Privacy policy

This notice explains how the Tapcord service (tapcord.app) handles your personal data. It covers only Tapcord — not any other activity of Gridvise Limited.

Who we are

Gridvise Limited is the data controller for the Tapcord service (tapcord.app). This notice covers only the Tapcord service and not any other activity of Gridvise Limited. Tapcord is a trading name of Gridvise Limited (Company No. 09002112), registered at Swift House, Ground Floor, 18 Hoffmanns Way, Chelmsford, Essex, England, CM1 1GU.

For anything in this notice, or to exercise your rights, email us at hello@tapcord.app.

What we process

• Your account: the email address you sign in with, and basic sign-in metadata needed to keep your account secure.
• Your tapcords: the records you create — photos, video, voice notes, text notes, dates, and any location you choose to attach. Media can contain whatever you point your camera at, so treat it as personal to you.
• Waitlist: if you join the waitlist, the email address you give us and, optionally, whether you asked for product updates.
• Tag activity: when a tag is tapped or a tapcord is opened, we record a first-party analytics event so an owner can see how often their own tags are used and we can keep the service healthy. It captures the kind of device, browser and operating system, a coarse location (country/region), the referring site, and a one-way hashedform of the visitor’s IP address. We do not set cookies for this, store your raw IP address, or use it to identify anonymous visitors.
• Sign-up context: when you create an account we record, once, how you arrived: the kind of device, browser and operating system, a coarse location (country/region), a one-way hashedform of your IP address, and — where we can tell — the page you first landed on that day, the site that referred you and any campaign tag in the link. We keep it so we can support you (“why can’t I sign in?”), spot abuse, and see which campaigns bring real accounts. We do not store your raw IP address and we do not set a cookie for it.
• Website analytics (only if you agree): on our public pages — the marketing pages and the shop — we ask whether we may use the third-party analytics service Google Analytics to understand which pages and campaigns actually help people. It is off by default: nothing is sent to Google and no analytics cookie is set unless you accept, and you can change your answer at any time on our cookies page. It measures pages and events — the pages you view on the public site, and the steps of a purchase. When an order completes we also send Google the sale and its value together with a one-way hashed form of your account identifier, so a purchase can be joined to the visit that led to it; Google never receives your email address, your name, or anything from your tapcords. The signed-in app is excluded entirely — as is a tapcord page itself — so your own records are never measured this way.

We do not use advertising or remarketing pixels, we run no cross-site ad tracking, and we do not sell your data. The tag-activity analytics above stay first-party: counts and coarse technical detail on our own servers, never a profile of you across the web.

Why we’re allowed to (lawful bases)

• Contract: to give you the account and features you signed up for — storing and showing your tapcords back to you.
• Legitimate interests: to keep the service secure, prevent abuse, fix problems, and understand how tags are used (our own first-party, cookieless measurement) so we can improve the service.
• Consent: for optional marketing updates and for the Google Analytics cookies described above, where you opt in. You can withdraw consent at any time — the analytics choice is a single tap on our cookies page.
• Legal obligation: where the law requires us to keep or disclose certain information.

Who processes data for us

We use a small set of trusted providers who process data on our behalf under contract:

• Supabase — database and authentication.
• Cloudflare R2 — storage for your photos, video, and voice notes.
• Vercel — hosting and content delivery.
• Email delivery (Brevo / SMTP) — sending sign-in and service emails.
• Stripe — payment processing, when the shop launches.
• Google — Google Analytics measurement of our public marketing and shop pages, only where you have accepted analytics cookies.

How long we keep it

We keep your account and tapcords for as long as your account is active. If you ask us to delete your account, we remove your personal data within a reasonable period, except where we must keep some records to meet a legal obligation.

International transfers

Some of our providers process data outside the UK/EEA. Where they do, the transfer is protected by appropriate safeguards, such as the UK International Data Transfer Agreement or Standard Contractual Clauses.

Your rights

You have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. Self-service tools for export and deletion are on the way; in the meantime, email hello@tapcord.appand we’ll handle your request. You can also complain to the UK Information Commissioner’s Office (ico.org.uk).