Privacy Policy

1. Who We Are

RepuTap ("RepuTap," "we," "us," or "our") operates the website reputap.net and the RepuTap feedback management platform. Our contact email is info@reputap.net.

This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data — whether you are a business client ("Client") who subscribes to our platform or an end user ("End User") who submits feedback through a RepuTap-powered NFC tag or feedback form.

2. Information We Collect

2.1 From Business Clients (Subscribers)

When a business signs up for RepuTap, we collect:

• Account information: business name, contact name, email address, and password (hashed — we never store plaintext passwords)
• Billing information: processed entirely by Stripe. RepuTap does not store credit card numbers. We receive a Stripe Customer ID and subscription status.
• Business configuration: your Google Review URL, your unique feedback slug, and your plan tier.

2.2 From End Users (Feedback Submitters)

When a customer taps an NFC tag or visits a feedback link and submits a form, we may collect:

• Feedback content: rating (1–5 stars), written comments, and feedback category
• Contact information (optional): email address and/or phone number, only if the End User voluntarily provides it
• Submission metadata: timestamp and the client account the feedback is associated with

IP address: collected at the time of submission for rate limiting and bot/abuse prevention (including verification via our CAPTCHA provider). It is not stored alongside the feedback record or shown to the Client. We do not collect device identifiers or location data from End Users submitting feedback.

2.3 From Website Visitors

When you visit reputap.net, we may collect:

• Basic analytics data (page views, referrer, browser type) via Vercel Analytics or similar tools
• Information you submit through contact or demo request forms (name, email, business name)

3. How We Use Your Information

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

4. How We Share Your Information

We share information only as follows:

• Stripe — to process subscription payments. Stripe's privacy policy governs their handling of payment data: stripe.com/privacy
• Supabase — our database and authentication provider. Data is stored on Supabase infrastructure: supabase.com/privacy
• Resend — our transactional email provider, used to send feedback alerts and digests: resend.com/privacy
• Vercel — our hosting provider: vercel.com/legal/privacy-policy
• Sentry — our error monitoring provider, used to detect and diagnose application errors. Sentry may receive technical metadata (such as browser type, error stack traces, and page URLs) but does not receive End User feedback content or personal data: sentry.io/privacy
• AI service providers — to power AI-drafted reply suggestions and trend analysis features. Feedback content (ratings, comments, and categories) may be processed by third-party AI providers. No End User contact information (email, phone) is sent to AI providers. AI providers are contractually prohibited from using this data to train their models.
• Meta Platforms, Inc. — limited website activity from our homepage, sign-up page, and purchase confirmation page, via the Meta Pixel, to measure the effectiveness of our advertising (see Section 6). No End User feedback data is ever shared with Meta: facebook.com/privacy/policy
• Google LLC — limited website activity from the same three pages, via the Google Ads tag, to measure the effectiveness of our advertising (see Section 6). No End User feedback data is ever shared with Google: policies.google.com/privacy
• Law enforcement or legal process — if required by law, court order, or to protect the rights and safety of RepuTap or others

We do not share End User feedback data with any party other than the Client who owns that feedback record, except as described above for service operation purposes.

5. Data Retention

• Client account data is retained for the duration of the subscription and for 90 days after cancellation, after which it is deleted.
• Feedback records are retained as long as the associated Client account is active. Clients may delete individual feedback records from their dashboard at any time.
• End User contact information submitted with feedback is visible only to the Client and is deleted with the Client's account.
• Billing records may be retained longer as required by financial regulations.

6. Cookies and Tracking

reputap.net may use:

• Essential cookies required for authentication and session management
• Analytics cookies to understand how visitors use the site (aggregate, non-personal data)
• Meta Pixel — an advertising measurement tool from Meta Platforms, Inc. that helps us understand whether our ads lead to sign-ups and purchases
• Google Ads tag — an advertising measurement tool from Google LLC that does the same for our Google ads

The Meta Pixel and the Google Ads tag run only on our homepage, our sign-up page, and the confirmation page shown immediately after a completed subscription purchase. On those pages, Meta and Google may receive the page URL, your browser and device information, your IP address, cookie identifiers, and — on the purchase confirmation page — the subscription amount and currency. Each may use this information in accordance with its own privacy policy: facebook.com/privacy/policy and policies.google.com/privacy.

Neither tool ever runs on customer feedback pages reached by tapping a RepuTap NFC device or visiting a feedback link, and neither runs inside the Client dashboard (other than the one-time purchase confirmation described above). End Users submitting feedback are not tracked by any advertising tool.

You may disable cookies in your browser settings, use a browser or extension that blocks tracking scripts, or adjust your ad preferences in your Meta or Google account settings. Disabling essential cookies may prevent you from logging into the dashboard.

7. Data Security

We implement reasonable technical and organizational measures to protect your data, including:

• HTTPS encryption on all pages
• Hashed passwords via Supabase Auth
• Row-level security policies on our database
• Restricted admin access

No system is 100% secure. If you believe your account has been compromised, contact us immediately at info@reputap.net.

8. International Data Transfers

RepuTap is based in the United States. Our service providers (including Supabase, Stripe, Vercel, and Resend) may process data in the United States or other countries where they maintain facilities. By using the Service, you consent to the transfer and processing of your data in the United States and other jurisdictions, which may have different data protection laws than your country of residence. We ensure appropriate safeguards are in place through our agreements with service providers.

9. Data Processing Agreement (DPA)

For Clients who require a Data Processing Agreement to comply with the EU General Data Protection Regulation (GDPR), UK GDPR, or similar data protection frameworks, RepuTap offers a DPA upon request. To request a DPA, email info@reputap.net with the subject line "DPA Request." We will provide a signed copy within 10 business days.

10. Children's Privacy

RepuTap is not directed to children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has submitted information through our platform, contact us at info@reputap.net and we will delete it promptly.

11. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Restrict or object to certain processing
• Data portability — receive your data in a structured format
• Opt out of marketing emails at any time via the unsubscribe link in any email we send
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, email info@reputap.net with the subject line "Privacy Request." We will respond within 30 days.

12. California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA):

• The right to know what personal information we collect, how it is used, and whether it is sold or shared
• The right to delete your personal information
• The right to correct inaccurate personal information
• The right to opt out of the sale or sharing of personal information. We do not sell personal information. Our use of the Meta Pixel and the Google Ads tag on our homepage, sign-up page, and purchase confirmation page (see Section 6) may be considered "sharing" for cross-context behavioral advertising under California law. To opt out, email us as described below, or enable the Global Privacy Control signal or a tracker-blocking tool in your browser. End User feedback data is never sold or shared.
• The right to limit the use of sensitive personal information (we do not process sensitive personal information beyond what is necessary to provide the Service)
• The right to non-discrimination for exercising your rights

To submit a CCPA/CPRA request, email info@reputap.net with the subject line "CCPA Request."

13. Do Not Track

Some browsers offer a "Do Not Track" (DNT) signal. RepuTap does not currently respond to DNT signals because there is no industry-standard protocol for handling them. Apart from the limited Meta Pixel and Google Ads tag use described in Section 6, we do not engage in cross-site tracking of our users, and End Users submitting feedback are never tracked across sites.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Effective" date at the top of this page. For material changes, we will notify active Clients by email at least 14 days before the changes take effect. Continued use of the platform after changes constitutes acceptance of the updated policy.

15. Contact Us