SmartTap Flow · Legal
Privacy Policy
How SmartTap Flow handles account, purchase and customer journey data.
SmartTap Flow handles data to provide the website, SmartTap Reseller, SmartTap Portal and public card journeys. Contact us about privacy at smarttapflow@gmail.com.
This notice explains our handling of personal information under UK data-protection law, including the UK GDPR. Your local business is responsible for how it handles feedback and contact details it receives through its own email or messaging services.
1. Information we handle
- Google sign-in identifiers, name, email address and account profile.
- Your account age declaration and Terms acceptance, including the Terms version, a copy of those Terms and the time the confirmation was recorded. We do not collect your date of birth for this declaration.
- Optional reseller business name, preferred client-facing support contact and website saved in your account.
- Billing name, address and any business name or business tax ID you choose to provide in Stripe Checkout. Providing business details does not itself establish that you are purchasing as a business.
- Product, payment, invoice, renewal, cancellation, refund and accepted-terms records. Stripe handles full payment-card details.
- Declared purchaser and client-business service countries, relevant region details and provider billing country used to assess service eligibility. These private location fields are not published in card journeys.
- Withdrawal notices identifying the purchase, buyer name, acknowledgement email, notice text and receipt time, plus records of acknowledgements actually sent.
- Reseller declarations of business authority, content rights, publication approval and monthly service responsibilities, with the wording/version, reseller identity, server timestamp and relevant configuration or offer references.
- Client business names, contacts, review and feedback destinations, logos, banners, card labels and Smart URL configuration entered by resellers.
- Support messages and proportionate technical, security and request logs.
2. Why we use it
We use this information to authenticate accounts, provide purchased resources, bill and fulfil products, publish configured card journeys, secure the service, answer support requests and meet legal obligations. Depending on the activity, our grounds include contract performance, legitimate interests, legal obligations and consent where specifically requested.
Optional reseller profile details provide defaults for private staff handover sheets. You can skip them or edit them in Account. They are separate from invoice details held by Stripe and are not automatically published on customer tap pages. Billing details support payment, invoicing and applicable tax obligations. We do not treat purchase or account creation as consent to marketing.
A public card journey uses a small cached business configuration. Normal taps do not create a per-tap database event. Private feedback is composed in the visitor's browser. A draft is kept in session storage for recovery until Finish is selected or the browser session ends. Finish clears the draft from this page's memory and session storage. Opening an email, WhatsApp or SMS link can disclose the prepared text to the external app or provider before Send is selected; opening a link is not proof the business received a message. Clipboard copies and external-provider copies remain outside SmartTap's control. SmartTap does not intentionally store the message body in the Portal database.
- Google account identifiers and session information: authentication and requested account access, normally contract performance; proportionate security measures also support our legitimate interests.
- Account declarations and accepted Terms: keeping a record of your account agreement and age declaration, normally contract performance and proportionate dispute prevention under legitimate interests.
- Optional reseller details: requested private profile and handover defaults, normally contract performance. You can remove or change them.
- Stripe billing, purchase evidence and subscription records: billing and fulfilment under the contract, applicable tax/accounting obligations and proportionate fraud or dispute prevention under legitimate interests.
- Client settings and approved publication: hosting on the reseller's documented instructions. The business or reseller determines the lawful ground for its own collection and publication; our own limited support and security activities have separate purposes.
- Service eligibility: assessing commercial availability, resolving ambiguous location information and meeting applicable legal and provider requirements. Currency does not establish your location or legal eligibility.
- Withdrawal notices: handling your contractual and statutory requests, sending acknowledgements and keeping proportionate evidence under applicable legal duties and legitimate interests.
- Support, abuse and privacy requests: responding to you, maintaining service security and complying with applicable legal duties. Any separate consent request identifies its particular purpose; account creation is not blanket consent.
- Reseller declaration evidence: documenting instructions and permissions for the requested service and supporting proportionate complaint and dispute handling. Our own evidence retention supports legitimate interests and applicable legal duties; these declarations are not marketing consent or proof of third-party rights.
3. Reseller and local-business data
SmartTap acts as controller for its own account, billing, support and security processing. When hosting personal information on documented client instructions, it acts as processor or subprocessor, depending on the business and reseller arrangement. The reseller and local business must establish their respective roles and authority. Our data-processing agreement draft is available for review at smarttapflow.com/data-processing; the draft is not an accepted contract.
Resellers are responsible for their own client relationships and for the lawful collection and accuracy of information they enter. We use entered client details to provide and support the configured service. We do not sell them as lead lists or directly solicit those businesses for a competing SmartTap reseller service.
Enabled Business Hub content, including public contact details and guest Wi-Fi credentials, is intentionally published in the customer page and its cached configuration to anyone with that Smart URL. Resellers should obtain business approval and use only guest-network credentials intended for public sharing. Disabled sections and operational owner contact details are not included in the Hub's public Contact section. When feedback is enabled, its effective email address or phone number is public. An empty Feedback Email falls back to the general contact email. Guest Wi-Fi is not a password vault. Use an approved guest network, never router-admin or staff-system credentials, and rotate credentials if revocation is needed; disabling a page cannot erase copies.
A customer's external review, email, WhatsApp or messaging destination is operated by the relevant third party and business, under their own practices.
4. Providers and transfers
Supabase, Vercel, Google authentication, Gmail and Stripe support hosting, storage, sign-in, withdrawal acknowledgements and payments. Withdrawal acknowledgements are sent through Gmail, with a private copy to our support inbox. Their processing may take place in other countries subject to the provider arrangements and transfer safeguards applicable to the particular service. We share only the data needed for those services, legal compliance, security or support.
5. Retention and deletion
Starter purchase records and entitlement remain while the purchased account exists, subject to refunds and legal obligations. Portal configuration remains available read-only after expiry until an account or data deletion request is completed after ownership and any retention obligations have been checked. We retain limited payment, tax, dispute and security records for applicable legal or operational periods.
Ask smarttapflow@gmail.com for access, correction, export or deletion. We may need to verify identity and may retain records where law requires. If another reseller or business controls the information you ask about, we may direct the request to that organisation.
The Portal CSV export contains client and card settings. It is not a complete response to a personal-data access request. You can request your personal information even if your subscription has expired or you cannot sign in. Account deletion and subscription cancellation are separate requests; tell us if you want both. We explain any necessary retained records and the applicable retention criteria when handling your request.
6. Cookies and rights
Fonts are hosted with the app. We do not use session replay or record visitors' screens, keystrokes or form inputs for replay.
Sign-in and security use cookies. We remember your chosen currency and Portal theme in local storage by default unless you turn this off. Open Browser preferences in the website footer, legal pages or Account and turn off Save currency and theme to clear saved choices without signing out. A separate storage entry remembers this setting. Dismissed notices and Academy progress stay in memory for the current tab and reset when you reload or close it. Customer feedback drafts and the Google review link tool use session storage for recovery until completion, clearing or the browser session ends. We do not use advertising cookies or session replay.
Depending on applicable law, you may have rights to access, correct, delete, restrict, transfer or object to processing, and to complain to a data-protection regulator. Consent may be withdrawn where processing depends on it.
We do not use customer feedback to build advertising profiles. Choosing to request a reply lets the business respond to that feedback; it is not consent to marketing. Providing the requested sign-in and billing information is necessary to supply account access and paid services. Feedback contact details are optional unless you ask for a reply. SmartTap does not make solely automated decisions about you with legal or similarly significant effects.
7. Contact and complaints
To exercise your rights, email smarttapflow@gmail.com with what you need and enough information to locate the relevant account or Smart URL. You do not need to use our request links or legal wording. Do not send passwords, payment-card details or identity documents unless we request a secure, proportionate verification step. Requests are normally free. We respond without undue delay, normally within one calendar month, subject to the applicable rules on identity verification, necessary clarification and permitted extensions. If an extension is permitted, we explain the reason within the initial response period.
Privacy requests or complaints can be sent to smarttapflow@gmail.com. Explain the issue and relevant account or Smart URL; avoid unnecessary sensitive details. We will acknowledge a data-protection complaint within 30 days, investigate it and provide appropriate progress information. This is not a promise to resolve every complaint within 30 days. You may complain to the UK Information Commissioner at ico.org.uk or another competent regulator.
Questions?
smarttapflow@gmail.comBrowser preferences
Saved on this device. Turn off to clear saved preferences.