TapEP is an iPhone app that helps UK businesses create payment links. Customers open a link and pay on Stripe’s secure payment page in their browser.
This policy explains how we use personal data about shop owners, customers and people who contact us. It covers the app, our payment-link pages and our website.
1. Who we are
TapEP is the trading name of TAPEP LTD, a company registered in England and Wales.
- Company number: 17412644
- Registered office: Flat 2, 36 Park Mansions, Vivian Avenue, London NW4 3UU
- ICO registration number: ZC232629
- Email: support@tapep.co.uk
- Phone: +44 7338 641505
- Website: tapep.co.uk
We decide how and why we use account information, security information and our own payment records. This makes us a data controller for those uses.
Shops have their own responsibilities for customers’ personal data. Stripe also acts as an independent controller for its own business and identity checks.
2. Information about shops
We hold:
- Your email address.
- Your password, stored only as a secure hash by our login provider, Supabase.
- Your TapEP username, display name, shop name and public shop handle.
- Your Stripe account ID and information about whether that account can accept payments.
- Your agreement to the terms, including the version and the date and time you agreed.
- Payment-link and payment records, including amounts, reasons, statuses, dates, fees and Stripe references.
- Sign-in, account-status and security information.
- Emails, phone calls and voicemails you send us, and our replies.
You give business, identity and bank details directly to Stripe during its sign-up process. TapEP does not store those details.
Your shop name and public handle are visible to people who open your payment links. Your display name may also appear in a message you share if your shop details have not loaded.
The app stores sign-in information securely on your iPhone. It can also store the amount and reason for an unfinished payment-link request until it receives a definite response, so it can retry safely.
We receive payment updates from Stripe, including amounts, statuses, fees and references.
Stripe also tells us about other payments on your Stripe account. We keep only a short technical record of these (reference, type, amount and status) to check which payments are TapEP’s. We don’t use them for anything else.
You need to give us an email address and a password to create an account, and your shop’s details to create a shop. Stripe needs the details it asks for before your shop can take payments. Without this information, we can’t provide TapEP to you.
3. Information about customers who pay
Customers do not need a TapEP account.
Your name, email address and card details are entered on Stripe’s payment page and held by Stripe. TapEP does not receive or store your card details.
TapEP holds payment records, including the amount, reason, status, dates and Stripe references. The shop can see its customers’ payment details in its own Stripe Dashboard.
We also use payment-link identifiers, a browser cookie and technical information to make payment-link pages work and protect them from misuse.
If you contact us, whether you are a shop, a customer or anyone else, we keep your message, your contact details and our reply (see section 9).
4. Technical information and security
Our server logs can include IP addresses. We also use a keyed, one-way hash of an IP address to limit repeated requests and protect against abuse. This is a coded identifier, not a copy of the original IP address.
Our login provider keeps sign-in logs.
We use encrypted connections and check messages received from Stripe. No system is completely secure. If a security incident affects personal data, we will act as UK law requires.
We do not sell personal data or use it for advertising.
We do not use analytics or tracking tools in the app.
5. Why we use personal data
We use personal data under the UK GDPR and the Data Protection Act 2018.
| Purpose | Legal basis |
|---|---|
| Provide accounts, payment links and account emails to someone who contracts with us personally | Carrying out our contract |
| Provide the service to a company through its representative | Legitimate interests in running the service |
| Show customers who they are paying and give shops payment updates | Legitimate interests in completing and recording payments |
| Calculate and check TapEP’s fees | Contract, where applicable, and legitimate interests in accurate accounts |
| Protect accounts and prevent misuse | Legitimate interests in keeping the service secure |
| Answer support enquiries | Legitimate interests in helping people use the service |
| Keep required records and answer privacy requests | Legal obligations, where they apply |
| Handle refunds, disputes and legal claims | Legitimate interests in resolving those matters |
| Run and protect our website, including web server logs and loading its fonts | Legitimate interests in running a working, secure website |
“Legitimate interests” means a reasonable business purpose, considered alongside your rights and interests.
6. Who receives personal data
We use these providers:
| Provider | What it does | Location or privacy role |
|---|---|---|
| Supabase | Database and logins | London, UK |
| Railway | Runs TapEP’s server | The Netherlands, EU |
| Resend | Sends confirmation and password-reset emails | Ireland, EU |
| WebsitePublisher.ai | Hosts the website and support mailbox | The Netherlands |
| Google (Google Fonts) | Supplies the fonts on our website | Receives your IP address when your browser loads the fonts |
| Stripe | Processes payments, manages payouts and checks shops | Also acts independently for its own checks |
| Apple | Distributes the app through the App Store | Handles its own information under Apple’s privacy policy |
Where a provider handles personal data for us, it may use it only to provide its service to us, and it must protect it at least as well as this policy describes and UK data protection law requires.
Stripe, Apple and Google also use some information for their own purposes, under their own privacy policies: Stripe, Apple and Google. Shops are responsible for explaining how they use their customers’ information.
We may also share information when the law requires it, including with regulators or courts.
7. Cookies and the website
Our payment-link pages use a cookie to connect your browser to a payment link. It helps the page work and expires when the link expires, after no more than 60 minutes.
Stripe’s own policies cover cookies on Stripe’s payment page.
Our website, tapep.co.uk, does not use advertising or analytics cookies and has no forms. It loads its fonts from Google Fonts, so Google receives your IP address when you visit. Our website host, WebsitePublisher.ai, keeps web server logs, which can include IP addresses, to run and protect the site.
8. International transfers
Some providers are US companies, even where the service locations listed above are in the UK or EU.
Where personal data leaves the UK, it is protected by UK adequacy regulations or appropriate standard contractual clauses, using the UK Addendum or International Data Transfer Agreement.
Contact us if you would like information about the safeguards that apply to your data.
9. How long we keep information
| Information | Retention period |
|---|---|
| Login details, display name, username, shop name and public handle | Until account deletion |
| Sign-ups where the email address is never confirmed | Automatically deleted after 30 days |
| Payment and fee records | 6 years after the end of the financial year in which the payment was made |
| Record of agreement to the terms | 6 years after the account is closed |
| Unpaid-link records, related references, account-deletion records and the short records of other Stripe payments | Up to 6 years, like payment records |
| Payment-page cookie in your browser | Until the link expires, after no more than 60 minutes |
| Keyed IP-address hashes | Only for short rate-limit windows (up to 24 hours), then cleared automatically |
| Server logs and sign-in logs | Kept by our providers for up to 30 days, then deleted automatically |
| Website server logs | Kept by WebsitePublisher.ai under its own retention rules |
| Support emails, voicemails and replies | Up to 2 years after the conversation ends |
Stripe keeps information under its own rules and privacy policy.
10. Deleting your account
In the app, open Account, select Delete account, type DELETE, then select Delete my account.
This removes your login and closes your shop. It removes your profile and shop names, and your unpaid payment links stop working.
We retain records the law requires us to keep, including payment records and your agreement to the terms. The table above explains retention.
Deleting your TapEP account does not close your separate Stripe account. Deleting the app from your phone does not delete your TapEP account.
If the app says a payment is still being processed, try again later. Contact us if you need help.
11. Your rights
Depending on the circumstances, you can ask us to:
- Give you access to your personal data.
- Correct inaccurate information.
- Delete information.
- Restrict how we use information.
- Stop processing based on legitimate interests.
- Provide a portable copy of information you gave us.
These rights have limits. For example, we may need to retain records after you ask us to delete your account.
Email support@tapep.co.uk. We may need to confirm your identity. We will respond within one month, or explain if an extension is allowed and needed.
If you paid a shop, include the payment reference, shop name, amount and date. Do not send card details.
You can complain directly to the Information Commissioner’s Office at ico.org.uk. You can also contact us so we can try to resolve your concern.
12. Automated decisions
We do not make decisions about you based only on automated processing that have legal or similarly significant effects on you.
Our systems automatically limit repeated requests and stop a payment link working after 60 minutes. These protect the service and do not decide your legal rights.
Stripe runs its own automated checks on shops and payments, including fraud checks, under Stripe’s privacy policy.
13. Changes to this policy
We will publish updates here and change the “Last updated” date.