Privacy Policy

Who this policy covers

• Business owners and their staff who sign up for and use the Tap KR dashboard.
• Customers of those businesses who scan a Tap KR QR code or NFC card, leave feedback or use a loyalty card.

For customer feedback and loyalty data, the business you visited decides how it is used; we process it on that business’s behalf.

Information we collect

• Account details: business name, owner name, email address, phone number, business address and branch details, and a securely hashed password.
• Staff details: names, and optionally phone numbers or emails, that an owner adds for their team.
• Customer feedback: star ratings, comments, what was ordered, and, only when a customer chooses to give them, a name and phone number so the business can call back.
• Loyalty cards: the customer’s phone number, stamps and rewards for that business.
• Usage data: when a card is scanned, the browser type, the referring page and a one-way hash of the IP address (we do not store the IP address itself). We use this for scan counts and to prevent abuse.
• Orders and billing: hardware orders, delivery contact details and plan or payment records.
• Google Business Profile data, when an owner connects their Google account (see below).

Google Business Profile data

If you choose “Connect Google”, we ask for permission to manage your Google Business Profile (scope business.manage). With your permission we:

• read your business accounts and locations, so you can choose which profile to link;
• read the reviews left on those locations and show them in your Tap KR dashboard;
• post, edit or delete your replies to those reviews, but only when you, or a team member you allow, press the button to do so.

We store the access tokens Google gives us in encrypted form, only for as long as your profile stays connected. We do not use Google data for advertising, do not sell it, and do not let people read it except where you ask us for support, where security or the law requires it, or where it has been made anonymous.

Tap KR’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect at any time from the Tap KR dashboard or at myaccount.google.com/permissions. When you disconnect, we delete the stored tokens and the copies of your reviews within 30 days.

AI-written suggestions

To draft review suggestions for customers and reply drafts for owners, we send the relevant text (for example the rating, comment, business name and item ordered) to Google’s Gemini API. We do not send passwords, phone numbers or Google access tokens. A person always reviews an AI draft before it is posted anywhere.

How we use information

• to provide the service: show feedback, analytics, loyalty cards and reviews to the business they belong to;
• to send account emails, such as password resets, and to send notifications that users have turned on;
• to deliver hardware orders and handle billing;
• to keep the service secure, prevent fraud and fix problems.

We do not sell personal information, and we do not use it for third-party advertising.

Service providers we use

• Google: Business Profile APIs (when connected) and the Gemini API for AI drafts.
• Resend: sending account emails.
• Browser push services (such as Google, Apple and Mozilla): delivering notifications that users switch on.
• Our hosting and database providers, which store the service’s data.

Each provider gets only what it needs for its task.

Cookies

We use only cookies the service needs to work: keeping owners, staff and admins signed in, and remembering which loyalty card belongs to a customer’s phone. We do not use advertising or tracking cookies.

How long we keep information

We keep account data while the account is active. When an account is closed, we delete or anonymise its data within 30 days, except records the law requires us to keep, such as billing records. Google data is deleted as described above.

Security

All traffic uses HTTPS. We store passwords and one-time links only as one-way hashes, encrypt Google tokens, and limit admin access, which is recorded in an audit log. No system is perfectly secure, so please use a strong password and keep it to yourself.

Your choices and rights

• Owners can view and edit their business information in the dashboard at any time.
• Anyone can ask us for a copy of their data, or to correct or delete it, by emailing support@marketingkr.com.
• Customers can also ask the business they visited directly.

Children

Tap KR is for businesses and is not directed at children under 13. We do not knowingly collect their information.

Changes

If we change this policy, we will update the date at the top of this page. If the changes are significant, we will also tell owners in the dashboard or by email.

Contact

MarketingKR, Pakistan · support@marketingkr.com