Privacy policy
Last updated 18 October 2026
This policy explains what personal data Tapmore handles, why, how long it's kept and the rights you have under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”). Tapmore is a partnership firm, Nav Mangal Society, Kathe Lane, Dwarka, Nashik, Maharashtra 422011(“Tapmore”, “we”, “us”).
It covers the guest pages that venues' QR codes open, the owners' dashboard and the till.
Two kinds of people use Tapmore: guests who scan a QR code at a café, restaurant or bar, and venue owners and their staff, who run those pages.
Part A: Guests at a venue
When you scan a table QR code, the page that opens belongs to that venue. The venue is the Data Fiduciary: it decides what to ask you for and why. Tapmore runs the page for the venue as its Data Processor, and uses your data only for that venue, never for itself and never for advertising.
What is collected, and why
| When you… | Data | Used to |
|---|---|---|
| Join the loyalty card or members' club | Email, the name you type, stamps, rewards, visits, and your birthday if you give it (day and month, never the year) | Run your card, let staff find and stamp it, email you your card, tell you when a reward is ready, and on your birthday offer you a treat at the venue and email you a birthday wish (you can unsubscribe from it) |
| Give your email for the Wi-Fi (if the venue asks) | Email, first name, the visit | Show you the Wi-Fi password and count your visits (at most one a day) |
| Leave feedback | What you write and any photo you attach | Pass your note privately to the venue, and summarise the week's notes for it with AI. Feedback isn't linked to your name or email; photos are re-encoded, which removes location data |
| Use the page | Which buttons are tapped, which table's QR code was scanned, a random ID for this visit, your network address | Show the venue how its page is used, and protect the service from abuse (addresses are held in memory briefly, not stored) |
Consent, and taking it back
- To join a venue's card you tick the “agree to join” box: that's your agreement to the membership and its emails (your card, rewards and a birthday wish). Getting on the Wi-Fi never needs it.
- Each birthday email has a one-tap unsubscribe link. Unsubscribing stops them; your card keeps working.
- You can delete your card and everything on it yourself, at any time, from the link at the bottom of your card (open it on the venue's page). That withdraws your consent and erases your details at that venue.
Age
Under the DPDP Act anyone under 18 is a child, whose data needs a parent's consent. Guests at Indian venues confirm they're 18 or older when they join. If you're under 18, please don't join or give your email without your parent or guardian.
On your phone
We don't use advertising or tracking cookies. The page stores a few small values on your phone: which card or guest ID is yours at this venue (so you don't have to join again), and a random visit ID that resets after 30 minutes without use.
How long it's kept
- Your details, card and visits: while the venue's account exists, until you delete your card, or until the venue deletes you on request.
- Page-use records: 400 days. Copies of emails sent to you: 90 days, with private links removed.
- When a venue deletes its account, its guests' data is erased. Backups roll over within 30 days.
Part B: Venue owners and staff
For your own account, Tapmore is the Data Fiduciary.
- Account: your name, email and password (stored only as a one-way hash), and which venues you run or work at. Used to sign you in, run your venues and send service, security and billing emails.
- Billing: your subscription status and Razorpay's customer and subscription IDs. Card, UPI and bank details go to Razorpay directly; we never see or store them.
- Security: sign-in sessions (a cookie, kept 90 days from your last visit), a cookie on paired till devices, network addresses held in memory briefly to stop abuse, and a log of support actions our staff take on accounts.
- Retention: while your account exists. Deleting your account erases it, along with the venues only you own and their guests' data. Razorpay keeps its payment records, and we keep invoices, for as long as tax law requires.
Who else handles data
We use trusted service providers, bound by contract to use the data only for us. Some are outside India, which the DPDP Act allows:
- Hosting, database and file storage (our cloud provider)
- Email delivery (Resend)
- Payments (Razorpay, for venue subscriptions only)
- Bot protection on sign-up (Cloudflare Turnstile)
- AI for owners: reading menu photos, and summarising a week's feedback notes (the note text only, never who wrote it)
- Measuring how fast pages load (our cloud provider; timings and the kind of device, no cookies, nothing that identifies you)
We don't sell personal data or share it for advertising. We disclose it to authorities only when the law requires.
Security
Data is encrypted in transit, passwords and private links are stored hashed, access is limited to people who need it, and admin actions are logged. If a breach affects your data, we'll tell you and the Data Protection Board of India as the DPDP Act requires.
Your rights
Under the DPDP Act you can:
- ask what personal data is held about you and how it's used, and who it's been shared with;
- have it corrected, completed, updated or erased;
- withdraw consent at any time (as easily as you gave it);
- nominate someone to act for you if you die or can't act yourself;
- have a complaint dealt with by us, and then, if you're not satisfied, complain to the Data Protection Board of India.
Guests can ask the venue directly, or write to us and we'll pass it on and help. Owners can change most things in the dashboard or delete their account there. We reply within 30 days.
Questions and complaints
Email team.nexloop@gmail.com. We acknowledge complaints within 48 hours and resolve them within 30 days. See also Contact us.
Changes
If we change this policy in a way that matters, we'll update the date above and, for owners, email you first. Guests will see the new version linked from the page.