Cookie settings & policy

1. 1. What are cookies and similar technologies?

Cookies are small text files stored on your browser or device. They can recognize a browser, remember settings, maintain a session, or help explain how a website is used.

We may also use:

• local storage, which stores information in a browser until it is removed;

• session storage, which usually expires when the browser session ends;

• pixels, tags, and web beacons, which record events such as a page view, purchase, or email open;

• software development kits, which perform similar functions in an application;

• device and app identifiers, where permitted; and

• server-side measurement, which may record an event without placing a browser cookie.

This Policy refers to these technologies collectively as “cookies.”

2. 2. First-party and third-party cookies

First-party cookies are set by the domain you are visiting, including a Tapmy Creator store or custom domain.

Third-party cookies and tags are provided by another company, such as Stripe, Google, Meta, TikTok, or X. Those companies may receive information about your browser, device, and activity under their own policies.

A cookie shown as first-party may still support a third-party service—for example, an analytics identifier stored under a Creator store’s domain.

3. 3. Our consent model

Strictly necessary technologies may operate without consent where permitted because they are required to provide a service you request or to keep the Services secure.

Where consent is required, the following remain disabled until you opt in:

• analytics and performance tools;

• session-replay or experience-analysis tools;

• advertising and retargeting pixels;

• Creator-installed analytics and advertising pixels; and

• referral attribution cookies that are not strictly necessary.

You may accept all, reject all, or choose categories through Cookie Settings.

Refusing non-essential cookies does not prevent core use of the Services, although optional measurement, personalization, or referral attribution may be unavailable.

You can withdraw consent as easily as you provide it. Withdrawal applies to future processing and does not make earlier lawful processing unlawful.

4. 4. Categories of cookies we use

| Category | Providers and examples | Purpose | Default state | |---|---|---|---| | Strictly necessary | Tapmy first-party session and consent technologies, Cloudflare, Stripe, and Google or Apple authentication selected by the user | Security, fraud prevention, bot protection, login, consent records, checkout, purchase access, load balancing, and requested functionality. Sign-in sessions may persist for up to 7 days. | Active where necessary | | Preferences | Tapmy first-party settings and consent records | Remember language, interface, privacy, and feature choices. Duration depends on the setting. | Active only where necessary or chosen | | Analytics and performance | Google Analytics, Google Tag Manager, Mixpanel, Hotjar, and Boostra | Understand visits and product use, diagnose errors, measure funnels, improve performance, and evaluate Customer journeys. | Off until consent where required | | Advertising and measurement | Meta Ads, TikTok Ads, and X Ads | Measure campaigns and conversions, attribute advertising, and, where permitted, create or reach audiences. | Off until consent | | Creator-installed technologies | Supported Meta Pixel, Google Analytics or Google Ads tags, and TikTok Pixel selected by a Creator | Measure activity on a Creator store, understand conversions, and run the Creator’s campaigns. | Off until consent where required | | Referral attribution | Tapmy first-party tapmy_ref cookie | Attribute an eligible referral to a referring partner or Creator. | Off until consent where required; expires after 90 days | | Email measurement | Technologies used with emails delivered through Resend, where enabled and legally permitted | Measure delivery, opens, or clicks and maintain unsubscribe or suppression records. | Used only as permitted by law and applicable preferences |

Google Tag Manager is a tag-management system and may not itself set a cookie. It can control other tags, which remain subject to the consent category assigned to them.

5. 5. Current cookie inventory

The Cookie Settings panel forms part of this Policy and should provide the current operational inventory of active cookies and similar technologies, including:

• cookie or technology name;

• provider;

• purpose;

• category;

• whether it is first- or third-party; and

• duration.

Provider cookie names and lifetimes may change as providers update their services. The live Cookie Settings inventory is the authoritative technical list.

Some cookies are session cookies and expire when the browser session ends. Others persist until their stated expiration or until you remove them.

Tapmy’s known referral cookie, tapmy_ref, expires 90 days after it is set unless removed sooner.

6. 6. Strictly necessary technologies

Strictly necessary technologies support functions without which the requested Service cannot operate securely.

They may be used to:

• keep you signed in;

• protect accounts and forms;

• remember privacy choices;

• prevent fraud, bots, and abusive traffic;

• load and route web traffic;

• initialize Stripe checkout after you choose to purchase;

• preserve a checkout or purchase-access session;

• authenticate through Google or Apple when you select that option; and

• provide security and service continuity.

These technologies are not used for behavioural advertising and cannot be disabled through Cookie Settings. You may block them through your browser, but parts of Tapmy may stop working.

Stripe and authentication providers may set cookies on their own domains when you interact with their flows. Their use is governed by their own privacy and cookie notices.

7. 7. Analytics and experience technologies

With consent where required, Tapmy uses Google Analytics, Mixpanel, Hotjar, and Boostra to understand how people use the Services.

These tools may process information such as:

• pages and screens viewed;

• buttons or links selected;

• referral source;

• general device and browser information;

• approximate location derived from IP address;

• session timing and navigation paths;

• product events and conversion steps; and

• technical errors or performance signals.

Hotjar may help us understand page interaction through tools such as heatmaps or session replay. We configure analytics tools to avoid intentionally capturing passwords, complete payment-card data, or sensitive form contents.

8. 8. Advertising and conversion measurement

With consent, Tapmy may use Meta Ads, TikTok Ads, and X Ads technologies to:

• measure whether an advertisement resulted in a visit, signup, or purchase;

• attribute a conversion to a campaign;

• limit or evaluate advertising;

• build audiences or reach people who may be interested in Tapmy; and

• improve campaign performance.

These providers may receive identifiers, device information, page activity, and conversion events.

Depending on applicable law, this disclosure may be considered “sharing,” “sale,” or processing for targeted advertising even though Tapmy does not sell personal information for money.

You can disable these technologies through Cookie Settings. Tapmy also honours Global Privacy Control as described below.

9. 9. Creator-installed pixels

Creators may enable supported analytics or advertising integrations on their Creator stores. Depending on the Creator’s configuration, these may include Meta Pixel, Google tags, or TikTok Pixel.

A Creator may independently determine why a supported pixel is used and may receive reporting from that provider.

The Creator is responsible for:

• having a lawful basis for tracking;

• accurately describing it in the Creator’s own privacy notice;

• using data only for permitted purposes;

• configuring the integration consistently with visitor choices; and

• complying with the provider’s advertising and measurement terms.

Tapmy’s supported consent controls are intended to prevent Creator-installed non-essential pixels from activating before required consent.

A Creator may not circumvent Tapmy’s consent controls or install undisclosed tracking. We may disable a pixel or store that violates this requirement.

10. 10. Referral cookies

Tapmy uses the first-party tapmy_ref cookie to determine whether a qualifying signup or purchase should be attributed to a referral.

The cookie:

• stores or references referral attribution;

• does not contain complete payment-card information;

• expires after 90 days; and

• is treated as non-essential where consent is required.

If you reject referral cookies, the referral may not be credited.

Creating fake traffic, accounts, purchases, or other activity to manipulate referral attribution is prohibited by the Acceptable Use Policy.

11. 11. Email pixels and links

Marketing emails may include a small pixel or tagged link that helps measure delivery, opens, or clicks where legally permitted.

You can unsubscribe from marketing emails using the link in the message.

Unsubscribing from marketing does not prevent receipts, access emails, booking reminders, security notices, or other transactional communications required to provide the Services.

Blocking remote images in your email application may limit open measurement.

12. 12. iOS and iPadOS applications

Mobile applications do not use browser cookies in exactly the same way as websites. They may use local storage, push-notification tokens, app-instance identifiers, and SDKs for comparable purposes.

Tapmy applies the same principles:

• technologies required for security, authentication, and requested functionality may operate as necessary;

• non-essential analytics or advertising technologies require consent or another valid legal basis;

• device permissions are requested when required; and

• advertising identifiers are not accessed without any permission required by the operating system and applicable law.

You can manage app permissions through device settings.

13. 13. How to manage your choices

Cookie Settings

Use the Cookie Settings control available on Tapmy web properties to:

• accept or reject non-essential categories;

• change previous choices; and

• withdraw consent at any time.

Your preference may be stored in a strictly necessary cookie.

Browser settings

Most browsers allow you to view, block, or delete cookies. Blocking all cookies may prevent login, checkout, or other essential features from functioning.

Deleting cookies may also delete your stored consent preference, requiring you to choose again.

Provider controls

Advertising and analytics providers may offer their own account-level, browser, or device controls. Those controls operate separately from Tapmy’s Cookie Settings.

Global Privacy Control

When Tapmy detects a supported Global Privacy Control (GPC) signal, we treat it as an opt-out request from the sale or sharing of personal information and from cross-context targeted advertising for that browser or device, as required by applicable law.

GPC overrides advertising and targeting preferences that conflict with the signal unless the law permits and you subsequently provide a valid site-specific choice.

GPC is not used to infer consent to analytics or other non-essential technologies.

Do Not Track

Some browsers send older Do Not Track signals. Because there is no consistent industry standard for interpreting them, Tapmy does not treat them as equivalent to GPC unless applicable law requires otherwise.

14. 14. Browser, device, and domain limitations

Cookie choices are generally specific to the browser, device, and domain where they were made.

You may need to make a separate selection when you:

• use a different browser or device;

• clear cookies or local storage;

• use a private browsing session;

• visit a Creator’s custom domain; or

• reset application data.

Where technically possible, Tapmy may associate preferences with an authenticated account, but browser- or device-level controls continue to apply.

15. 15. Data retention and international processing

Removing a cookie from your device does not necessarily delete information previously collected through that cookie.

Tapmy retains related personal information as described in the Privacy Policy. Providers may retain information according to their own policies and Tapmy’s configured retention settings.

Some providers may process information outside the EEA, United Kingdom, or Switzerland. Tapmy uses Standard Contractual Clauses and other lawful safeguards where required, as described in the Privacy Policy.

16. 16. Creator and Tapmy roles

Tapmy determines the purposes and means of its own essential, product analytics, and Tapmy advertising activities.

A Creator may independently determine the purpose of supported pixels and other tracking on the Creator’s store. The Creator is responsible for its own notices, lawful basis, vendor terms, and use of the resulting information.

Nothing in this Policy makes Tapmy the seller of a Creator Offering or the controller of every purpose selected independently by a Creator.

17. 17. Changes to this Policy

We may update this Policy when technologies, providers, laws, or the Services change.

We will update the date above and provide additional notice where a change is material or consent is required.

18. 18. Contact

Questions about cookies or privacy choices may be sent to [email protected].