1. Scope and who is responsible
This notice explains how taplyy, an unincorporated business operated from Lebanon, handles personal data for its own purposes when you visit our website, contact us, evaluate the service, create or use a business workspace, or interact with support.
It does not primarily govern data a business customer places in passes or processes through its customer program. For that data, read the Passholder Privacy Notice; the business customer generally decides why and how it is used, while taplyy acts as its service provider or processor.
2. Information we collect
- Account and identity data, such as name, business email, profile image, Google account identifier, workspace, role, and authentication records supplied through Supabase and Google sign-in.
- Business and commercial data, such as company name, locations, use case, plan, order details, invoices, tax information, and communications about a purchase.
- Support and contact data, including messages, attachments, feedback, meeting details, and records needed to resolve a request.
- Technical and usage data, such as IP address, browser, device type, timestamps, requested pages, diagnostic events, security logs, feature interactions, and first-party product analytics.
- Cookie and local-storage data described in the Cookie Notice.
3. Sources of information
We receive data directly from you, from a workspace administrator, from your use of the service, from Google when you choose Google sign-in, from our infrastructure providers, and from business partners or public professional sources when lawful.
We do not receive your Google password. Google sign-in shares only the identity data and permissions presented during the sign-in flow.
4. Why we use information
- Provide, authenticate, administer, support, and secure the website and service.
- Create and manage workspaces, communicate service notices, and respond to requests.
- Prepare orders, administer subscriptions, process payments through an appointed provider, and maintain business records.
- Monitor reliability, prevent abuse and fraud, troubleshoot, and improve features using internal analytics.
- Send requested product information and, where permitted, relevant business marketing with an opt-out.
- Comply with law, enforce agreements, establish or defend claims, and protect people, platforms, and the service.
Depending on the applicable law, we rely on performance of a contract, steps requested before a contract, legitimate business interests, legal obligations, or consent. Where consent applies, it may be withdrawn without affecting earlier lawful processing.
5. When we disclose information
We do not sell personal data and do not permit pass-derived data to be used for targeted advertising or data-broker activity. Service providers may process data only for contracted services and under appropriate confidentiality and data-protection obligations. Apple and Google may act independently under their own privacy notices for their platforms.
- Vercel for website hosting, content delivery, operational logs, and monitoring.
- Supabase for database, authentication, and related backend infrastructure.
- Google for the sign-in flow you choose and, where relevant, Google Wallet platform operations.
- Apple for Apple Wallet platform operations initiated by a customer or passholder.
- A future payment provider for checkout, fraud prevention, and payment administration after it is selected and disclosed.
- Professional advisers, authorities, counterparties to a business reorganization, or other recipients when necessary and lawful.
6. International processing
taplyy operates from Lebanon and its providers may process data in other countries. Those countries may have different privacy laws. Where applicable law requires a transfer mechanism, we will use appropriate contractual or other safeguards and make relevant information available on request.
Customers should select available hosting regions and configure their programs with passholder locations and legal requirements in mind.
7. Retention
We retain information only as long as reasonably needed for the purposes above, including the account or contract term, support, security, tax and accounting obligations, dispute limitation periods, and backup cycles. Retention varies by record type and legal requirement.
When data is no longer required, we delete it, anonymize it, or isolate it from active use until deletion from backups. Customers control retention of Customer Personal Data subject to the Data Processing Addendum and technical limits.
8. Security
We use reasonable organizational and technical safeguards designed to protect personal data, including access controls, encrypted network transport, provider security controls, logging, backups, and restricted production access. Security depends partly on customers protecting their accounts, credentials, exports, and connected systems.
No method of storage or transmission is completely secure. Contact us immediately if you suspect unauthorized access involving taplyy.
9. Your choices and rights
Depending on your location, you may have rights to ask for access, correction, deletion, restriction, objection, portability, or withdrawal of consent. You may also opt out of marketing at any time. We may need to verify your identity and may retain information where law permits or requires it.
Lebanon's Law No. 81/2018 provides rights concerning personal-data processing, including rights to review and object in applicable circumstances. Requests may be sent to support@taplyy.com. You may also complain to a competent authority where that right applies.
10. Children
The taplyy business service is not directed to children and workspace accounts are for adults authorized by a business. Customers must not use taplyy to collect children's data or issue child-directed passes without our prior written approval and all legally required parental notices and consents.
11. Changes and contact
We may update this notice as the service, providers, or law changes. The effective date and version identify the current notice. We will provide additional notice of material changes when appropriate.
For privacy questions or requests, email support@taplyy.com. Because taplyy has not yet been incorporated, this notice will be updated with the registered entity name and service address before commercial launch or promptly after incorporation.