Privacy Policy

Last updated: 22 October 2026

1. Who is responsible

TapVault is run by a private individual based in Lublin, Poland. For any question about your data, write to tapvault.support@gmail.com.

For visitors and buyers we are the data controller. For guests of a venue, the venue decides why and how guest data is used (the controller) and TapVault provides the technology and processes the data on the venue's behalf (the processor).

2. Visitors of this website

The marketing pages have no forms, no accounts, no analytics and no advertising trackers. Like every website, it is delivered by a hosting provider (Vercel), whose servers may log technical details such as your IP address when a page is requested. This is needed to show you the page and keep it secure.

3. Buyers (venue owners and partners)

The Founding Pass and plans are sold through Whop. Whop processes your payment and personal data under its own privacy policy. We receive the details we need to give you access, such as your name, email address and the plan you bought. Access to the community runs on Discord; if you connect your Discord account we see your username and your role.

For each venue we store its name, a short venue code and a salted hash of the staff PIN. We never store the PIN itself.

4. Guests who add a loyalty card

When a guest taps a TapVault stand and adds a card to Apple Wallet, we store:

• the first name or nickname the guest typed (or "Guest" if left empty);
• a random card code, the number of stamps and visits, and the date and time of each stamp or reward;
• for Apple Wallet updates: the device identifier and push token that Apple sends us, so the card can refresh when a stamp is added.

We do not ask for an email address, phone number or location, and we do not track guests across venues or build advertising profiles.

Cookie. After a guest adds a card, we set one strictly necessary cookie named tv_<venue> in the guest's browser for up to 12 months. It only remembers the card code, so tapping the same stand again gives the same card instead of a duplicate. It is not used for tracking or advertising. Deleting the cookie has no effect on the card already in the Wallet.

5. Why we use this data

• To deliver the service: issue cards, count stamps, update cards in Wallet and let venue staff confirm a reward.
• To keep the service secure and prevent abuse, for example limiting repeated wrong PIN attempts.
• To answer your messages and give support.
• To keep accounting records as the law requires.

We do not sell personal data.

6. Who else handles data

We use a small number of providers: Vercel (hosting), Supabase (database), Apple (Wallet and push updates), Whop (payments) and Discord (community). Venue staff can see the first name, stamps and visit count of a card when they scan it. Where a provider is outside the European Economic Area, transfers rely on safeguards such as Standard Contractual Clauses.

7. How long we keep data

Card data is kept while the venue uses TapVault. When a venue closes its account, or when you ask, we delete or anonymise the cards. Accounting records are kept as long as the law requires.

8. Security

Data is transmitted over HTTPS. The database accepts requests only from our servers, staff PINs are stored as salted hashes, and staff sessions expire automatically. No system is perfectly secure, but we take these measures seriously.

9. Your rights

You can ask us for access to your data, to correct or delete it, to restrict its use, or to receive a copy. You can also withdraw any consent you gave. A guest can also ask the venue directly. Write to tapvault.support@gmail.com and we will reply within one month. You have the right to complain to the Polish data protection authority, the President of the Personal Data Protection Office (UODO), at uodo.gov.pl.

10. Changes

When the service changes, for example when Google Wallet cards or reminders are added, we will update this page. The date at the top shows the latest version.