Facts checked 29 October 2026
Our main databases and uploaded files are stored with Supabase in Singapore. Production and development use separate databases in that location. Tappin’s Vercel server functions also run in Singapore.
This does not mean every copy or request stays in Singapore. Vercel’s delivery network, service logs, email, sign-in, AI and payment providers may process information in other countries. Restricted migration backup copies are kept separately from the live databases. We do not promise that all processing happens in the Philippines or Singapore.
Supabase stores account records, company records, Page content and uploaded files, and handles sign-in. Vercel hosts the website, delivers pages and runs server requests.
When you choose an AI feature, the relevant request and approved context go through Vercel AI Gateway to Parasail. The current route uses Google’s Gemma model served by Parasail. It checks the provider’s no-training and zero-retention support before sending a request. We have not verified a Singapore-only processing location for AI requests. Tappin keeps the conversations and results needed for your features under its own retention rules.
Namecheap Private Email handles account and service email, including the recipient address and message contents. Its processing location is not confirmed as Singapore in our configuration.
Google handles optional Google sign-in and Google Calendar connections. Company sign-in uses the identity provider chosen by your company. These services receive the identity or calendar information needed for the feature you authorize.
Xendit processes online payment information when those payment features are enabled. For manual bank or wallet payments, the provider you choose also processes the payment. Payment records needed to manage your order are retained in Tappin. These providers may process information outside Singapore.
We use encrypted HTTPS connections. Server credentials stay on the server. Company roles and Page assignments control access to company information; changing a destination or company setting requires an authorized account.
Company owners can manage who belongs to their workspace and who takes over a departing person’s work. Company sign-in and automatic user setup require a completed company setup and verification before use. The owner keeps a backup sign-in method. Ask support about availability for your company.
The Singapore move included separate copies of the databases and uploaded files, with access restricted to the operator. We have not published an automatic daily backup promise or a guaranteed recovery time. Backup copies can retain information after it is removed from the live app.
Items placed in Trash remain recoverable for 30 days before permanent removal from the live app. Account closure and backup deletion need a separate review. Some records may need to be kept for payments, fraud investigations or legal requirements; we explain any limits when handling a request.
Email support@tappin.ph with your account email and what you want to access, correct or delete. For a company request, include the company name and your role. Do not send passwords, sign-in codes or payment credentials.
We verify your identity and authority before disclosing or changing information. You can also ask about an objection to processing or a privacy concern. Your rights and any applicable limits are described by the Philippine National Privacy Commission under the Data Privacy Act.