Privacy Policy

1. Who We Are

RepuTap ("RepuTap," "we," "us," or "our") operates the website reputap.net and the RepuTap feedback management platform. Our contact email is info@reputap.net.

This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data — whether you are a business client ("Client") who subscribes to our platform or an end user ("End User") who submits feedback through a RepuTap-powered NFC tag or feedback form.

2. Information We Collect

2.1 From Business Clients (Subscribers)

When a business signs up for RepuTap, we collect:

• Account information: business name, contact name, email address, and password (hashed — we never store plaintext passwords)
• Billing information: processed entirely by Stripe. RepuTap does not store credit card numbers. We receive a Stripe Customer ID and subscription status.
• Business configuration: your Google Review URL, your unique feedback slug, and your plan tier.

2.2 From End Users (Feedback Submitters)

When a customer taps an NFC tag or visits a feedback link and submits a form, we may collect:

• Feedback content: rating (1–5 stars), written comments, and feedback category
• Contact information (optional): email address and/or phone number, only if the End User voluntarily provides it
• Submission metadata: timestamp and the client account the feedback is associated with

We do not collect device identifiers, IP addresses, or location data from End Users submitting feedback.

2.3 From Website Visitors

When you visit reputap.net, we may collect:

• Basic analytics data (page views, referrer, browser type) via Vercel Analytics or similar tools
• Information you submit through contact or demo request forms (name, email, business name)

3. How We Use Your Information

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

4. How We Share Your Information

We share information only as follows:

• Stripe — to process subscription payments. Stripe's privacy policy governs their handling of payment data: stripe.com/privacy
• Supabase — our database and authentication provider. Data is stored on Supabase infrastructure: supabase.com/privacy
• Resend — our transactional email provider, used to send feedback alerts and digests: resend.com/privacy
• Vercel — our hosting provider: vercel.com/legal/privacy-policy
• Sentry — our error monitoring provider, used to detect and diagnose application errors. Sentry may receive technical metadata (such as browser type, error stack traces, and page URLs) but does not receive End User feedback content or personal data: sentry.io/privacy
• AI service providers — to power AI-drafted reply suggestions and trend analysis features. Feedback content (ratings, comments, and categories) may be processed by third-party AI providers. No End User contact information (email, phone) is sent to AI providers. AI providers are contractually prohibited from using this data to train their models.
• Law enforcement or legal process — if required by law, court order, or to protect the rights and safety of RepuTap or others

We do not share End User feedback data with any party other than the Client who owns that feedback record, except as described above for service operation purposes.

5. Data Retention

• Client account data is retained for the duration of the subscription and for 90 days after cancellation, after which it is deleted.
• Feedback records are retained as long as the associated Client account is active. Clients may delete individual feedback records from their dashboard at any time.
• End User contact information submitted with feedback is visible only to the Client and is deleted with the Client's account.
• Billing records may be retained longer as required by financial regulations.

6. Cookies and Tracking

reputap.net may use:

• Essential cookies required for authentication and session management
• Analytics cookies to understand how visitors use the site (aggregate, non-personal data)

We do not use third-party advertising cookies or tracking pixels. You may disable cookies in your browser settings. Disabling essential cookies may prevent you from logging into the dashboard.

7. Data Security

We implement reasonable technical and organizational measures to protect your data, including:

• HTTPS encryption on all pages
• Hashed passwords via Supabase Auth
• Row-level security policies on our database
• Restricted admin access

No system is 100% secure. If you believe your account has been compromised, contact us immediately at info@reputap.net.

8. International Data Transfers

RepuTap is based in the United States. Our service providers (including Supabase, Stripe, Vercel, and Resend) may process data in the United States or other countries where they maintain facilities. By using the Service, you consent to the transfer and processing of your data in the United States and other jurisdictions, which may have different data protection laws than your country of residence. We ensure appropriate safeguards are in place through our agreements with service providers.

9. Data Processing Agreement (DPA)

For Clients who require a Data Processing Agreement to comply with the EU General Data Protection Regulation (GDPR), UK GDPR, or similar data protection frameworks, RepuTap offers a DPA upon request. To request a DPA, email info@reputap.net with the subject line "DPA Request." We will provide a signed copy within 10 business days.

10. Children's Privacy

RepuTap is not directed to children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has submitted information through our platform, contact us at info@reputap.net and we will delete it promptly.

11. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Restrict or object to certain processing
• Data portability — receive your data in a structured format
• Opt out of marketing emails at any time via the unsubscribe link in any email we send
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, email info@reputap.net with the subject line "Privacy Request." We will respond within 30 days.

12. California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA):

• The right to know what personal information we collect, how it is used, and whether it is sold or shared
• The right to delete your personal information
• The right to correct inaccurate personal information
• The right to opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioral advertising)
• The right to limit the use of sensitive personal information (we do not process sensitive personal information beyond what is necessary to provide the Service)
• The right to non-discrimination for exercising your rights

To submit a CCPA/CPRA request, email info@reputap.net with the subject line "CCPA Request."

13. Do Not Track

Some browsers offer a "Do Not Track" (DNT) signal. RepuTap does not currently respond to DNT signals because there is no industry-standard protocol for handling them. We do not engage in cross-site tracking of our users.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Effective" date at the top of this page. For material changes, we will notify active Clients by email at least 14 days before the changes take effect. Continued use of the platform after changes constitutes acceptance of the updated policy.

15. Contact Us