Privacy Notice
Version 2026-11-06. Issued under Republic Act No. 10173 (Data Privacy Act of 2012) and its IRR.
Who we are
Tapdali is operated by [LEGAL ENTITY NAME], [ADDRESS], Davao City, Philippines (the “personal information controller”). Data Protection Officer: [DPO NAME], privacy@tapdali.com.
What we collect, why, and for how long
| Data | Purpose · lawful basis | Kept for |
|---|---|---|
| Email, name | Run your account and send sign-in links · contract | Until you delete your account (+30-day grace) |
| Delivery name, phone, address | Print and ship your order · contract | Order date + 2 years (tax records), then deleted |
| Your page content (details you choose to publish) | Show it to people who tap your card · contract. You decide what goes on it; it is public to anyone with the card or link. | Until you delete the page or account |
| Contacts and feedback visitors send you | Deliver them to you · legitimate interest of you and the visitor, with notice to the visitor at the point of submission. You are the controller of this data once delivered; delete what you no longer need. | Until you delete them or your account |
| Tap logs: time, country/city, device type | Show you how your cards perform · legitimate interest. No name, device identifier or readable IP address of the visitor is stored. To stop abuse and avoid counting one person twice we keep a scrambled, one-way code derived from the network address; the scrambling key changes daily, the codes cannot be turned back into an address, and rate-limiting codes are deleted within a day. | 13 months |
| Sign-in and activity log: IP address, browser, action | Detect account misuse and let you review it · legitimate interest, legal obligation (security) | 12 months |
| Payment | Handled entirely by PayMongo. We store only an order reference, never card or e-wallet details. | Reference kept with order |
Who we share it with
Only processors needed to run the service, under contract: Vercel (hosting, USA/Singapore), Neon (database), Resend (email), PayMongo (payments, Philippines), and the courier for your order. We do not sell personal data and do not use it for advertising.
Your rights
Under the DPA you may access, correct, object to, download, or erase your data, and complain to the National Privacy Commission. Download and deletion are self-service in Settings; anything else, email the DPO. We answer within 15 working days.
Security
No passwords are stored; sign-in uses one-time links and passkeys. Data is encrypted in transit (TLS 1.3) and at rest. Tokens are stored hashed. Every owner action is logged and visible to you. See the Security page for details and responsible disclosure.
Breaches
If a breach is likely to harm you, we notify you and the National Privacy Commission within 72 hours of knowing, as the DPA requires.
Children
Tapdali is for people 18 and over. We do not knowingly collect data from minors.
Changes
We will ask you to accept a new version in the dashboard before it applies to you.