Privacy Policy
Last updated: 21 October 2026
This Privacy Policy explains how TAPZA collects, uses and protects personal information when you use tapza.co.uk, buy TAPZA products, subscribe to TAPZA Pro, or connect a Google Business Profile.
1. Information we collect
Depending on how you use TAPZA, we may process information such as your name, business name, email address, delivery details, subscription and transaction references, account settings, support communications and information you provide during setup.
If you connect a Google Business Profile, TAPZA may access information made available through Google Business Profile APIs that is necessary to provide the service. This may include connected account and location identifiers, business profile information, customer reviews, ratings, existing review replies and information needed to create or manage replies.
TAPZA cards may record operational information such as the card identifier, whether an interaction came from NFC or QR, and the date and time of the interaction. We may also process technical information reasonably required to operate, secure and troubleshoot the website and service.
2. Where information comes from
We receive information directly from you when you order, subscribe, contact us or configure TAPZA. When you connect Google, relevant business profile and review information is obtained from Google through the Google Business Profile APIs under the authorisation you provide.
3. How we use information
We use information to provide and administer TAPZA products and TAPZA Pro, fulfil orders, manage subscriptions, connect the correct Google Business Profile location, display review activity and insights, generate AI-assisted review replies, send drafts for approval where applicable, publish authorised replies, provide customer support, maintain security, prevent misuse and meet legal, accounting and regulatory obligations.
Where a customer has expressly enabled automatic replies, eligible positive-review replies may be generated and published automatically. Lower-rated or otherwise configured reviews may require the business user's approval or editing before publication.
4. Lawful bases
Depending on the processing, we rely on performance of a contract or steps taken at your request, legitimate interests in operating, securing and improving TAPZA, compliance with legal obligations, and consent where consent is the appropriate lawful basis. Where we rely on consent, you may withdraw it at any time, without affecting processing already carried out lawfully.
5. Google user data
Google Business Profile access uses Google's OAuth authorisation process. TAPZA does not ask for or store your Google password. You choose whether to authorise TAPZA and can revoke access through your Google Account.
Google user data obtained through Google APIs is used only to provide and improve the user-facing TAPZA functionality you request, including connecting business locations, retrieving review information and managing authorised review replies. TAPZA does not sell Google user data or use it for unrelated advertising.
6. AI-assisted replies
Review text and relevant business context may be processed by an AI service to generate suggested replies. AI-generated content can make mistakes. TAPZA Pro is designed to give the business control over the reply settings available to it, including approval workflows where configured.
7. Sharing and service providers
We may share information with service providers only where reasonably necessary to operate TAPZA. These may include payment processing, website hosting, email delivery, Google services used to connect and manage Business Profiles, and AI technology providers used to generate review-reply drafts. We may also disclose information where required by law, to protect legal rights, or in connection with a legitimate business transfer.
Full payment card details are handled by the relevant payment provider rather than stored by TAPZA.
8. International transfers
Some technology providers may process information outside the United Kingdom. Where data protection law requires it, appropriate safeguards or recognised transfer mechanisms are used by the relevant parties.
9. Retention
We keep personal information only for as long as reasonably necessary for the purposes described in this policy, including providing the service, maintaining appropriate business and accounting records, resolving disputes and meeting legal obligations. Retention periods vary according to the type of information and why it is held. Google access tokens and connected-account information are retained only while needed to provide the connected service or until access is disconnected or revoked, subject to necessary security or legal records.
10. Security
We use reasonable technical and organisational measures designed to protect information against unauthorised access, loss, misuse or alteration. No internet service can guarantee absolute security.
11. Your data protection rights
Depending on the circumstances, UK data protection law may give you rights to access your personal information, correct inaccurate information, request erasure or restriction, object to certain processing, request portability and withdraw consent where consent is relied upon. To make a request, email hello@tapza.co.uk.
You also have the right to complain to the UK Information Commissioner's Office (ICO) if you are concerned about how your personal information is handled.
12. Cookies and similar technology
TAPZA may use cookies or similar technologies necessary for website functions, security, sessions and payments. If we use non-essential cookies or similar tracking that requires consent, we will provide appropriate information and consent controls.
13. Children
TAPZA is a business service and is not intended for children.
14. Changes to this policy
We may update this policy when our services, providers or legal requirements change. The latest version will be published on this page with an updated date.
15. Contact
Email: hello@tapza.co.uk
Website: https://tapza.co.uk/