Privacy Policy

Last updated: June 2026

Who we are

Tap-Tap ("we," "our," or "us") is a review management service for local businesses, operated from New York, NY. Our service helps business owners manage and respond to Google reviews using AI-assisted drafts. You can reach us at hello@nfctaptap.com.

What we collect

When you use Tap-Tap, we collect:

Account information — your email address and password (stored securely via Supabase Auth).
Business information — your business name, type, and website URL, as provided when onboarding.
Google account credentials — OAuth access and refresh tokens granted when you connect your Google Business Profile. These are encrypted at rest using AES-256-GCM.
Review data — your Google Business Profile reviews, reviewer names, ratings, and timestamps, fetched from the Google Business Profile API on your behalf.
AI-generated content — draft replies we generate for your reviews. You review and approve these before anything is posted.
Billing information — payment is handled directly by Stripe. We store only your Stripe customer ID and subscription status; we never see or store your card number.
Usage data — basic server logs (IP address, browser type, pages visited) used for debugging and security.

How we use your data

To sync your Google reviews and display them in your dashboard.
To generate AI-drafted reply suggestions using the Anthropic API.
To post approved replies to Google on your behalf, using your connected Google account.
To manage your subscription and process payments through Stripe.
To send you transactional emails (account setup, billing receipts) via Resend.
To improve the reliability and performance of our service.

We do not sell your data. We do not use your review data for advertising. We do not share your Google credentials with any third party beyond the APIs required to operate the service.

Google API access

Tap-Tap uses the Google Business Profile API under the https://www.googleapis.com/auth/business.manage scope. This grants us permission to:

Read your Google Business Profile account and location information.
Read customer reviews on your profile.
Post and update review replies on your behalf, only when you explicitly approve a draft.

We do not access any other Google services. You can revoke this access at any time from your Google Account permissions page.

Tap-Tap's use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

Third-party services

Supabase — database and authentication. Data hosted in the US.
Google — Business Profile API for review data and reply posting.
Anthropic — AI model API used to generate review reply drafts. Review text is sent to Anthropic solely for this purpose.
Stripe — payment processing. Subject to Stripe's own privacy policy.
Resend — transactional email delivery.
Vercel — web hosting and CDN.

Data retention and deletion

We retain your data for as long as your account is active. If you close your account, we will delete your personal data and Google credentials within 30 days. Review data synced from Google may be retained in anonymized form for service improvement. To request deletion of your data, email hello@nfctaptap.com.

Security

Google OAuth tokens are encrypted at rest using AES-256-GCM before being stored. All data is transmitted over HTTPS. Access to business data is restricted by row-level security policies — users can only access data associated with their own business account.

Your rights

You may request access to, correction of, or deletion of your personal data at any time by contacting hello@nfctaptap.com. You can disconnect your Google account from within the dashboard settings at any time.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email to the address on your account. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

Contact

Questions about this policy? hello@nfctaptap.com