Privacy Policy

The short version

We collect what we need to sell you cards, bill you, and support you — nothing beyond that.

We do not use analytics or advertising trackers of any kind. We do not track you across other apps or websites. We do not sell your personal information, and we do not share it for advertising.

Our support chat is answered by an AI assistant before a person takes over, and we spell out exactly what it is given further down this page.

Who we are

FavorTap is operated by FavorTap LLC, a Texas limited liability company. FavorTap sells NFC “tap” cards to local businesses and provides a service that manages them: when a customer taps a card, they are sent to that business's review page. This policy covers our website, our customer account portal, and our mobile app.

You can reach us about anything on this page at support@favortap.com.

What we collect

If you are a business customer or a prospective one, we hold your business name, contact name, phone number, email address, business address, service area, and your Google review link. If you ask us to ship your cards somewhere other than your business address, we use that shipping address to send the order and to calculate sales tax, and it appears on our internal record of the order; we do not add it to your customer record. If you start a plan we also keep your plan rate, billing and activation status, plan start and cancel-eligible dates, your payment processor's customer and subscription identifiers, payment-attempt history, your next billing date, and a copy of the service agreement you signed together with the date you signed it.

If you use the customer portal, we store a secure hash of your password — never the password itself — and, if you request a reset, a hashed single-use token. The raw token only ever exists inside the email we send you.

If you use our support chat, we keep the messages you send. If you ask to be connected to a person, we also ask for your name and email address so that we can reply to you.

If you tap one of our cards, we record which card was tapped, when, and your browser's user-agent string. We do not attempt to identify the person tapping, and a tap is not linked to a name, an account, or an advertising profile.

If you use our mobile app, we collect your email address and password when you sign in, and issue a session token to keep you signed in. Those credentials are stored in your device's operating-system Keychain, protected by Face ID or your device passcode.

The owner side of our app — used by FavorTap itself, not by customers — can show the user's own position on a map of customers and leads. That position is shown on the device only and is not sent to us. When FavorTap takes a card payment in person with Tap to Pay on iPhone, Stripe's software on the phone sends Stripe an approximate location of the payment, which Stripe requires to prevent fraud. We do not receive it.

What we don't collect

Online, card numbers are entered on a payment page hosted by Stripe. In person, your card may be read by the iPhone's built-in card reader (Tap to Pay on iPhone) and passed straight to Stripe. Either way, we never receive, see, or store your card number — only the card brand and last four digits, so we can tell which card paid.

We do not collect your device's location. Addresses in our system are typed in, not read from your phone. Our app asks for these permissions and no others: NFC, to read and program the tap cards; Face ID, to protect access to the owner tools; location, on the owner side only, for the map and for in-person card payments as described above; and Bluetooth, which Stripe's payment software requires the app to declare even though we don't use Bluetooth card readers.

Our AI support assistant

Our support chat is answered by an AI assistant — Anthropic's Claude — until a member of our team takes over the conversation. Once a person has replied, the assistant does not reply again on that conversation.

If you are signed in when you use the chat, the assistant is given a summary of your own account so that it can answer questions about it. That summary contains:

• Your business name
• Whether you are on a card-only or a management plan, and your billing and activation status
• Your plan start date and the date you become eligible to cancel
• How many cards you have, and a breakdown of their statuses
• Your total tap count and the date of your most recent tap

Your email address, phone number, postal address, contact name and payment details are never sent to the AI assistant.

Who we share information with

We use a small number of service providers, and only to run the service. This list is complete:

• Stripe — payments, subscription billing and sales tax calculation (the address your order ships to, or your business address for an in-person sale, is used to work out the tax). Card details are collected on Stripe's own hosted page or, in person, read by Stripe's Tap to Pay software, and the billing address for your card is held by Stripe rather than by us.
• Supabase — our database hosting.
• Anthropic — our AI support assistant, as described above.
• Resend — sending transactional email such as receipts, password resets and support replies.
• Google Places — address autocomplete while an address is being typed.
• Apple MapKit — displaying customer locations on our own internal map, in our tools and on the owner side of our app.
• OpenStreetMap (Nominatim) — turning a customer's typed business address into map coordinates for that internal map. Only the address is sent.
• Vercel — hosting our website and app services.

We may also disclose information where we are legally required to do so, or in connection with a sale or transfer of the business. We do not sell your personal information, and we do not share it for advertising or for cross-context behavioural advertising.

Cookies

We set no cookies at all until you sign in, and we have no cookie banner because we have nothing to ask you about.

There are exactly two cookies in the entire service, and both exist only to keep you signed in: one for a customer signed into their account, one for the FavorTap owner signed into the admin tools. Neither tracks you, neither follows you to other sites, and no advertising or analytics cookie is set anywhere, because we don't use any.

Our support chat also stores two values in your own browser — which conversation you're in, and the last message you saw — so that reopening the chat shows your conversation rather than starting a new one. That stays on your device.

How long we keep it

We keep customer and billing records for as long as your account is active, and for seven years afterwards, because tax and accounting rules require us to be able to substantiate past transactions. Support conversations are kept for two years. Tap logs are kept for two years, and are not linked to an identifiable person in the first place.

If you ask us to delete your information, we will do so except where we are required to retain it for the reasons above — in which case we will tell you what we are keeping and why.

Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to delete it, to receive a copy of it, and to object to certain uses of it. We extend these rights to everyone who asks, regardless of where they live, rather than only where the law compels it.

To make a request, email support@favortap.com. We will not charge you for it, and we will not treat you differently for asking. If you are in California: we do not sell or share personal information as those terms are defined by the CCPA, and we do not engage in cross-context behavioural advertising, so there is nothing for you to opt out of.

Security

We hash passwords using scrypt and never store them in plain text. Password-reset tokens are stored only as hashes, so reading our database does not let anyone take over an account. Credentials in our mobile app are held in your device's operating-system Keychain behind Face ID or your device passcode. Payment card details never reach our servers at all.

No system is perfectly secure, and we cannot guarantee absolute security. If we ever discover a breach affecting your information, we will tell you.

Children

FavorTap is a tool for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, email support@favortap.com and we will delete it.

Changes to this policy

If we change this policy we will post the change here and update the effective date at the top. If a change materially affects how we handle information we already hold about you, we will email account holders rather than relying on you to re-read this page.