your street address or precise location), your profile photo (if uploaded), your bio, your offers and requests, and reviews and ratings from other Tappers. Your email address, phone number, and full last name are never visible to other Tappers.

4.2 Third-Party Service Providers

tapus works with a small number of trusted third-party service providers, bound by data processing agreements and not permitted to use your data for their own purposes: cloud hosting and infrastructure providers; email delivery service providers; analytics providers (see Section 8); customer support tools; identity and phone verification services; and cybersecurity and fraud detection services. We do not share your personal data with advertisers, data brokers, or any third party for marketing purposes.

4.3 Legal Disclosures

We may disclose your personal data to law enforcement, regulatory authorities, or other third parties where required by applicable law, court order, or government request, or where we believe in good faith that disclosure is necessary to comply with a legal obligation, protect rights/property/safety, detect or prevent fraud or security issues, or enforce our Terms and Conditions.

4.4 Business Transfers

If tapus is involved in a merger, acquisition, asset sale, or other business transfer, your personal data may be transferred as part of that transaction. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

4.5 We Do Not Sell Your Data

tapus does not sell, rent, trade, or otherwise transfer your personal data to any third party for commercial purposes. This applies globally, including California residents' rights under CCPA/CPRA. You will never find a "Do Not Sell My Information" link on tapus because we simply do not engage in the sale of personal data.

Section 5: Your Privacy Rights

Depending on where you are located, you have specific legal rights regarding your personal data, which tapus honors globally:

Right to Access: request a copy of all personal data tapus holds about you (support@tapus.co, response within 30 days)
Right to Correction: request correction of inaccurate or incomplete data (via account settings or email)
Right to Deletion: request deletion of your personal data ("right to be forgotten")
Right to Portability: request your data in a structured, machine-readable format
Right to Object: object to processing based on legitimate interests (e.g. analytics)
Right to Restrict Processing: request that we limit how we use your data in certain circumstances
Right to Withdraw Consent: withdraw consent for optional processing (e.g. marketing emails)
Right Not to Be Discriminated Against: for exercising any privacy right
Right to Lodge a Complaint: with your national or state data protection authority

We aim to respond to all valid privacy rights requests within 30 days. In complex cases we may extend this by a further 30 days, with notice of the extension and reason.

Section 6: Data Security

6.1 How We Protect Your Data

tapus implements appropriate technical and organizational security measures, including: encryption of personal data in transit (TLS/SSL) and at rest; access controls limiting which tapus personnel can access personal data; regular security assessments and vulnerability testing; secure account authentication including email and phone verification; and monitoring for suspicious account activity and potential fraud.

6.2 Data Breach Notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify you and any relevant regulatory authorities as required by applicable law. Under GDPR, we notify the relevant supervisory authority within 72 hours of becoming aware of a qualifying breach, and notify affected Tappers without undue delay where the breach is likely to result in high risk.

6.3 Your Responsibility

The security of your account also depends on you. You are responsible for keeping your account credentials confidential and for notifying us immediately if you suspect any unauthorised use of your account.

Section 7: Data Retention

We keep your personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law. Upon account deletion, we delete or anonymize your personal data within 90 days, except where we are required to retain it for a legal obligation, it is necessary for the establishment/exercise/defense of legal claims, or anonymized data is retained for statistical and Platform improvement purposes only. Messages exchanged between Tappers are retained for 2 years from the date of the message to assist in dispute resolution, then permanently deleted. Reviews and ratings may be anonymized and retained after account deletion to preserve the integrity of the Platform's trust system.

Section 8: Cookies and Tracking

8.1 What Cookies Are

Cookies are small text files placed on your device when you visit the tapus website or use our app. They help us make the Platform work correctly and allow us to understand how Tappers use it so we can improve it.

8.2 Types of Cookies We Use

Essential: required for the Platform to function, cannot be disabled (session management, security tokens, login state)
Functional: remember your preferences (language, display settings), can be disabled
Analytics: help us understand how Tappers use the Platform, using privacy-respecting tools, can be opted out via account settings
None: tapus does not use advertising cookies, third-party ad tracking cookies, or social media tracking pixels

8.3 Cookie Consent

When you first visit the tapus Platform, you will be presented with a cookie consent banner. You can accept all cookies or manage preferences to accept only essential cookies, and change your preferences at any time. For EU and UK residents, we obtain explicit consent before placing any non-essential cookies, per GDPR and the ePrivacy Directive.

Section 9: International Data Transfers

tapus is based in the United States. If you are accessing the Platform from outside the United States – including the EU, EEA, or UK – your personal data will be transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs), the EU-US Data Privacy Framework (where applicable), or your explicit consent, to ensure your data receives an equivalent level of protection.

Section 10: Children's Privacy

The tapus Platform is not directed at or intended for use by individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected personal data from a person under 18 without verified parental consent, we will delete that data immediately. If you believe we may have inadvertently collected data from a minor, contact us immediately at support@tapus.co.

Section 11: California Residents – Additional Rights

California residents have additional rights under the CCPA as amended by the CPRA, including the right to know the categories and specific pieces of personal information collected, sources, purposes, and third parties involved; to delete or correct personal information; to opt out of sale or sharing (note: tapus does not sell or share personal information for advertising purposes); to limit use of sensitive personal information; and to not be discriminated against for exercising CCPA rights. Contact support@tapus.co - we respond within 45 days, extendable by 45 more days with notice. tapus does not knowingly share personal information for cross-context behavioral advertising, so we do not include a "Do Not Sell or Share" link.

Section 12: EU and UK Residents – Additional Rights

EU/EEA/UK residents have additional rights under GDPR and UK GDPR, including the right to be informed about processing (fulfilled by this Policy), to object to processing based on legitimate interests including profiling, to not be subject to solely automated decision-making with significant effects, and to lodge a complaint with your national Data Protection Authority (UK: ico.org.uk). Where we process based on legitimate interests, you may object and we will cease processing unless we can demonstrate compelling legitimate grounds, or processing is necessary for legal claims.

Section 13: Third-Party Links and Services

The tapus Platform may contain links to third-party websites, applications, or services. This Privacy Policy does not apply to any third-party site or service accessed through a link on tapus. When you arrange a Local Exchange with another Tapper, you may share personal information directly with that Tapper outside the Platform; tapus is not responsible for how another Tapper uses information you share with them directly. We recommend sharing only what is necessary.

Section 14: Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we update the Effective Date, post the revised Policy on the Platform, send an email notification if changes are material, and where required by law, seek your consent before applying changes to existing data processing. Continued use of the Platform after changes take effect constitutes acceptance of the revised Policy, to the extent permitted by law.

Section 15: How to Contact Us

Privacy: support@tapus.co (subject line "Privacy Request – [your name]", response within 30 days) · General: hello@tapus.co · Website: www.tapus.co