Privacy Policy
This page explains what personal data Tapzy collects, why, who we share it with and the choices you have. We have tried to keep it short and plain.
1. Who we are
Tapzy (“Tapzy”, “we”, “us”) runs an online form builder with link-in-bio pages, short links and QR codes at tapzy.io.
Questions about this policy or your data: hello@tapzy.io.
2. Creators, respondents and visitors
This policy uses three words:
- Creators have a Tapzy account and build forms, pages, links and QR codes.
- Respondents fill in a creator’s form.
- Visitors open a creator’s page, short link or QR code, or our own website.
For creator accounts and our own website, Tapzy decides how data is used (we are the “controller”). For form responses and the analytics on a creator’s pages, links and QR codes, the creator is in charge of that data and Tapzy processes it on their behalf. If you answered a form, the creator who made it is the best person to contact about your answers.
3. What we collect
Account data (creators)
- Name, email address, username and profile details you add.
- Your password, stored only as a bcrypt hash.
- Your plan, billing status and invoices. Card details are handled by the payment provider; we never see or store card numbers.
- What you create: forms, pages, links, QR codes and the images you upload.
- Messages you send us.
Form responses (respondents)
- The answers and files a respondent sends. What is asked is up to the creator.
- An email address or phone number, when a form asks for a verification code.
- Context about the visit: country and city (looked up from the IP address), device type, browser, operating system, the referring page and UTM parameters.
- The IP address is used in the moment for rate limits and spam checks and is not stored with the response.
- Payment status and amount, when a form takes payment. Card details go straight to the creator’s payment provider.
Link, QR code and page analytics (visitors)
When someone opens a short link, scans a QR code or views a bio page, we record the visit for the creator’s analytics: country and city (looked up from the IP address), device type, browser, operating system, referrer and UTM parameters, together with the IP address and the time.
4. How we use it
- To run Tapzy: host your forms and pages, deliver responses, send notifications and codes, and show analytics.
- To keep it safe: stop spam and abuse, rate-limit requests, and protect accounts.
- To bill you for your plan.
- To answer support requests and send important service emails.
- To understand how Tapzy is used and make it better.
We do not sell personal data, and we do not use respondents’ answers for advertising or to train AI models.
Where the law asks for a legal basis, we rely on our contract with you (to provide the service), our legitimate interests (security, product improvement) and, where needed, consent.
5. Who we share it with
We use these service providers to run Tapzy. They only get the data they need for their job.
| Provider | What for | When |
|---|---|---|
| Resend | Sends email: account emails, response notifications, autoresponders and email verification codes | Always |
| Twilio | Sends SMS verification codes | Only when a creator connects their own Twilio account |
| Stripe | Subscription billing, and payments inside forms | When you pay for a plan, or a form takes payment through Stripe |
| Dodo Payments | Subscription billing, and payments inside forms | When you pay through Dodo Payments |
| PayPal | Subscription billing | When you pay for a plan with PayPal |
| Cloudflare (R2) | Stores files uploaded to forms and images used on pages | Always |
| PostHog | Product analytics for the Tapzy website and app | Always (see section 6) |
| Google, HubSpot, Notion | Receive form responses (Google Sheets, HubSpot, Notion) | Only when a creator connects them |
Creators can also add their own tags (Meta Pixel, Google Tag Manager) to their forms. Those tags are run by the creator. Tapzy never passes form answers to them. We may also share data when the law requires it, or as part of a merger or sale of the business, with notice to you.
7. Google user data
Tapzy uses Google sign-in in two places, and asks Google only for what each needs:
- Signing in with Google. We receive your name, email address and Google account ID, and use them only to create your Tapzy account and sign you in.
- The Google Sheets integration. When a creator connects a Google account to a form, Tapzy gets access only to the Google Drive files it uses: spreadsheets it creates for the creator, and ones the creator chooses in Google’s file picker. It reads their title, tabs and heading row, and adds each form response as a row. It cannot see any other file in the creator’s Drive.
The lasting access Google grants is stored encrypted on our servers; only a short-lived token reaches the creator’s own browser, to open Google’s file picker. We do not use Google user data for advertising, do not sell it, and do not let people read it except with your permission, for security or where the law requires. You can disconnect a Google account in Tapzy at any time, which also tells Google to revoke our access, or remove Tapzy from your Google account’s third-party access settings.
Tapzy’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
8. How long we keep it
- Account data: for as long as your account is open.
- Form responses and files: until the creator deletes them or closes their account.
- Billing records: as long as tax and accounting law requires.
When an account is closed we delete or anonymise its data within a reasonable time, except where we must keep it by law.
9. Your rights
Depending on where you live, you can ask to see, correct, export or delete your personal data, and to object to or limit how we use it. Creators can export responses as CSV at any time from the app.
To make a request, email hello@tapzy.io. If you answered someone’s form, please contact that creator first; we will help them respond. You can also complain to your local data protection authority.
10. Security
We protect data with hashed passwords, HTTPS, private file storage with signed links and signed webhooks. The details are on our security page. No system is perfectly secure; if we learn of a breach that affects you, we will tell you without undue delay.
11. International transfers
Our providers may process data in countries other than yours, including the United States. Where required, we rely on safeguards such as the European Commission’s Standard Contractual Clauses.
12. Children
Tapzy is not meant for children under 16, and we do not knowingly collect their data for our own purposes. Creators must not use Tapzy to collect children’s data without the consent the law requires.
13. Changes to this policy
We will update this page when our practices change and change the date at the top. If a change is significant, we will tell creators by email before it takes effect.
14. Contact
Email hello@tapzy.io with any question about privacy.