Tapp
Book a demo

Privacy Policy

Privacy Policy

Privacy Policy for Tapp.so Ltd.

Last modified: November 13, 2026

Tapp.so Ltd. (“Tapp.so”, “we”, “us”, or “our”) respects your privacy and is committed to protecting it through our compliance with this policy.

The data controller according to Art. 4 of the UK General Data Protection Regulation (“UK GDPR”) and the EU General Data Protection Regulation (“EU GDPR”) for the processing described in Part A is:

Tapp.so Ltd.
Unit 4.07 The Tea Building, 56 Shoreditch High Street
London, United Kingdom, E1 6JJ

If you have any questions relating to data protection, please get in touch with us at legal@tapp.so.

This policy is in two parts, because we play two different roles:

Part A — Website Visitors and Customers

This section applies to visitors to our website (https://www.tapp.so), prospective customers, registered account holders, subscribers, and authorised users of our Dashboard.

For the processing activities described in this Part A, Tapp.so Ltd. acts as the data controller under the UK General Data Protection Regulation (“UK GDPR”) and, where applicable, the EU General Data Protection Regulation (“EU GDPR”).

A1. Information We Collect

We collect and process the following categories of personal information from and about visitors to our website, registered customers, subscribers, and users of our Dashboard.

A1.1. Information You Provide to Us

When you complete a contact form, request a demonstration, communicate with our team, register for an account, or use our Services, we may collect:

We use this information to respond to enquiries, establish customer relationships, create and administer accounts, and provide our Services.

A1.2. Account Registration and Authentication

When you register for a Tapp account, we collect and process information necessary to create, verify, secure and maintain your account.

This may include:

Registration requires you to acknowledge our Terms & Conditions and Privacy Policy.

We record the date and time of this acknowledgement for compliance and account administration purposes.

Your decision to receive marketing communications is requested separately and is not a condition of registering for an account or purchasing a subscription.

A1.3. WordPress and Tapp Dashboard Account Synchronisation

Our website and customer Dashboard operate using interconnected account-management systems.

Account registration, profile management and subscription purchasing are handled through our WordPress-based website, while access to certain Tapp Services is provided through our Laravel-based Dashboard.

To maintain consistent authentication, account access and subscription entitlements, we may securely synchronise relevant account information between these systems.

This information may include:

Such synchronisation is performed for the purpose of administering your account and providing the Services for which you have registered or subscribed.

We use authenticated communications and appropriate technical safeguards to protect information transferred between these systems.

A1.4. Subscription and Billing Information

When you register for a subscription, purchase a paid plan, change your plan, or manage billing information, we may collect and process:

Payments and recurring subscription transactions are processed through Stripe, our third-party payment services provider.

Payment-card details are collected and processed through Stripe’s payment infrastructure. We do not store complete payment-card numbers or card security codes within our WordPress or Laravel customer databases.

Stripe may provide us with limited payment-related information, such as payment-method type, card brand, the last four digits of a payment card, invoice status and transaction identifiers, where necessary for billing administration and customer support.

For more information about Stripe’s processing of personal information, please refer to https://stripe.com/privacy

A1.5. Enterprise Subscription Offers

When you request, receive or accept a personalised Enterprise subscription offer, we may process:

Personalised Enterprise offers may be delivered through time-limited links associated with the intended recipient’s email address.

We process this information to prepare, communicate, administer and, where accepted, fulfil the relevant subscription agreement.

A1.6. Technical and Website Usage Information

When you visit our website or access our Dashboard, we may automatically collect certain technical information, including:

This information may be collected through server logs, cookies, analytics technologies and other technical mechanisms, subject to applicable consent requirements.

A1.7. Security and Account Activity Information

To maintain the security and integrity of our Services, we may process information relating to account access and administrative activity, including:

Where supported, we may use this information to identify potentially unfamiliar sign-ins and send account-security notifications.

Any geographic information inferred from an IP address is approximate and may not accurately represent your physical location.

A1.8. Marketing Preferences and Consent Records

When you register or update your customer profile, you may choose whether to receive marketing communications from Tapp.

We may record:

Marketing consent is voluntary and is separate from the processing necessary for account registration, authentication, billing and provision of our Services.

You may change your marketing preferences through your customer profile or withdraw your consent using an unsubscribe mechanism where provided.

A1.9. Communications and Support Information

When you contact our sales, support or administrative teams, we may retain information relating to your enquiry, including:

We process this information to provide assistance, resolve problems and maintain appropriate records of customer communications.

A2. How We Use This Information and Legal Bases

We process personal information only where we have an appropriate legal basis under applicable data-protection legislation.

Our principal purposes and legal bases are described below.

A2.1. Providing Our Website, Dashboard and Services

We process account and customer information to:

Legal basis: Performance of a contract or taking steps at your request before entering into a contract (Article 6(1)(b) GDPR).

A2.2. Subscription Management and Payment Processing

We process subscription and billing information to:

Legal basis: Performance of a contract (Article 6(1)(b) GDPR), compliance with legal obligations (Article 6(1)(c) GDPR), and, where applicable, legitimate interests in the management and recovery of payments (Article 6(1)(f) GDPR).

A2.3. Customer Support and Communications

We process contact details, correspondence and relevant account information to:

Legal basis: Performance of a contract or legitimate interests in providing customer support and maintaining business relationships (Article 6(1)(b) and (f) GDPR).

A2.4. Account Security, Fraud Prevention and Service Protection

We process relevant account, authentication and technical information to:

Legal basis: Legitimate interests in maintaining secure and reliable Services (Article 6(1)(f) GDPR) and compliance with applicable legal obligations where relevant (Article 6(1)(c) GDPR).

A2.5. Transactional and Security Notifications

We may send communications necessary to administer or secure your account, including:

These communications are related to your account, contractual relationship or service security and are distinct from optional promotional emails.

Legal basis: Performance of a contract, legitimate interests in account administration and security, or compliance with legal obligations, as applicable (Article 6(1)(b), (f) and (c) GDPR).

A2.6. Website Analytics and Service Improvement

We may analyse website traffic, navigation and engagement information to understand how visitors use our website and improve its content, performance and usability.

Where analytics involves non-essential cookies or similar technologies, we obtain the consent required under applicable electronic communications and privacy legislation.

Legal basis: Consent where required (Article 6(1)(a) GDPR), or legitimate interests for limited processing that can lawfully be conducted without consent (Article 6(1)(f) GDPR).

A2.7. Marketing and Promotional Communications

Where permitted by applicable law, we may use your contact details to send information about:

Where consent is required, marketing emails are sent only after you have provided the relevant consent.

You may withdraw marketing consent at any time without affecting your access to core account functionality.

Legal basis: Consent (Article 6(1)(a) GDPR), or legitimate interests only where direct marketing is otherwise permitted by applicable law (Article 6(1)(f) GDPR).

A2.8. Compliance with Legal Obligations

We may process and retain information where necessary to:

Legal basis: Compliance with legal obligations (Article 6(1)(c) GDPR) or legitimate interests in establishing and defending legal claims (Article 6(1)(f) GDPR), where applicable.

A3. Cookies and Similar Technologies

We use cookies and similar technologies to operate our website, maintain secure user sessions, support essential website functionality, and, where you provide the necessary consent, analyse website usage and measure the effectiveness of our services.

Some cookies and similar technologies may involve the processing of personal data. Where this occurs, such processing is subject to this Privacy Policy and applicable data-protection legislation.

Non-essential cookies and tracking technologies are subject to your consent where required by applicable law. You may manage or withdraw your cookie consent through the cookie preference controls available on our website.

For detailed information about the cookies we use, their purposes, providers, retention periods, available consent choices, and instructions for managing your preferences, please refer to our separate Cookie Policy.

A4. How We Share Personal Information

A4.2. Payment Processing

Subscription payments are processed through Stripe.

We share or make available the information necessary to create and manage Stripe customer records, subscriptions, payment transactions, invoices, payment methods and related billing activities.

Stripe may process certain personal information as an independent controller or service provider, depending on the relevant processing activity and applicable contractual arrangements.

Stripe’s Privacy Policy is available at https://stripe.com/privacy

A4.3. Internal Systems and Account Synchronisation

Personal information may be exchanged between our WordPress website infrastructure and our Laravel-based Dashboard to provide consistent authentication, account management, subscription access and service entitlements.

These exchanges form part of Tapp’s account and subscription administration processes and are subject to appropriate security safeguards.

A4.4. Affiliates and Business Operations

We may disclose personal information to subsidiaries, affiliates, contractors and authorised business partners where necessary for the purposes described in this policy and subject to applicable safeguards.

We may also disclose information to a buyer, successor or other relevant party in connection with a merger, acquisition, restructuring, financing, divestiture or transfer of some or all of our business or assets, subject to applicable legal requirements.

A4.5. Legal Obligations and Protection of Rights

We may disclose personal information where necessary to:

A4.6. Disclosure with Your Consent

Where appropriate, we may disclose information to a third party where you have specifically authorised or consented to that disclosure.

We do not disclose customer account information to third-party advertisers for their independent marketing purposes without an appropriate legal basis.

A5. Retention

We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, including providing our Services, maintaining account security, administering subscriptions, complying with legal obligations and resolving disputes.

Different categories of information may have different retention periods, depending on their purposes and applicable requirements.

A5.1. Account and Profile Information

We generally retain account and profile information for the duration of your active account or customer relationship.

Following account closure, relevant information may be deleted, anonymised or retained for a limited additional period where necessary to comply with legal obligations, resolve disputes, prevent fraud or establish and defend legal claims.

A5.2. Subscription, Billing and Financial Records

Subscription agreements, payment references, invoices, billing records and related financial information may be retained for the periods required under applicable accounting, taxation and other legal obligations.

Cancellation of a subscription does not automatically require immediate deletion of records that we are legally required to retain.

A5.3. Registration and Terms Acceptance Records

We retain relevant registration records and evidence of acceptance of our Terms & Conditions and acknowledgement of our Privacy Policy for the period necessary to administer the account, demonstrate compliance with applicable requirements and address potential contractual or legal disputes.

Such records may include applicable policy references and acceptance timestamps.

A5.4. Marketing Consent Records

Where personal information is processed on the basis of marketing consent, we retain the relevant preference information while that consent remains applicable.

If you withdraw consent, we stop processing your information for the affected marketing purpose, subject to applicable legal requirements.

We may retain limited records of your previous consent, withdrawal and suppression preference for the period necessary to demonstrate compliance and respect your decision not to receive further marketing communications.

A5.5. Security and Activity Logs

We retain security, authentication, application and administrative activity records for periods reasonably necessary to protect our Services, investigate security incidents, prevent fraud and maintain operational accountability.

Routine website, application and account activity logs are generally retained for up to 90 days.

Certain security-related records, including documented security incidents, suspected fraudulent activity and significant administrative changes, may be retained for up to 24 months, where necessary and justified for security investigations, legal compliance or the establishment, exercise or defence of legal claims.

Records that must be retained for longer under applicable legal obligations may be subject to separate retention periods.

We apply appropriate access controls and periodically review retained information. Logs are deleted or anonymised when they are no longer required for their intended purposes.

A5.6. Enterprise Offers

Information relating to personalised Enterprise offers may be retained for the period necessary to administer the offer, establish or fulfil a resulting subscription agreement, maintain appropriate commercial records and address contractual or legal obligations.

Expired or unused offers may be invalidated before the associated administrative records are deleted.

A5.7. Customer Support and Correspondence

We retain support requests, enquiries and related communications for as long as reasonably necessary to provide assistance, maintain customer relationships and address potential disputes or legal obligations.

A5.8. Deletion and Data Subject Requests

You may request deletion of your personal information in accordance with the rights and limitations described in Part C of this Privacy Policy.

Where we are legally required or otherwise lawfully permitted to retain certain records, we will explain the applicable restrictions.

Where appropriate, we will delete or anonymise information once it is no longer required for its original purpose or a valid retention obligation.

For information about your rights, data security, international transfers and our contact details, please refer to Part C — Provisions Applying to Everyone below.

Part B — End Users of Our Customers’ Apps

B1. Our Role

We provide deep linking, attribution, referral and analytics services to our customers (mobile app and website providers). When you use an app or click a link that integrates the Tapp SDK, APIs or links (collectively, the “Tapp Technology”), we process certain data about that interaction on behalf of and on the instructions of the app provider.

The app provider is the data controller of this data; Tapp.so is a data processor.

The app provider’s own privacy policy governs this processing, and questions or requests should be directed to the app provider in the first instance (see B5).

B2. Data Processed Through the Tapp Technology

The Tapp Technology is designed to operate on pseudonymous, technical and event-based data. Depending on the app provider’s configuration, it may process:

What We Do Not Collect

The Tapp Technology does not request or intend to receive information that directly identifies you, such as your name, email address, phone number, postal address or payment details, and our agreements prohibit app providers from sending us such data (including inside event metadata or URLs).

If we become aware that such data has nevertheless been transmitted to us, we delete it.

We do not combine End User data with any other data in a way that would enable us to personally identify End Users, we do not use it for our own marketing, and we do not sell it.

B3. Purposes

We use this data solely on behalf of our customers to provide our Services: to route deep links, attribute app installations and events to campaigns and referrals, measure marketing performance, calculate programme rewards, prevent and detect fraud, and provide aggregated analytics to the app provider.

B4. Retention

We retain End User data only for as long as necessary to provide our Services, in accordance with the documented instructions of the relevant app provider (the data controller) and the applicable Data Processing Agreement (“DPA”).

Default retention period: Unless otherwise agreed with the app provider, End User tracking, attribution, installation, referral and conversion data is retained for up to 24 months from collection, subject to the purposes and retention instructions established by the app provider.

The app provider may request a shorter retention period or deletion of relevant data, subject to the applicable contractual arrangements and legal requirements.

Upon termination or expiration of the customer relationship, we will, at the app provider’s choice, delete or return the End User personal data processed on its behalf and delete existing copies, unless applicable law requires continued storage.

Where immediate deletion from backups is not technically feasible, remaining copies will be protected, placed beyond ordinary use and deleted in accordance with an appropriate backup-retention schedule.

Aggregated data that has been irreversibly anonymised so that individuals can no longer be identified may be retained for statistical analysis, reporting and service improvement, subject to applicable law.

B5. Your Rights as an End User

You have the rights described in Part C below.

Because the app provider is the controller, please direct requests to the provider of the app you used; we support our customers in responding to such requests.

You may also contact us at legal@tapp.so and we will forward your request to the relevant customer where we can identify them.

Please note that, because the data we process is pseudonymous, we are often unable to identify which data relates to you without additional information (Art. 11 GDPR).

Part C — Provisions Applying to Everyone

Children’s Privacy

Our website and Services are not intended for children under 16 years of age, and we do not knowingly collect personal information from children under 16.

Our terms prohibit customers from using the Services in apps primarily directed at children without our prior written consent.

If we learn we have collected or received personal information from a child under 16 without verification of parental consent, we will delete that information.

Data Security

We have implemented technical and organisational measures designed to secure personal information from accidental loss and from unauthorised access, use, alteration, and disclosure, including encryption of data in transit, access controls and logging.

A description of our measures is set out in our Data Processing Agreement.

International Data Transfers

Tapp is established in the United Kingdom, and our primary hosting infrastructure is located within the European Union (EU).

We may use trusted third-party service providers that process personal data in the United Kingdom, the European Economic Area (EEA), or other jurisdictions.

Where personal data is transferred internationally, we ensure that appropriate protections are in place in accordance with applicable UK and EU data protection legislation.

Such transfers are carried out on the basis of applicable adequacy regulations or decisions, or appropriate safeguards, including the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, as applicable.

We require our service providers to implement appropriate technical and organisational measures to protect personal data.

For further information about international data transfers and applicable safeguards, please contact legal@tapp.so.

Your Rights Under the UK GDPR and EU GDPR

As a data subject, you have, subject to conditions and exemptions under applicable law, the right of:

Where processing is based on consent, you can withdraw this consent at any time with effect for the future by sending an email to legal@tapp.so; the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

You also have the right to lodge a complaint with a supervisory authority — in the UK, the Information Commissioner’s Office (ico.org.uk), and in the EU/EEA, the supervisory authority of your habitual residence, place of work or the place of the alleged infringement.

Changes to Our Privacy Policy

It is our policy to post any changes we make to our privacy policy on this page, with the date the privacy policy was last revised identified at the top of the page.

Where changes materially affect how we process your personal data, we will provide more prominent notice where required by law.

Contact

For questions relating to data protection, contact us at:

Email: legal@tapp.so

Postal address:
Tapp.so Ltd.
Unit 4.07 The Tea Building
56 Shoreditch High Street
London, United Kingdom, E1 6JJ

Growth Hubs
Referral MarketingAffiliate MarketingViral Loops
Developers
FDL Migration GuideDocumentation
Why Tapp
Features & BenefitsHow It WorksPricing PlansFAQs
Resources
BlogGlossary