Privacy policy
Tapback lets businesses and events ask for quick feedback: people swipe a few cards, can add a comment by voice or text, and may win a reward. This policy explains what we collect, why, and your rights under the GDPR.
Who we are
Tapback runs tapback.ee. For feedback given to a business or event, that business or event decides what to ask and what the answers are used for: it is the controller and we are its processor. For business accounts (the people who build forms) and for our own website, we are the controller. Contact us at info@tapback.ee.
If you give feedback
- Your answers: your swipes (for example “Like” or “Dislike”), and anything you choose to type or say in the optional comment. We keep the text of your comment, not the recording.
- Voice: if you tap the microphone, your browser's speech service (Google in Chrome, Apple in Safari) or our speech-to-text provider turns your speech into text. The audio is used only for that and is not stored by us. You can always type instead, or skip.
- A random device ID stored on your phone, so the same phone can't claim a reward again and again, and a count of taps on the link or NFC tag you used. We don't ask for your name and don't track you across other websites.
- Your email, only if you ask us to email your reward code. It is used to send that one email and is not kept in our database or used for marketing.
- AI processing: the text you choose to add is sent to our AI provider to tag what you liked and disliked and to summarise feedback for the business. Providers may not use it to train their models under our agreements with them.
Legal basis: the business's legitimate interest in improving what it offers (Art. 6(1)(f) GDPR), and your choice to take part. Giving feedback is voluntary. Please don't include sensitive details (for example about health) or other people's personal data in comments.
If you have a business account
- Your name, email and profile picture from Google sign-in, your role on each team, and what you create (forms, rewards, notes).
- For paid plans: billing details handled by Stripe; we store only the plan, seats and a Stripe reference, never card numbers.
- If you ask the AI to read your website, we read its public pages to understand your business.
Legal basis: providing the service you signed up for (Art. 6(1)(b)), our legal obligations such as accounting (Art. 6(1)(c)), and keeping the service secure (Art. 6(1)(f)).
How long we keep data
- Feedback: for as long as the business keeps its account, or until the business or you ask us to delete it.
- Reward codes and device IDs: up to 24 months after the last visit.
- Business accounts: until the account is closed, then up to 30 days in backups. Invoices: 7 years, as Estonian accounting law requires.
- Server logs: up to 30 days.
Who helps us (subprocessors)
We use these providers to run Tapback. Each is bound by a data processing agreement.
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting and delivery of the website and app | USA / EU edge |
| Supabase Inc. | Database (answers, forms, accounts) | EU (Frankfurt) |
| Anthropic PBC | AI: summarising and tagging typed or transcribed answers, suggestions | USA |
| Groq, Inc. | Speech-to-text for voice answers (audio is processed, not stored by us) and tidying spoken comments | USA |
| OpenAI, L.L.C. | AI fallback and speech-to-text when enabled | USA |
| Google LLC | Google sign-in for businesses; AI fallback when enabled | USA / EU |
| Resend, Inc. | Sending the reward-code email you ask for | USA |
| Stripe Payments Europe Ltd. | Card payments for paid plans | Ireland / USA |
Where data leaves the EU/EEA, it is protected by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
Your rights
You can ask to see, correct, delete or export your data, to restrict or object to how it is used, and to withdraw consent where you gave it. Write to info@tapback.ee. If your request is about feedback you gave a business, we pass it on and help them answer. We reply within one month. You can also complain to the Estonian Data Protection Inspectorate (aki.ee) or your local authority.
Children
Tapback is not meant for children under 13. Business accounts are for adults (18+).
Security
Data is encrypted in transit and at rest; access is limited by role, and every business write is checked on the server. No system is perfectly secure; if something goes wrong we will tell affected people and the authorities as the law requires.
Changes
We will post changes here and, for significant ones, email business account owners.