Trust & Privacy

Tap handles the contacts your team meets, the conversations it records and the deals it works on. This page explains how we protect that data, and where to find the documents your security and legal teams will ask for.

GDPR compliant

Tap is built to meet the EU General Data Protection Regulation and the UK GDPR. We also follow Egypt's Personal Data Protection Law (Law 151 of 2020), Saudi Arabia's PDPL and the UAE's data protection law, plus the privacy laws of US states.

  • You own your data. For Tap Teams, your company is the controller of its members' and leads' data, and Tap processes it only on your instructions, under our Data Processing Agreement.
  • We publish who we work with. Every company that processes personal data for us is on our sub-processor list, and customers get 30 days' notice of changes.
  • We explain what we do. Our Privacy Policy covers what we collect, why, the legal basis, how long we keep it and your rights. Our Cookie Policy covers the website.

Consent where it matters

  • Lead capture. Companies can turn on GDPR mode. Visitors who share their details through a Tap profile must then tick a consent box, and Tap records when they consented and which notice they saw. Without consent, Tap won't automatically look up extra contact details for that lead.
  • Meeting recording. Before a recording starts, the person recording confirms that the people in the room know and agree. The confirmation is stored with the meeting.
  • Website and app analytics. Visitors in the EU, UK and Switzerland choose before any analytics or advertising cookies are set. You can change your choice at any time with the Cookie settings link in the footer.
  • Marketing. We only send product news to people who opted in, and every email has an unsubscribe link.

How we keep data safe

  • Encrypted in transit. Every connection to Tap uses HTTPS (TLS).
  • Hosted on AWS in the United States, with production secrets kept in AWS Secrets Manager, never in code.
  • Private recordings. Meeting recordings and voice notes are private files. They open through links that expire within hours, and only for people allowed to see that meeting.
  • Company isolation. Each company's data is separated, and every request is checked against the user's company, department and role. Automated tests guard these boundaries.
  • Secure sign-in. Passwords and emailed codes are stored hashed. Codes expire after 10 minutes, repeated attempts are blocked, and sessions end after 180 days without use.
  • Clean logs. Logs are automatically scrubbed of passwords, tokens and keys, and never hold lead or meeting content on purpose.
  • Accountability. Changes to accounts and settings are recorded in an audit log, kept for 12 months.

AI you can trust

  • Meetings are transcribed and analysed by the providers on our sub-processor list. None of them may use your data to train their models.
  • Lead scores come from fixed rules (for example, whether a lead has a phone number, a work email and a senior title), not from an AI model. No automated decision with legal effect is made about anyone.
  • A business-card photo is read to fill in the lead form, then discarded. It is never stored.

We keep data only as long as needed

Data How long
Meeting audio Deleted 30 days after the meeting. Transcripts and summaries stay until you delete them or close your account
Voice-note audio Deleted 30 days after processing. The text stays with the lead
Deleted account Erased 30 days after you ask, so you can change your mind
Exact meeting location Kept only as an area. The precise point is removed after 90 days
Lead imports (raw file rows) 30 days after the import finishes
Audit and activity logs 12 months
Unused sign-in sessions 180 days

The full schedule is in our Privacy Policy.

Your rights, made easy

  • Download your data. In Tap Teams, go to Settings and request your data. We email you a secure link to a file with your profile, leads, notes and meetings.
  • Delete your account from the app's settings, or ask us.
  • Anything else, such as correcting, restricting or objecting: email privacy@gettap.co. We answer within 30 days.
  • If someone captured your details with Tap, the company that captured them is in charge of your data. Contact them first. If you can't, write to us and we'll pass your request on.

If something goes wrong

We have a written incident response plan. If a breach affects your data, we tell affected customers without undue delay and within 48 hours, and we notify the regulators where the law requires it, within 72 hours.

Documents for your security review

Contact

Privacy and security questions: privacy@gettap.co.

Tap - Digital Business Card LLC, 447 Broadway, New York, NY, United States, and Tap - Digital Business Card LLC, Maadi, Cairo, Egypt.