Privacy Policy

1. Who Controls Your Personal Information

Tapmy acts as a data controller for personal information processed through the Services for the purposes described in this Privacy Policy.

When Customer information is made available to a Creator, that Creator also acts as an independent controller for the Creator's own purposes, such as fulfilling an order, delivering a service, managing a customer relationship, sending lawful communications, handling taxes, or resolving a refund or dispute. A Creator's own privacy notice may therefore also apply.

Tapmy and each Creator are responsible for their respective use of personal information. Stripe processes payment, identity-verification, fraud-prevention, and regulated financial information under its own terms and privacy notice.

2. 1. Personal Information We Collect

The information we collect depends on how you use the Services.

Information You Provide

We may collect:

• Account information, such as your name, email address, profile image, authentication details, account preferences, and support language.
• Creator and business information, such as your brand, business goals, niche, audience, offers, products, pricing, content, storefront settings, policies, social profiles, and business preferences.
• Store and product content, including digital products, eBooks, templates, Courses, Community materials, Webinar details, Service descriptions, booking availability, images, videos, files, and other materials you upload or create.
• Customer and CRM information, such as names, email addresses, purchases, subscriptions, bookings, Course progress, Community access, form responses, messages, support requests, offer engagement, and customer history.
• Communications, including emails, support conversations, feedback, survey responses, and other messages you send to Tapmy.
• AI information, including prompts, files, instructions, business context, audience signals, generated content, AI Clone conversations, agent configurations, and generated outputs. When you use Tapmy Assistant, we collect this from what you type, the text of what you dictate, or photos and files you attach, and from store records the assistant reads when you ask it to do something.
• Marketing information, such as communication preferences, campaign engagement, referral information, and event registrations.
• Imported information, including contacts, content, products, and business data that a Creator chooses to import into Tapmy.

Creators must have a lawful basis and all required permissions before uploading, importing, or using another person's information through Tapmy.

Information Collected From Customers

When a Customer interacts with a Creator storefront, we may collect:

• contact and account details;
• checkout and transaction information;
• purchases, subscriptions, downloads, bookings, Course participation, Webinar registrations, and Community activity;
• messages, form responses, reviews, or other information submitted to a Creator;
• AI Clone and support conversations;
• access, delivery, and download logs; and
• information necessary to maintain access to purchased content or Services.

The Creator operating the storefront receives relevant Customer information and may use it under the Creator's own privacy notice.

Payments and Stripe Information

Buyer payments are processed through the Creator's Stripe Connect Standard account.

A purchase or subscription is created as a direct charge on the Creator's connected Stripe account. Tapmy may receive an application fee under the Creator's Tapmy plan. Stripe processing fees are separate and are charged by Stripe to the connected account.

Tapmy may receive and store:

• Customer email addresses;
• Stripe customer, account, payment, charge, invoice, subscription, refund, and dispute identifiers;
• transaction amount, currency, status, and timestamps; and
• limited information necessary to update access, transaction ledgers, referral commissions, refunds, or subscription status.

Tapmy does not receive or store complete card numbers, CVCs, or full bank-account credentials. Stripe processes that information under its own terms and privacy notice.

The Creator—not Tapmy—is the seller and merchant for the Creator's products and Services. Tax treatment depends on the Creator's business and Stripe configuration. Refunds and disputes relating to Creator sales are processed through the Creator's connected Stripe account.

A Creator's own subscription to a Tapmy paid plan is processed separately through Tapmy's platform Stripe account.

Information From Connected Accounts and Integrations

If you connect an account or service, we may receive the information and permissions you authorize that provider to share. Connected services may include Instagram, TikTok, YouTube, Google, Apple, Google Calendar, Google Meet, and supported social-publishing, content, analytics, or business integrations.

Depending on the integration and permissions granted, this may include profile information, content, audience and engagement data, publishing permissions, calendar availability, authentication identifiers, and access or refresh tokens.

We use connected-account information for the feature requested by the Creator, such as authentication, audience analysis, content creation, publishing, scheduling, and business analytics. We do not use connected-account data for third-party advertising.

Information Collected Automatically

When you use the Services, we may automatically collect:

• IP address and approximate location derived from it;
• browser, device, operating system, language, and application version;
• session, page, click, referral, and feature-usage information;
• timestamps, error reports, performance data, and security logs;
• email delivery, open, and click information where lawful;
• cookie and similar-technology identifiers; and
• information about how a Customer moves through a Creator storefront or checkout.

We do not collect precise GPS location.

Mobile Permissions

On iOS and iPadOS, Tapmy may access:

• a push-notification token, if notifications are enabled;
• the microphone only when you activate dictation or voice input; and
• photos or files only when you choose content to upload.

Tapmy does not request access to your contacts, Health data, precise GPS location, or biometric identifiers for the Services covered by this Policy.

Sensitive Information

Tapmy does not intentionally request sensitive personal information unless it is necessary for a clearly identified feature or legal purpose. Do not submit health, financial, government-identification, biometric, or other sensitive information unless it is necessary, lawful, and appropriate for the feature you are using.

We do not use sensitive personal information to infer characteristics about a person or create an advertising profile.

3. 2. How We Use Personal Information

We use personal information to:

• create, authenticate, and manage accounts;
• build and operate Creator storefronts, custom domains, and Link in Bio pages;
• create, sell, deliver, and manage Digital Products, eBooks, Notion Templates, Services, bookings, Communities, Courses, and Webinars;
• process checkout activity, subscriptions, access, refunds, disputes, and transaction records;
• analyze a Creator's connected audience, content, offers, and business performance;
• recommend, create, package, price, and improve offers;
• operate AI agents, AI Clone, content generation, publishing, CRM, analytics, and growth automation;
• provide Customer access, downloads, bookings, Course progress, and Community participation;
• send receipts, access instructions, booking reminders, security notices, and other service communications;
• provide support and respond to requests;
• measure performance, diagnose errors, improve reliability, and develop the Services;
• detect fraud, abuse, unauthorized access, and violations of our terms;
• comply with legal, accounting, tax, regulatory, and contractual obligations;
• establish, exercise, or defend legal claims;
• send marketing communications where permitted by law; and
• measure or deliver advertising where the required consent or other lawful basis exists.

Legal Bases

Where applicable law requires a legal basis, we rely on one or more of the following:

• Performance of a contract, including operating accounts, storefronts, checkout, delivery, subscriptions, and requested product features.
• Legitimate interests, including securing and improving the Services, supporting users, preventing fraud, understanding product performance, and operating our business, where those interests are not overridden by your rights.
• Consent, including for certain connected-account permissions, marketing, non-essential cookies, analytics, and targeted advertising.
• Compliance with law, including financial recordkeeping, lawful requests, and regulatory obligations.
• Protection of vital interests or legal claims, where applicable.

You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal.

Email and Other Communications

Receipts, purchase access, booking reminders, security messages, and service notices may be sent where necessary to provide the Services or perform a contract.

Tapmy marketing communications are sent with consent or another basis permitted by law. Unsubscribing from marketing does not stop transactional or essential service messages.

Creators are responsible for the lawful basis, content, and recipient lists used in their own campaigns. Tapmy provides unsubscribe and suppression mechanisms for Creator campaigns where applicable.

4. 3. AI and Automated Features

Tapmy uses OpenAI and OpenRouter to provide AI functionality.

AI features may process prompts, files, content, Creator business context, audience signals, offers, CRM information, Customer interactions, AI Clone conversations, and generated outputs.

Tapmy personnel do not routinely review AI inputs or outputs. Limited access may occur only where reasonably necessary to:

• provide support requested by a user;
• investigate security, abuse, or a violation of our terms;
• maintain the reliability of the Services; or
• comply with law.

Tapmy Assistant and Your Permission

Tapmy Assistant is the AI chat in the Tapmy dashboard. It generates replies and carries out what you ask, such as creating or editing store content, answering questions about your store, searching the web, and generating images.

In the Tapmy iOS and iPadOS app, the first time you send something to Tapmy Assistant, we ask for permission before sharing your information with an AI provider. You can choose Allow or Not Now. If you choose Not Now, nothing is shared.

When you allow Tapmy Assistant and use it, we may share:

• your messages, and any photos or files you attach;
• your store content, such as your profile, offers, prices, links, and documents;
• customer and Community member details the assistant looks up for you, such as names, email addresses, and phone numbers;
• store stats, such as sales, earnings, and visits;
• web search questions; and
• image prompts and reference images.

Tapmy Assistant does not receive your account password or full payment card details.

We send that information to OpenAI and OpenRouter. OpenRouter routes each request to the AI model provider that serves the model Tapmy selected. You do not choose the model.

You can allow or withdraw this permission at any time in Settings → Privacy, on a desktop browser, a mobile browser, or the Tapmy iOS and iPadOS app. After you withdraw, Tapmy Assistant does not share your information until you allow it again. Withdrawal does not undo processing that already happened. Tapmy keeps the conversation in your account until you delete that conversation or close your account. What happens after that is described in Data Retention and Account Deletion.

How AI Providers Protect Your Information

Tapmy does not use this information to train its own models or permit it to be used to train general-purpose models.

OpenAI does not use data sent through its API to train its models by default. OpenRouter states that it does not use inputs or outputs for model training. Tapmy instructs OpenRouter to route each request only to a provider that does not store the data or use it to train models.

We only share AI data with providers whose published terms and data controls protect your information at least as well as this Privacy Policy.

These providers may nevertheless temporarily process or retain limited information where necessary to operate their services, maintain security, prevent abuse, or comply with law. You can read how they describe those practices here:

• OpenAI Privacy Policy;
• OpenAI business and API data usage;
• OpenRouter Privacy Policy; and
• OpenRouter provider logging and data policies.

AI Clone

An AI Clone is identified as an AI system rather than the Creator personally.

AI Clone conversations may be stored in Tapmy's CRM and made available to the relevant Creator. They may be used to respond to a visitor, recommend a relevant offer, provide support, and improve the customer journey.

Do not submit sensitive information to an AI Clone unless it is genuinely necessary and appropriate.

Creator-Controlled Agents

A Creator may enable agents to create or publish content and perform approved business or growth actions. Agents act only within the permissions and automation settings enabled by the Creator.

Payments, refunds, payout-detail changes, and other financially critical actions require the Creator's explicit authorization.

Tapmy does not use solely automated processing to make decisions about a person that produce legal or similarly significant effects.

AI-generated information may be incomplete or inaccurate and should be reviewed before reliance. AI output is not medical, legal, financial, or other regulated professional advice.

5. 4. How We Share Personal Information

We may disclose personal information as follows.

With Creators and Customers

We disclose information necessary to operate a Creator's business, fulfill a Customer request, deliver a purchase, manage a booking or subscription, provide Course or Community access, or support a Creator–Customer relationship.

With Service Providers

We use service providers that process information for infrastructure, payments, communications, AI, integrations, analytics, security, and advertising. These providers may include:

• Infrastructure and application services: DigitalOcean, Cloudflare, and Lovable;
• Payments: Stripe;
• Email delivery: Resend;
• AI services: OpenAI and OpenRouter (and the model providers OpenRouter routes requests to);
• Social data and publishing: Apify and bundle.social;
• Authentication and connected services: Google and Apple;
• Calendar and meetings: Google Calendar and Google Meet;
• Analytics and product insights: Google Analytics, Google Tag Manager, Mixpanel, Hotjar, and Boostra; and
• Advertising and measurement: Meta, TikTok, and X.

Creators may also install Meta, Google, or TikTok pixels on their storefronts. Such pixels are subject to consent requirements and the Creator's own responsibilities.

We require service providers to protect personal information and use it only for permitted purposes, subject to their own legal obligations where they act as independent controllers.

With Connected Platforms

When you request an integration, we disclose information and instructions necessary to authenticate, publish, schedule, retrieve authorized data, or perform the requested action.

For Legal and Safety Reasons

We may disclose information when reasonably necessary to:

• comply with law, regulation, court order, or lawful government request;
• protect users, Tapmy, Creators, Customers, or the public;
• prevent or investigate fraud, security incidents, abuse, or illegal activity;
• enforce our terms; or
• establish, exercise, or defend legal claims.

With Professional Advisers

We may share information with lawyers, auditors, accountants, insurers, and other professional advisers subject to appropriate confidentiality duties.

In a Business Transaction

Information may be disclosed as part of a merger, acquisition, financing, restructuring, sale of assets, insolvency, or similar transaction, subject to applicable law.

Aggregated or De-identified Information

We may use and disclose information that has been aggregated or de-identified so it can no longer reasonably identify an individual. We will not attempt to re-identify it except where permitted by law to test our de-identification safeguards.

6. 5. Information You Make Available to Others

Information you publish on a storefront, public profile, Community, review, or other public area may be visible to other people and may be copied or shared outside Tapmy.

When a Customer purchases, books, subscribes, enrolls, joins a Community, submits a form, or speaks with an AI Clone, relevant information is made available to the Creator. The Creator may retain and use that information under the Creator's own privacy notice and legal obligations.

Creators must:

• provide appropriate privacy disclosures;
• obtain any required consents;
• use Customer information only for lawful purposes;
• honor applicable marketing and privacy rights; and
• protect information exported from Tapmy.

Be careful not to publish or submit personal or sensitive information that you do not want other people to receive.

7. 6. Cookies, Analytics, and Advertising

Tapmy uses cookies and similar technologies to keep the Services working, maintain sessions, protect accounts, remember preferences, understand usage, attribute referrals, and measure advertising.

Cookie Choices

Essential cookies operate where necessary to provide and secure the Services.

Where consent is required, non-essential analytics, advertising technologies, and Creator-installed pixels do not operate until consent is provided. You may change or withdraw consent through the Cookie Settings control available through the Services. After withdrawal, only essential technologies remain active, except where another use is permitted by law.

Tapmy may use a first-party tapmy_ref cookie for referral attribution for up to 90 days, subject to applicable consent requirements.

Advertising Disclosures

Tapmy does not sell personal information for money.

Meta Ads, TikTok Ads, and X Ads may receive identifiers, device information, approximate location, and activity information for measurement or targeted advertising where permitted. Under some United States privacy laws, these disclosures may be considered a "sale," "sharing," or processing for targeted advertising even when no money is exchanged.

You may opt out through Cookie Settings. Where required by law, Tapmy also treats a recognized Global Privacy Control signal as a request to opt out of sale, sharing, or targeted advertising for the browser or device sending the signal.

8. 7. Your Privacy Rights

Depending on where you live, you may have the right to:

• access personal information we hold about you;
• receive information about how we process it;
• correct inaccurate or incomplete information;
• request deletion;
• restrict processing;
• receive your information in a portable format;
• object to processing based on legitimate interests;
• withdraw consent;
• opt out of sale, sharing, or targeted advertising;
• appeal a decision regarding a privacy request;
• use an authorized agent where permitted by law; and
• lodge a complaint with a data-protection or privacy authority.

You will not be discriminated against for exercising a privacy right.

To submit a request, email [email protected]. We may need to verify your identity and authority before fulfilling a request. We will respond within the period required by applicable law.

If a request concerns information also controlled by a Creator, we may involve or direct you to that Creator. This does not limit your ability to exercise rights directly against Tapmy for processing for which Tapmy is responsible.

Some rights are subject to exceptions. For example, we may retain information necessary to complete a transaction, preserve purchased access, meet legal obligations, prevent fraud, resolve disputes, or establish legal claims.

9. 8. Data Retention and Account Deletion

We retain information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, preserve Customer access, comply with law, resolve disputes, and enforce agreements.

Our standard retention periods are:

| Information | Standard retention | |---|---| | Active account and storefront information | While the account or storefront remains active | | Information scheduled for deletion from active systems | Normally within 30 days after verified deletion or account closure | | Encrypted backups | Up to 90 days before rotation or deletion | | Security and access logs | Up to 12 months | | Support history | Up to 24 months | | Short-term Community operational logs | Up to 7 days | | Payment, refund, dispute, tax, and accounting records | Normally 5–7 years, or longer if required by law |

We may retain information longer where reasonably necessary for litigation, fraud prevention, a regulatory request, or another legal obligation. De-identified information may be retained for longer.

Closing a Creator Account

When a Creator account is closed:

• the storefront is unpublished;
• the Tapmy plan and active Community subscriptions are canceled;
• integrations, access tokens, agents, and AI Clone are disabled;
• the Creator remains responsible for handling future bookings, including required cancellations or refunds;
• limited order, payment, refund, dispute, tax, and accounting records are retained as required by law; and
• limited access and purchase records may be retained so Customers can continue accessing previously purchased downloads or Courses.

Other personal information is deleted in accordance with the retention schedule above.

10. 9. Children

Customers, students, and Community members must be at least 13 years old, or the higher minimum age required by the law where they live.

A Creator must be at least 18 years old, or the applicable age of legal majority, to create a Creator account, sell through Tapmy, or connect Stripe.

Where the law requires parental or guardian consent for a person between 13 and the applicable age of consent, that consent must be obtained before the person uses the relevant feature.

Tapmy does not knowingly collect personal information from children below the applicable minimum age. If you believe a child has provided information unlawfully, contact [email protected].

Creators must not direct offers, Courses, Communities, or other Services to children without an appropriate lawful basis, required parental consent, and suitable protections.

11. 10. Third-Party Links and Connected Services

The Services may link to third-party websites, applications, payment services, social networks, or tools. Their privacy practices are governed by their own policies, not this Privacy Policy.

When you disconnect an integrated account, Tapmy promptly revokes or deletes the relevant access and refresh tokens where technically supported. Content or business information previously imported into Tapmy may remain until you delete it or close your account, subject to our retention obligations.

Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

Deleting or disconnecting an integration from Tapmy does not necessarily delete information held independently by the third-party provider.

12. 11. Security

Tapmy uses administrative, technical, and organizational safeguards designed to protect personal information, including:

• TLS/HTTPS encryption in transit;
• encryption at rest for databases, files, and backups;
• hashed-password storage;
• encryption of OAuth tokens and other sensitive credentials;
• role-based and least-privilege access controls;
• logging, monitoring, and bot protection; and
• incident-response procedures.

If a personal-data breach requires notice, we will notify affected users and relevant authorities in the manner and within the time required by law.

No system is completely secure. We cannot guarantee that unauthorized access, loss, misuse, or alteration will never occur.

13. 12. International Data Transfers

Tapmy's production databases, files, and backups are hosted in Frankfurt, Germany, within the European Union.

Some service providers, including AI, analytics, communications, and connected-platform providers, may process information outside the European Economic Area, Switzerland, or the United Kingdom.

Where required, we use recognized safeguards such as:

• adequacy decisions;
• the European Commission's Standard Contractual Clauses;
• the United Kingdom's applicable transfer addendum or other approved mechanism; and
• supplementary technical and organizational measures.

14. 13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to the Services, our practices, or applicable law.

We will publish the updated Policy with a revised effective date. If a change is material, we may also provide notice through the Services, by email, or by another appropriate method.

15. 14. Contact Us

For privacy questions, requests, or complaints, contact:

Blackridge Software LLC
Texas Secretary of State file no.: 0806694459
Registered office: 5222 Fenton Ln, Belton, TX 76513, United States
Email: [email protected]

You may also lodge a complaint with the data-protection or privacy authority responsible for your place of residence, work, or the location of an alleged infringement.