Your Page is the place to start. Bring your Card, team and follow-up with you.
Create a free PageEffective October 11, 2026
Last updated: 21 October 2026
tappin controls the personal information described here. This policy covers our storefront, Tappin’ Products and Tappin’ Connect services. Contact us about privacy at tappin@gmail.com or 09762623231. Our place of business is 275 Saint Paul Street Republic Ave. Holy Spirit Quezon City Phillipines 1127.
An account uses your name, email address and sign-in credentials handled by Supabase Authentication. Your cart and order may contain your business name, selected products, quantities, chosen review or social links, recipient name, mobile number, delivery address, delivery notes and courier preference. When you report payment, we record the chosen payment provider, transaction reference and time. We do not ask for your bank password, wallet PIN or card number; payment takes place in your bank or wallet app.
A Tappin’ Page uses the profile, business and destination details you provide for publication. Those details become public when you publish the page. Connect records page views and link clicks as page and link identifiers with a timestamp for basic analytics; it does not store a visitor identity in those analytics records. Optional Pro and Team subscription status and payment references are processed with Xendit; Tappin’ does not store your card details. An included setup call uses the booking details you enter in Cal.com and its Cal Video meeting service. The custom NFC waitlist stores your email, signup time and consent version; joining it does not create an account or order.
We use account and cart information to provide sign-in, recovery and saved configurations. We use order, payment and delivery information to verify payment, fulfill your purchase, arrange delivery, issue an invoice and handle support, refunds and disputes. We use page and card settings to provide the destination and page you choose. These uses are needed to take steps you request, perform our contract, meet legal obligations and protect orders against misuse. We use a waitlist email only for custom NFC launch updates on the basis of the consent you give in that form; you can withdraw that consent by emailing us.
When someone opens a Tappin-managed card link, we store the card identifier, time, and whether the link was encoded for NFC or printed as a QR code. This supports card counts without recording the visitor’s name, account, IP address, or browser user agent in those records. Hosting providers may process ordinary request logs to operate and secure the site. Essential cookies keep you signed in. Browser storage retains an unsynced guest cart and theme preference. We do not use advertising tracking cookies in this storefront.
Supabase hosts authentication and application data, and our website host processes requests needed to run the storefront. We share the recipient, phone and destination details needed by a courier when delivery is arranged. Cal.com receives the details you enter when you book an included call. Payment is made in your GCash or MariBank app, which handles it under its own privacy terms. Opening an external destination such as Google or a social platform takes you to that provider’s service. Service providers may process information outside the Philippines; Tappin’ remains responsible for handling it under Philippine privacy law. We do not sell customer or waitlist information.
We keep account, cart, page and card settings while the service is active and remove them after a verified closure request unless a transaction or live claim requires specific data. We keep paid-order, payment, delivery and invoice records for five years from the day after the relevant tax-return filing deadline, or from actual late filing, and longer while a related tax matter or legal claim remains unresolved. We keep unpaid-order records while payment or a complaint is unresolved, then remove them when no longer needed. We keep waitlist emails until you withdraw or the custom NFC launch-update campaign ends. We keep QR scan timestamps while a card is active to show lifetime and recent counts, then erase them when the card service is closed.
We remove or de-identify information when its stated purpose ends, except for records we must keep by law or to resolve a live claim. Copies in provider backups expire through their backup cycles rather than immediately from every backup. We restrict access to retained records and use account ownership controls for customer data.
You may correct cart and page details in your account, remove cart items, or withdraw from the waitlist by contacting us. You may ask to access, correct, object to processing of, or erase your personal information, subject to applicable legal retention duties. You may also raise a complaint with the National Privacy Commission. Email tappin@gmail.com with your request. We may verify your identity before acting so another person cannot access or delete your information.
We may revise this policy as our services change. We will show the updated date here and give any notice required by Philippine law.
View the terms and conditions.
Card orders may also store your selected Page, a snapshot of its public design details, uploaded artwork or logos, a design brief, destination URL, and proof approvals. We use these to create and fulfill your card. Artwork files and batch proofs are private to the workspace owner, workspace admins and authorized staff; the approved files and encoding links needed to make the card are shared with our manufacturer.
In a Team workspace, the owner and admins can access workspace Pages, cards, contacts, form submissions, consent history and analytics. Members and viewers can access these only for their assigned resources according to their role. Owners and admins control assignments and can revoke access. Invitation email addresses and hashed, expiring invitation tokens are stored to manage membership. Each member uses their own account; passwords are not shared.
Google data and AI disclosures updated 21 October 2026.
When you choose Sign in with Google, Google shares your account identifier, name, email address and profile picture with Supabase Authentication. We use this information to create or link your Tappin’ account and provide secure sign-in. Supabase stores the account and authentication information; Vercel hosts Tappin and processes the requests needed to operate the service. Google sign-in does not give us access to your Gmail messages, Google Drive files or other Google Workspace content. We retain this account information while your account is active and handle verified deletion requests under the retention and deletion rules below. You can request deletion by contacting support@tappin.ph.
Google Calendar access is optional and separate from Google sign-in. When a workspace owner chooses Connect Google Calendar and grants permission, we obtain the primary calendar’s identifier and time zone, check free/busy intervals to offer appointment times, and read, create, reschedule or cancel Tappin service appointments in that calendar. We request calendar.calendars.readonly for calendar identity and time zone, calendar.events.freebusy for availability, and calendar.events.owned for managing appointments on a calendar the owner owns.
A visitor must explicitly choose to save an appointment in the owner’s Google Calendar. The event contains the service title, start and end times, time zone and internal booking identifiers. Visitor contact details and request notes remain in the owner’s Tappin request; we do not add visitors as Google event attendees or send Calendar invitation emails. Supabase hosts connection and booking records, and Vercel hosts Tappin’s server requests. Google receives the authorization and event data needed to provide the Calendar service under its own privacy terms.
Access and refresh tokens are encrypted in server-side storage and are not exposed on public Pages. Google Calendar information is used for the Calendar connection and appointment features, not advertising or AI model training. Tappin’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
The owner can disconnect in Settings to stop Tappin’s active Calendar use and request revocation of Google access, or revoke access through their Google Account connections. Active credentials are cleared on disconnect; encrypted credentials may remain temporarily in a restricted revocation queue until cleanup succeeds. Disconnecting does not cancel existing appointments or erase booking history. Connection metadata and booking/audit records follow the retention and deletion rules in this policy. For access, correction or deletion requests, contact support@tappin.ph.
We share Google user data only as needed to provide the features you authorize: with Supabase for authentication and application storage, with Vercel for hosting and server processing, and with Google for sign-in, authorization and Calendar operations. Within Tappin, access is limited by account ownership, workspace roles and Page permissions. Human access to Google user data is permitted only with your explicit consent for specific support requests, for security purposes, or where required by law. We do not sell Google user data, disclose it to advertisers or data brokers, or transfer it for purposes unrelated to these features. These processors may process data outside the Philippines.
We use HTTPS/TLS for data in transit between your browser, Tappin and Google’s APIs. Calendar access and refresh tokens are additionally encrypted using AES-256-GCM with a server-only key and workspace-bound authentication. Calendar credentials, OAuth state and revocation records are kept in private database tables with row-level security enabled and direct access revoked from public and client API roles. Server-side authorization checks restrict Calendar operations to the appropriate workspace. Tokens are not included in public Page content or AI prompts. We keep access to credentials limited to the server operations that need them.
Tappin does not use Google Workspace API data, including raw, aggregated, anonymized or derived data, to create, train or improve foundational, generalized or non-personalized AI or machine-learning models. Calendar identifiers, time zones, free/busy results, Calendar event responses and OAuth credentials are processed by the Calendar service and are not supplied to our AI integrations. The AI services have no tool to read Google Calendar or other Google Workspace APIs. Tappin’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including their Limited Use requirements.
When you use an AI feature, relevant information you provide in Tappin may be sent to Vercel AI Gateway and its inference provider Parasail to generate the requested response. This may include your request, recent conversation messages, public Page and business details, explicitly approved knowledge passages, or a photo you submit for an AI-assisted feature. We use the Google Gemma model served by Parasail through Vercel; this is not the Gemini API or a Google Workspace data connector. Google Calendar data is not automatically added to these requests. Information you choose to type or upload into an AI feature is processed as part of that request, so include only information you are authorized to share.
AI requests are restricted to the approved Parasail route, with no alternative model fallback. Each request disallows prompt training, and the server checks that the selected provider endpoint is listed by Vercel as supporting both no training and zero data retention before sending any prompt. If that check fails, the AI request is refused. Vercel states that AI Gateway does not retain prompts or outputs; Parasail processes requests under its no-training and zero-retention arrangements with Vercel. Operational records such as request status, model, token counts and cost may be retained separately from prompt content. Tappin retains conversations, saved sources and AI results needed for your features under the retention and deletion rules in this policy.
The hosted LlamaParse document reader is not enabled and does not receive files or Google user data. Where available, background removal uses a fixed BiRefNet model on Tappin’s server infrastructure: the image is processed locally on that infrastructure, not sent to the model publisher or a third-party inference API for training or secondary use. This image feature does not read Google Workspace APIs.