Last updated: 10 July 2026

Privacy Policy

This policy explains what data Tapminta collects, why, and how it's handled. It's written to be genuinely readable rather than dense legal boilerplate — if anything here is unclear, email support@tapminta.com and ask.

This document has not yet been reviewed by a lawyer. It's a good-faith, accurate description of what the system actually does today, intended as a solid working draft — not a substitute for legal advice.

1. Who we are

Tapminta ("Tapminta", "we", "us") operates a platform that turns NFC tags and QR codes into measurable marketing: a physical card is tapped or scanned, the visit is logged in de-identified form, and the visitor is redirected to a destination the card's owner has configured.

2. The two kinds of data we handle

Tapminta processes two genuinely different categories of data, and they're treated very differently:

2.1 Dashboard accounts (our direct clients)

If you or your organisation has a Tapminta login, we hold your name, email address, a securely hashed password (we never store or can see your actual password), and which organisation(s) you belong to. This is ordinary account data, used to run the service and communicate with you about it.

2.2 Anonymous tap data (everyone who scans or taps a card)

Every time someone taps an NFC card or scans a QR code, we log:

We never store IP addresses or full precise location. Location is always city-level, resolved at the network edge — never the visitor's exact position, never anything their device provides directly.

2.3 The tap-deduplication cookie

We set one small, first-party cookie when a card is tapped or scanned. Its only job is telling apart a genuinely new visitor from the same device tapping the same card again — for example, a sales rep re-tapping their own card to show someone, or a friend or family member tapping it out of curiosity — so that a card's reported engagement reflects real distinct interest rather than the same device inflating the count.

The cookie is a random, meaningless string. It does not contain or derive from your name, email, IP address, or any other identifying information, and it is never combined with any other data to work out who you are. It is scoped only to Tapminta's redirect domain, is never shared with advertisers or any other third party, and is never used for advertising. It expires after 400 days of inactivity. If you clear cookies or use a different device or browser, you'll simply be counted as a new visitor next time — nothing is lost, and nothing about you is tracked across that gap.

3. Why we collect this

The anonymous tap data exists for one reason: to let the organisation that owns a batch of cards see how their cards are performing — how many taps, from roughly where, on what kind of device, and how many of those represent genuinely distinct engagement rather than the same device tapping repeatedly — so they can measure whether the cards are working. We don't use any of this for advertising, we don't sell it, and we don't combine it with any other source to try to identify who tapped a card — the deduplication cookie above is no exception to that.

4. Who else touches this data

We use a small number of infrastructure providers to run the service, each processing data only as needed to do their specific job:

We don't sell or share data with anyone for their own marketing purposes.

5. How long we keep data

Tap records are kept indefinitely by default, since the whole point of the service is historical performance data over the life of a card — but nothing about a tap identifies who made it, so there's no "personal data" clock running on it in the way there would be for, say, an email address. The deduplication cookie described in 2.3 expires automatically after 400 days of inactivity — whichever comes first between that and you clearing it yourself. Account data is kept while an account is active, and can be deleted on request.

6. Your rights

If you have a Tapminta dashboard account, you can ask us to access, correct, or delete your account data at any time — email support@tapminta.com. Because tap data isn't tied to an identifiable individual, there generally isn't a specific tap record to "find and delete" for any one person — if you believe that's not the case for a specific situation, tell us and we'll look into it properly.

7. Our role, and what happens when a client resells or white-labels this data

This section matters if you're not dealing with Tapminta directly, so we're being explicit about it.

Tapminta provides its dashboard and tap-tracking service directly to the organisation that signs up for it (a "Client"). Some Clients use Tapminta's data internally; others repackage it — as their own reports, screenshots, or a white-labelled part of their own product or service — for their own clients or customers. Where a Client does this, that relationship is entirely between the Client and their own client or customer. Tapminta is not a party to it, has no agreement with that end recipient, and is not providing them a service, quote, or commitment of any kind. The Client is solely responsible for what they represent about the data, and for their own relationship with the people they share it with.

That said, this doesn't erase our own responsibility for the underlying data itself. Regardless of whose card was tapped or how many steps removed the final recipient of a report is, Tapminta is the one operating the servers and database that actually process every tap. We remain responsible for handling that data securely and in line with this policy, in our own systems, no matter how far downstream it's eventually viewed.

In short: our contractual relationship is with our direct Client only — we don't have one with a Client's own clients or customers — but our data-handling responsibility for the anonymous tap data itself doesn't depend on who's contractually in the room.

8. Security

Access to the dashboard requires a login; passwords are hashed, never stored in plain text. Traffic to and from the service is encrypted. Internal access to the database is restricted to what's needed to operate the service.

9. Changes to this policy

If this policy changes in a way that matters, we'll update the date at the top and, for material changes, let active Clients know directly.

10. Contact

Questions about this policy or how your data is handled: support@tapminta.com.