Privacy Policy
1. Controller
Be1x sp. z o.o., ul. Strażacka 54D, 35-312 Rzeszów, Poland, entered in the National Court Register (KRS) under number 0000995721, NIP 8133886490, REGON 523337944. Contact for all data matters: hello@tapvee.com.
2. Launch waitlist
If you sign up to be notified about the launch, we store your email address, the language of the page you used (English or Polish) and the date and time you gave consent. We do not store your IP address. Purpose: sending you one message when Tapvee launches. Legal basis: your consent, Article 6(1)(a) GDPR. We keep the data until the launch notice is sent and for 12 months after that, or until you withdraw consent, whichever comes first. To withdraw consent or unsubscribe, write to hello@tapvee.com. Withdrawal does not affect anything done before it.
2a. Beta testers
If you sign up for the beta, we additionally store the business name and type you give and whether you have an iPhone. Purpose: inviting you to test the app through Apple TestFlight and asking for feedback. Legal basis: your consent, Article 6(1)(a) GDPR. We keep these details until the end of the beta and for 12 months after that, or until you withdraw consent. To send a TestFlight invite we pass your email address to Apple, which runs TestFlight.
3. People who tap a tag or scan a QR code
When someone opens a Tapvee link we look up which business it points to and send them to that business’s Google review form. We store only a daily count of opens and redirects per tag. We do not store IP addresses, names, device identifiers or location, and we do not set cookies. Bots and link previews are not counted. Legal basis: our legitimate interest in running the service and showing owners how often their tag is used, Article 6(1)(f) GDPR. The counters are kept as long as the tag link exists.
4. Business owners using the iPhone app
The app needs no account. To create a link we store the Google Place ID of the business you chose, the short Tapvee address created for it, an anonymous identifier of the tag you wrote and a one-way hash of a random identifier generated by your app installation. Business search is done through the Google Places API, so your search text is sent to Google. To limit automated abuse we compute a salted one-way hash of the requesting IP address and keep it for about two minutes. The IP address itself is never stored. Legal basis: legitimate interest in providing and protecting the service, Article 6(1)(f) GDPR.
5. Fonts, cookies and analytics
Fonts are served from our own domain, so loading this website does not contact Google Fonts. The website sets no cookies. We use Cloudflare Web Analytics to count visits: it uses no cookies and no device fingerprint, and gives us only aggregated statistics such as page views, referrers, countries and page load times. Legal basis: our legitimate interest in knowing how the website is used, Article 6(1)(f) GDPR.
6. Processors and recipients
Cloudflare, Inc. hosts the website, the Worker code and the databases (Workers, D1) as our processor. Google receives business search queries from the app (Places API), and customers who reach a Google review form are on Google’s own service under Google’s privacy policy. When someone joins the waitlist or the beta, we send ourselves an internal notification with the sign-up details through Telegram (Telegram Messenger Inc.), which only our team reads.
7. Transfers outside the EEA
Cloudflare may process data in the United States and other countries outside the European Economic Area. Such transfers rely on the EU–US Data Privacy Framework where applicable and on the European Commission’s Standard Contractual Clauses in Cloudflare’s data processing agreement.
8. Your rights
You have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent at any time. Write to hello@tapvee.com. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, or with the supervisory authority in your own country.
9. Automated decisions
We do not make decisions based solely on automated processing, including profiling.
10. Changes
We will publish any changes to this policy on this page with a new date.