Privacy policy
Last updated: 14 October 2026
This policy explains how Tap collects, uses, shares and protects personal data, and the rights you have. It covers the Tap mobile app (including Tap Instant), Tap Teams (teams.gettap.co), public profile pages (link.gettap.co), Tap NFC products and our website gettap.co (together, the "Services").
1. Who we are
Tap is run by two companies with the same name:
- Tap - Digital Business Card LLC, a New York limited liability company, 447 Broadway, New York, NY, United States. It provides the Services to customers outside Egypt.
- Tap - Digital Business Card LLC, an Egyptian limited liability company, Maadi, Cairo, Egypt. It provides the Services to customers in Egypt, and builds, operates and supports the Services for both companies.
In this policy, "Tap", "we" and "us" mean the company that provides the Services to you.
Contact: privacy@gettap.co
EU and UK representatives (GDPR Art. 27): being appointed; their names and addresses will appear here. Until then, contact privacy@gettap.co.
Data Protection Officer (Egypt): being appointed under Law 151 of 2020. Until then, contact privacy@gettap.co.
2. Our role: controller or processor
- Tap is the controller of the data we need to run our own business: Tap accounts, billing, our website and marketing, security logs, and the matchmaking feature in the app.
- Our business customers are the controllers of the data their teams put into Tap Teams, such as members' activity, the leads they capture, their notes and their meeting recordings. Tap processes that data as their processor, only on their instructions and under our Data Processing Agreement.
- Individual app users who capture leads for their own business decide why and how those leads are used. They are the controller of that lead data and Tap is their processor.
If a company or user captured your details with Tap, they are your first point of contact. Section 15 explains how we can help.
3. The data we collect
3.1 Tap users and team members
- Account and profile: name, email, mobile number, country, job title, company, photo, bio, username, the links, files and contact details you add to your cards, and your card design.
- Sign-in and security: password (stored hashed), one-time codes (stored hashed, expire after 10 minutes), two-step verification settings, sign-in method (Google, Apple, Facebook, LinkedIn), session tokens, device identifiers and push tokens.
- LinkedIn profile: if you give us your LinkedIn profile link, we read your public profile (headline, experience, education, skills, location, photo) to fill in your card, suggest connections and work out your industry. We refresh it every 6 months.
- Billing: plan, transactions and invoices. Card details are entered on the payment provider's own page; we only keep the card brand and last four digits.
- Usage: features used, sign-ins, card views and taps, activity scores, AI feature usage, and app analytics and crash reports.
- Your recordings and notes: meetings you record, voice notes, typed notes and what Tap's AI produces from them (see section 6).
- Meeting location: when you record a meeting in the app, its approximate location (see section 8).
- Calendar: if you connect Google Calendar, your events for the next 7 days.
- Consents: your marketing choice, and the recording confirmations you give.
3.2 Leads and contacts captured with Tap
- Contact details: name, email, phone, job title, company, website, address, LinkedIn link, and any other fields on the capture form or added by the Tap user, including notes and files.
- How they were captured: through a Tap profile form, an exchange, Tap Instant, a scanned business card, the user's phone contacts (one contact at a time), a file import or a CRM, and who captured them.
- Consent record: for leads captured through a public form with GDPR mode on, when consent was given, which notice was shown, and a shortened IP address.
- Enriched details: work email, phone, job title, seniority and company information found by our enrichment providers when a Tap user asks for them.
- Qualification: a lead score (0–100), buying role, tags and the Tap user's notes.
- Emails a Tap user sends the lead from Tap.
3.3 People in recorded meetings
Voice recordings, transcripts, speaker names, talk time, summaries, topics, action items, and AI observations such as objections, buying signals, competitors mentioned, interest level and sentiment.
3.4 Visitors to public profile pages
IP address (stored shortened to the first three parts), device and browser type, whether the visit came from an NFC tap or a link, and which buttons were tapped.
3.5 Website visitors and buyers
Cookies and similar identifiers (see our Cookie Policy), IP address, pages visited, what you send through our forms, newsletter sign-ups, orders and reviews.
4. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide the Services: accounts, cards, lead capture, meetings, AI features, integrations, support | Contract. For customer data we process as a processor, the customer's own legal basis |
| Billing and accounting | Contract; legal obligation (tax and accounting law) |
| Security, preventing fraud and abuse, keeping logs | Legitimate interests (keeping the Services and our users safe); legal obligation |
| Fill in your card from your LinkedIn profile and suggest people to connect with | Legitimate interests (a networking product that works out of the box). You can object at any time |
| Product analytics and session replays in the app and Tap Teams | Consent where the law requires it (EU, UK, Switzerland); legitimate interests (improving the product) elsewhere |
| Reuse an enrichment result for 3 months instead of buying the same lookup again | Legitimate interests (keeping enrichment affordable). You can object |
| Service emails and notifications | Contract |
| Product news and marketing emails | Consent. You can unsubscribe in any email |
| Website analytics and advertising; app install attribution | Consent where the law requires it; legitimate interests elsewhere, with an opt-out |
| Aggregated, de-identified statistics | Legitimate interests |
| Comply with the law and respond to lawful requests | Legal obligation |
You need to give us your name, email and a password or sign-in method to open an account. Everything else is optional, but some features won't work without it.
5. Lead capture and enrichment
- When you share your details through a Tap profile, they go to the person or company whose profile it is. They decide how to use them, and may sync them to their own CRM.
- Companies can turn on GDPR mode, which asks you to consent before you submit. Without consent, Tap does not automatically look up extra details about you.
- Enrichment: when a Tap user asks, we send a lead's name, company and LinkedIn link to our enrichment providers (BetterContact and FullEnrich), who search their sources for the lead's work email and phone. To avoid paying twice for the same lookup, we keep results for 3 months and may reuse them when another Tap customer looks up the same person.
- If you are a lead and did not give your details to the Tap user yourself, they may have come from a business card, a CRM, a file or an enrichment provider. You can ask the company that captured you, or us, to access, correct or delete them (section 15).
6. Meeting recording and AI
- How it works: a Tap user records an in-person meeting in the app, or uploads a recording. The audio is turned into text by our transcription providers, then analysed by AI providers into a title, summaries, topics, action items and observations such as objections, buying signals, competitors mentioned, interest level and sentiment. In Ask AI, users can ask questions about their meetings, answered from the transcripts.
- Consent of the people in the room is the recording user's responsibility. Before recording, the app asks the user to confirm that the people present know and agree, and stores that confirmation. Some places, including several US states and many countries, require everyone's consent to record. Never record without it.
- Our AI providers (Soniox, Google Gemini, OpenAI and Deepgram) process the audio and text only to provide the feature, and may not use it to train their models.
- Retention: audio is deleted 30 days after the meeting. Transcripts, summaries and Ask AI conversations stay until the meeting is deleted or the account is closed.
- Ownership and access: for Tap Teams, meetings belong to the customer company. The person who recorded the meeting and their company's admins can see it.
7. Business-card scanning
When you scan a business card, the photo is sent to Google Cloud Vision to read the text, and the text to OpenAI to sort it into fields. The fields fill in the new-lead form; the lead is only created if you save it. The photo itself is not stored.
8. Meeting location
When you record a meeting in the app, it asks your phone for its location once. We round it to about 100 metres, match it to an area (for example a district or city), and use it to show where meetings happen in Team Insights and on the meeting page. 90 days after the meeting the rounded point is removed and only the area is kept. If no area matches, the rounded point stays with the meeting. We don't track your location at any other time. You can refuse location access; recording still works.
9. Scores, insights and matchmaking
- Lead score: a number from 0 to 100 worked out by fixed rules, not AI: for example, whether the lead has a phone number, a work email and a senior job title, and the buying role the Tap user chose. It helps users sort their own leads.
- Team Insights: company admins see their team's activity, such as leads captured, meetings, talk time, card views and meeting areas. The customer company decides how to use this and must tell its employees about it.
- Matchmaking: the app suggests other Tap users you may want to meet, based on the profile information you made visible, your industry and how complete your profile is. Others only see what you made visible on your profile, and contact details are shared only after a connection request is accepted.
- None of these makes a decision with a legal or similarly significant effect on anyone.
10. Integrations you connect
If you connect a CRM (HubSpot, Salesforce, Zoho, Pipedrive, Odoo, Veeva or a custom API), Zapier, Slack or Google Calendar, Tap sends the data you choose to that service and receives what is needed to sync. Once data reaches your CRM or tool, that provider's terms and your own controls apply. Disconnecting stops future syncs; it does not delete what was already sent.
11. Who we share data with
- Sub-processors that help us run the Services, such as hosting, AI, email, payments and analytics. They are listed, with what they do and where, on our sub-processor list.
- The other Tap company, which builds and supports the Services (section 1).
- Services you connect (section 10), and the people you share your card with.
- Sign-in providers (Google, Apple, Facebook, LinkedIn), when you choose to sign in with them.
- Advertising and attribution partners (Google, Meta, TikTok, AppsFlyer) for our own marketing, on our website and in the app, with your consent where the law requires it. See the Cookie Policy.
- Authorities and advisers, when the law requires it or to protect rights and safety; and a buyer or successor if Tap is sold or merged, under this policy.
We do not sell personal data for money. Using advertising cookies on our website may count as "sharing" or "selling" under some US state laws; you can opt out on our Do not sell or share my personal information page.
12. International transfers
The Services are hosted on Amazon Web Services in the United States, and our team in Egypt operates and supports them. Some sub-processors work in other countries, as listed on the sub-processor list.
- When personal data from the EU, UK or Switzerland goes to a country without an adequacy decision, including the United States and Egypt, we use the European Commission's Standard Contractual Clauses (and the UK Addendum), together with an assessment of the transfer and additional safeguards.
- For personal data from Egypt, we transfer it abroad under the cross-border licence and the conditions of Egypt's Personal Data Protection Law, including your consent where it requires it.
- For Saudi Arabia and the UAE, we follow the transfer conditions of their data protection laws.
You can ask for a copy of the safeguards at privacy@gettap.co.
13. How long we keep data
| Data | How long |
|---|---|
| Account and profile | While your account is open. After you ask to delete it, we erase it 30 days later |
| Leads, notes and voice-note text | Until the Tap user or their company deletes them, or the account is erased |
| Meeting audio | 30 days after the meeting |
| Voice-note audio | 30 days after processing |
| Transcripts, AI summaries and Ask AI conversations | Until the meeting is deleted or the account is erased |
| Rounded meeting location | 90 days, then only the area is kept (see section 8) |
| Raw rows of a lead import file | 30 days after the import finishes |
| Enrichment results kept for reuse | 3 months |
| Lead data in CRM sync logs | 30 days |
| Audit and activity logs | 12 months |
| AI usage records | 13 months |
| Application logs | 30 days |
| Unused sign-in sessions | 180 days |
| Your data export file | The link works for 7 days; the file is deleted after 8 |
| Card view statistics | While the account exists |
| Billing and transaction records | As long as tax and accounting law requires (usually 5 to 7 years), with personal details removed when the account is erased |
| Marketing contact details | Until you unsubscribe or your account is erased |
| Record that an account was erased | Kept, without any personal data, to prove the erasure |
For Tap Teams, when a member leaves or deletes their account, the leads and meetings they captured stay with the company and move to one of its admins. When a company closes its account, its data is erased 30 days after each account's deletion. Copies already sent to a connected CRM or tool are not deleted by Tap.
14. Security
We use encryption in transit, company-level data separation with role checks, hashed passwords and codes, private recordings behind short-lived links, scrubbed logs, audit trails and an incident response plan. Read more on our Trust & Privacy page. If a breach puts your rights at risk, we will tell you and the relevant regulators as the law requires.
15. Your rights
Depending on where you live, you can ask us to:
- give you access to your personal data and a copy of it, in a portable format;
- correct it;
- delete it;
- restrict how we use it;
- object to uses based on legitimate interests, and to direct marketing at any time;
- withdraw consent at any time, without affecting what was done before.
How: in Tap Teams you can download your data from Settings; in the app you can delete your account from Settings. For anything else, email privacy@gettap.co. We may need to confirm your identity. We answer within one month (we may extend that by up to two more months for complex requests, and tell you why).
If a Tap customer holds your data (for example, you are their lead or employee), please contact them first, as they decide how it is used. If you write to us, we will pass your request to them and help them answer it.
Complaints: you can complain to your data protection authority: in the EU, the authority where you live or work; in the UK, the Information Commissioner's Office (ico.org.uk); in Egypt, the Personal Data Protection Center (pdpc.gov.eg). We'd appreciate the chance to fix it first.
Egypt: under Law 151 of 2020 you also have the right to be told about any breach of your personal data.
16. US state privacy rights
If you live in a US state with a consumer privacy law (such as California, Colorado, Connecticut, Virginia or Texas), you have the right to know what personal information we collect, use and disclose; to access, correct and delete it; and to opt out of its "sale" or "sharing" for targeted advertising and of profiling with legal effects. We collect the categories in section 3, for the purposes in section 4, from the sources described there, and disclose them to the recipients in section 11. We don't sell personal information for money. You can opt out of advertising "sharing" on our Do not sell or share my personal information page, and we honour the Global Privacy Control signal. Meeting locations are used only to provide the meeting features. You can use an authorised agent, and we won't treat you differently for using your rights.
17. Children
The Services are for people aged 16 and over, and are built for professional use. We don't knowingly collect data from children. If you think a child has given us personal data, contact us and we will delete it.
18. Cookies
Our website uses cookies as described in our Cookie Policy. In the EU, UK and Switzerland we ask first. You can change your choice with the Cookie settings link at the bottom of every page. In the app, people in those regions are asked before analytics is turned on.
19. Changes to this policy
We update this policy when the Services or the law change. We show the date at the top, and we tell users by email or in the app before significant changes take effect.
20. Contact
Email privacy@gettap.co, or write to Tap - Digital Business Card LLC, 447 Broadway, New York, NY, United States (customers outside Egypt) or Tap - Digital Business Card LLC, Maadi, Cairo, Egypt (customers in Egypt).