Privacy notice · Updated October 7, 2026

We keep data collection simple.

Tapyo is a product of Greatclicks Information Technology Solutions. This notice explains how we handle information when you use Tapyo.

We collect only the information needed to operate the business page: the owner’s name, email, and phone number, business details, services, prices, photos, and payment status. Simply viewing a public page does not require a customer to give us their contact details.

Product usage analytics

We use PostHog (US hosting) to understand which pages and features are useful. We send page categories, selected actions, and basic browser information with a pseudonymous browser identifier stored locally. We do not send names, contact details, form contents, chat messages, business profile identifiers, or URL query strings through this integration. PostHog session recording and heatmaps are disabled in Tapyo. This integration respects your browser’s Do Not Track setting.

When a customer taps or scans

The Tapyo application stores the visit count, time, a referrer without its query string, and a short-lived keyed identifier derived from the connection. Tapyo does not put the raw IP address in its customer analytics database. Advertising tracking is not enabled on customer business-profile pages. Hosting and security providers may process connection logs to deliver and protect the service.

When a customer shares contact details

The assistant may ask for your name and either a mobile number or email before chatting. You can review and correct your details and explicitly agree to share them with that business for inquiry follow-up. These details are saved to its Customer Contacts, not sent to the AI provider, and do not subscribe you to marketing. Contact ownership is not verified by this flow. The separate contact form asks for a name, email address, mobile number, and an optional birthday month and day (the birth year is discarded). We save these details only after the customer agrees to the notice on the form. The relevant business owner and authorized Tapyo administrator can view them for follow-up and relevant updates. Customers may ask the business or Tapyo to correct, export, delete, or stop using their details.

When you chat with an AI assistant

Questions that need an AI-generated answer are sent to OpenAI together with a limited recent conversation and the business information needed to respond. Some common questions are answered directly without contacting an AI provider. Tapyo does not save complete chat transcripts. Unanswered questions may be shared with the relevant business and authorized administrators for follow-up and are visible for up to 30 days. Expired questions are removed on subsequent assistant activity. Our AI provider’s own retention policies also apply. Do not include passwords, payment card details, or sensitive personal information in the chat.

The assistant’s name and uploaded photo are public. Chat content is masked from session replay analytics. Short-lived pseudonymous identifiers help limit abuse and usage. The assistant does not make bookings or payments on your behalf.

When you join the Tapyo waitlist

We save your name, email address, mobile number, and written business type so an authorized Tapyo administrator can contact you about early access. These waitlist details are not shared with Tapyo business owners. You may ask us to correct or delete them at any time.

When you contact owner support

Questions sent to Tapyo’s AI support assistant are processed by our AI provider to select relevant help articles or identify requests for management. When a request is escalated, we save the submitted conversation, business association, ticket status, and management reply. Your business’s owners and authorized Tapyo administrators can view these records. Email alerts to Tapyo management contain a ticket reference and inbox link, not the conversation. Please do not include passwords, verification codes, card details, or sensitive customer information. Support conversations are masked from session replay.

When an owner signs in

We use your registered mobile number or email to send a one-time login code. Login messages are transactional and are never used for marketing.

When you set up your business

We save your setup progress so you can continue on another device. You may optionally tell us where you heard about Tapyo and provide a referral name or code. We also record supported campaign labels and the referring website’s domain, when available, to understand how businesses discover us. This setup record does not keep the full referring URL or advertising click identifiers. Campaign information is held in this browser tab until it is associated with your first authenticated workspace visit. Only you and authorized Tapyo administrators can access your setup record; it is never shown on your public page. We retain it while needed to operate and improve onboarding, and you may request its deletion.

Advertising measurement

Tapyo uses the Meta Pixel on its marketing (including blog and pricing), order, owner sign-in, and onboarding pages to measure page visits, selected button clicks, Messenger link clicks, prepaid-period selections, waitlist submissions when available, and completed business setup. Meta may receive the visited URL, referrer, IP address, browser information, and advertising cookie identifiers to measure and improve Tapyo ads. Our event code does not send names, email addresses, phone numbers, login codes, or other form contents, and automatic advanced matching is not enabled by our integration. You can manage advertising preferences through Meta’s ad settings and your browser’s cookie controls.

Heatmaps and session recordings

We use Microsoft Clarity on Tapyo’s marketing and pricing pages to understand clicks, scrolling, and how visitors use these pages through heatmaps and session recordings. Clarity processes interaction data, page URLs, device and browser information, and cookie identifiers. Form inputs are masked, and our waitlist form is explicitly masked. Recording stops when you leave these pages for sign-in, the owner or admin dashboard, or a customer business page. For details about how Microsoft handles this information, see the Microsoft Privacy Statement.

Service providers and retention

Tapyo uses Supabase for authentication, database, and photo storage; Vercel or Cloudflare infrastructure to deliver the app; Semaphore to deliver SMS login codes; Brevo to deliver email login codes; Sentry, when enabled, for privacy-filtered error reports; and PayMongo only when payment checkout is enabled. Raw scan events are retained for up to 90 days before daily totals are kept. Short-lived security counters are removed after two to eight days. Business, contact, and waitlist records are kept while needed to provide the service or follow up, and are deleted on a verified request unless a legal or billing obligation requires longer retention.

Who can access the data

Owners can see only their own business. Database-level access rules prevent one owner from reading or changing another business’s data. Limited administrator access is used for onboarding, billing, and support.

Questions or data requests

To correct, export, or delete owner data, contact Greatclicks Information Technology Solutions at asabmidia@gmail.com. You may also opt out of non-essential messages at any time.

You can also read our Terms of use.