Privacy Policy

The short version

We collect what we need to sell you stands and stickers, bill you, and support you — nothing beyond that.

We do not use advertising trackers. We do not track you across other apps or websites. We do not sell your personal information, and we do not share it for advertising. We do count visits to our public web pages with a privacy-focused service that does not rely on cookies and shows us only combined totals; it is described below.

Our support chat is answered by an AI assistant before a person takes over, and we spell out exactly what it is given further down this page.

Who we are

FavorTap is operated by FavorTap LLC, a Texas limited liability company. FavorTap sells NFC “tap” stands and stickers to local businesses and provides a service that manages them: when a customer taps one, they are sent to that business's review page. This policy covers our website, our customer account portal, and our mobile app.

You can reach us about anything on this page at support@favortap.com.

What we collect

If you are a business customer or a prospective one, we hold your business name, contact name, phone number, email address, business address, service area, and your Google review link. If you ask us to ship your stands or stickers somewhere other than your business address, we use that shipping address to send the order and to calculate sales tax, and it appears on our internal record of the order; we do not add it to your customer record. If you start a plan we also keep your plan rate, billing and activation status, plan start and cancel-eligible dates, your payment processor's customer and subscription identifiers, payment-attempt history, your next billing date, and a copy of the service agreement you signed together with the date you signed it. If you publish a FavorTap Page, the name, description, address, and phone number shown on it are separate fields you choose to make public — they're not the private contact name and phone number we hold for account purposes, and publishing one never changes or exposes the other.

If you apply to join our team, we keep your name, email address, phone number, city or area, anything you tell us in the form, and any resume or other document you choose to upload (a PDF, Word or text file), to consider your application and to contact you about it by email, phone call or text message. Uploaded documents are stored privately, only our team can see them, and they are deleted with your application. If you agree to texts, message frequency varies, message and data rates may apply, and you can reply STOP at any time to stop them. We do not use an applicant's phone number for marketing texts. We keep an application for up to one year, then delete it unless you joined the team.

When you visit our public web pages, we count page views to see which pages are used. For this we use Vercel Web Analytics, a service from our hosting provider. It does not use third-party cookies; it recognises a visit by a value computed from the request, not by anything stored on your device. Each page view is recorded without being tied to you or to your IP address, and we see only combined totals. It notes the time, the page address, the page you came from, your approximate location (country, region and city), your device type, and your operating system and browser with their versions. Vercel discards the visit value after 24 hours. We count only our public pages, never signed-in pages, and we remove anything after a question mark in the page address.

If you start an order on our website and do not finish it, we keep what you entered as a prospect record and may email you once, about a day later, to help you finish. If you would rather not hear from us again, reply and say so, and ask us to delete it.

If you use the customer portal, we store a secure hash of your password — never the password itself — and, if you request a reset, a hashed single-use token. The raw token only ever exists inside the email we send you.

If you use our support chat, we keep the messages you send. If you ask to be connected to a person, we also ask for your name and email address so that we can reply to you.

If you tap one of our stands or stickers, we record which one was tapped, when, and your browser's user-agent string. We do not attempt to identify the person tapping, and a tap is not linked to a name, an account, or an advertising profile.

We also keep a simple count of our own: when a public page loads, we add one to that day’s total for that page. We store only the day, the page address without anything after a question mark, and the number. We store no IP address, cookie or identifier with it, and we skip crawlers and other automated visitors. It tells us how many visits our public pages get, nothing about who made them.

To protect sign-in, checkout, the support chat, tap counts, our own visit count, app crash reports and unfinished-order reminders from abuse, we briefly keep your IP address in short-lived counters, which are cleared within about two days.

If your business is on a plan and uses a FavorTap Page, we also record when the page is opened and which row on it is pressed — which row, when, and the visitor's browser user-agent string — the same way we record a tap. We don't attempt to identify who opened the page or pressed a row.

If you use our mobile app, we collect your email address and password when you sign in, and issue a session token to keep you signed in. That session token is stored in your device's operating-system Keychain, protected by Face ID or your device passcode; your password is not stored on the device.

The owner side of our app — used by FavorTap itself, not by customers — can show the user's own position on a map of customers and leads. That position is shown on the device only and is not sent to us. When FavorTap takes a card payment in person with Tap to Pay on iPhone, Stripe's software on the phone sends Stripe an approximate location of the payment, which Stripe requires to prevent fraud. We do not receive it.

If you work with us as an independent sales rep, we also hold the last four digits and routing number of the bank account we pay you into and, if you authorize bank debits for charges such as a lost product, the IP address and browser recorded when you authorize them. We also keep a copy of the agreement you signed in the app, with the name you typed, the date and the version. Your tax information for 1099 reporting is collected directly by our payment processor; we keep only Stripe's status for it (complete, or what is still missing), never the tax number.

If you work with us as an independent sales rep and are required to use Start working to record sales, we collect your phone's precise location, including while the app is in the background, until you tap Stop working or the app ends your work session. Only people with owner-level access see it, live and as route history. We use it to see where our reps are, to help keep them safe, to check disputes about visits, leads and sales, and to protect the business. We keep each point for one year after it is recorded and then delete it, unless it is needed for a dispute or legal claim. It is stored with our cloud database provider and shown on our map provider's map. We do not sell it or share it for advertising. We collect none when you are not in a work session. You can stop with Stop working, turn off location in your phone settings, or email support@favortap.com to withdraw consent. After you withdraw, nothing new is recorded. Points already recorded are kept for their full year and then deleted; without location you cannot record sales.

If one of our team or a sales rep takes a photo or video of you with a FavorTap product after a sale, we do so only after you tick a consent box. We keep the photo or video, your business name, the name entered with your consent, which team member took it, and the exact wording you ticked with the time. It is stored privately, where only our team can open it, and the location data in a photo is removed. With your consent we may use it, with your name and business name, in our own marketing: on our website, on social media and in advertising. You can ask us to take it down at any time by emailing support@favortap.com. We keep the consent record after a takedown, without the photo or video.

If the FavorTap app crashes, it sends us a short report: the error message and trace, the screen it happened on, the app version, whether the phone is an iPhone or Android and its system version, the time, and, if you were signed in, whether you are an owner, a rep or a customer and your internal account ID. Before anything is stored we automatically strip what we can recognise: email addresses, sign-in tokens, long keys and card-like numbers. We use these reports only to fix the app.

If you turn on notifications in the customer app (new review, monthly summary), we keep your two choices and this phone's device identifier from Apple so we can send them. Both are off until you turn them on, and you can turn them off in Settings; signing out everywhere removes all of your phones.

If a card payment is disputed with the card issuer, we send our payment processor, and through it the bank, evidence about that order: your business name, email address, phone number and address, the agreement you signed and when you accepted our Terms, your payment and shipping records, how many times you contacted support, and your product's tap activity.

What we don't collect

Online, card numbers are entered on a payment page hosted by Stripe. In person, your card may be read by the iPhone's built-in card reader (Tap to Pay on iPhone) and passed straight to Stripe. Either way, we never receive, see, or store your card number — only the card brand and last four digits, so we can tell which card paid.

We collect your phone's location only for the owner-side map (kept on the device), for in-person card payments (sent to Stripe), and from sales reps during a work session, as described above. Addresses in our system are typed in, not read from your phone. Our app asks for these permissions and no others: NFC, to read and program the tap stands and stickers; Face ID, to protect access to the owner tools; location, for the map and for in-person card payments as described above, and, for sales reps, including in the background during a work session, with a notice shown in the app first; and Bluetooth, which Stripe's payment software requires the app to declare even though we don't use Bluetooth card readers. If you're on a plan, the app also asks for the camera, to take a photo for your FavorTap Page's logo.

Camera. If you use the FavorTap app and choose to take a photo for your FavorTap Page's logo, we access your device's camera at that moment only, to capture that one photo. The photo is uploaded, resized, and stored as your page's logo — handled the same way as a logo you upload from your camera roll instead. We don't access your camera at any other time and don't keep the original photo separately once it's stored as your logo.

Our AI support assistant

Our support chat is answered by an AI assistant — Anthropic's Claude — until a member of our team takes over the conversation. Once a person has replied, the assistant stops replying on that conversation; if it then goes quiet for about a day, the assistant may answer again, and it can see our team's earlier replies.

If you are on a management plan, we also use the same AI service for drafting replies to your Google reviews. For that it is given your business name and the review: the reviewer's name as shown on Google, the star rating and the review text.

If you are signed in when you use the chat, the assistant is given a summary of your own account so that it can answer questions about it. That summary contains:

• Your business name
• Whether you are on a product-only or a management plan, and your billing and activation status
• Your plan start date and the date you become eligible to cancel
• How many products you have, and a breakdown of their statuses
• Your total tap count and the date of your most recent tap
• Your plan's name, your next payment date, and the date your plan ends if you have cancelled it
• Each product's code, type, and whether it has been turned on
• The status of your recent orders, including the carrier and tracking number

Your email address, phone number, postal address, contact name and payment details are never sent to the AI assistant.

Who we share information with

We use a small number of service providers, and only to run the service. We share information with them by category, not by name, since who specifically handles a given task is an internal detail rather than something that changes what's shared or why. This list of categories is complete:

• Payment processing, subscription billing, and sales tax calculation — the address your order ships to, or your business address for an in-person sale, is used to work out the tax. Card details are collected directly by our payment processor, not by us, and the billing address for your card is held by them, not by us.
• Cloud database and file storage, including a logo you choose to upload for your FavorTap Page.
• AI-assisted customer support and drafting replies to your Google reviews, as described above.
• Shipping labels and delivery — the name and address your order ships to, so the carrier can deliver it.
• Push notifications to our mobile app — a device identifier from Apple, which also carries the notification text, so we can send notifications to your phone.
• Transactional email delivery — receipts, password resets, support replies, and Google review emails forwarded to us so we can respond to your reviews.
• Address autocomplete and mapping, to help you enter an address and to display customer locations on our internal map.
• Application hosting and aggregated website visit counts (page views and where visitors come from).

We may also disclose information where we are legally required to do so, or in connection with a sale or transfer of the business. We do not sell your personal information, and we do not share it for advertising or for cross-context behavioural advertising.

Cookies

We set no cookies at all until you sign in, and we have no cookie banner because we have nothing to ask you about.

We use cookies only to run your signed-in session: to keep you signed in, to sign you out automatically after a period of inactivity, and to tell our systems whether a session was opened in a browser, in the FavorTap app, or through a Page's own separate sign-in. We never use cookies for advertising, analytics, or tracking. A public FavorTap Page — the page a customer sees when they tap a Product — sets no cookies at all, whether or not anyone is signed in to manage it.

Our support chat also stores three values in your own browser — which conversation you're in, the last message you saw, and whether that conversation belongs to your signed-in account — so that reopening the chat shows your conversation rather than starting a new one. That stays on your device.

How long we keep it

We keep customer, billing, shipping and signed-agreement records for as long as your account is active, and for at least seven years afterwards, because tax and accounting rules require us to be able to substantiate past transactions. Support conversations are kept for two years. Tap logs are kept for at least two years, and are not linked to an identifiable person in the first place.

If you send us a photo or video with a replacement request, we keep it for 90 days after the request is closed so we can review it, and only our team can see it.

A sales rep's location points are kept for one year after they are recorded and then deleted, unless needed for a dispute or legal claim. App crash reports are deleted after 60 days. Testimonial photos and videos are kept until you ask us to take them down, and we then delete them.

If you ask us to delete your information, we will do so except where we are required to retain it for the reasons above — in which case we will tell you what we are keeping and why. Copies in our backups and with our service providers can remain for a short time after we delete your information.

Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to delete it, to receive a copy of it, and to object to certain uses of it. We extend these rights to everyone who asks, regardless of where they live, rather than only where the law compels it.

To make a request, email support@favortap.com. Before we delete anything, we confirm the request comes from the person the record belongs to — by replying to the email address we hold for you, or from your signed-in account. We aim to finish within 30 days. We will not charge you for it, and we will not treat you differently for asking. If you are in California: we do not sell or share personal information as those terms are defined by the CCPA, and we do not engage in cross-context behavioural advertising, so there is nothing for you to opt out of.

Security

We hash passwords using scrypt and never store them in plain text. Password-reset tokens are stored only as hashes, so reading our database does not let anyone take over an account. Credentials in our mobile app are held in your device's operating-system Keychain behind Face ID or your device passcode. Payment card details never reach our servers at all.

No system is perfectly secure, and we cannot guarantee absolute security. If we ever discover a breach affecting your information, we will tell you.

Children

FavorTap is a tool for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, email support@favortap.com and we will delete it.

Changes to this policy

If we change this policy we will post the change here and update the effective date at the top. If a change materially affects how we handle information we already hold about you, we will email account holders rather than relying on you to re-read this page.