Last updated: 2026-05-09
Welcome to TapReview. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our website, business dashboard, customer-facing scan flow, and related services (collectively, the "Service"). By using the Service, you agree to the practices described in this policy. This policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023 ("DPDP Act").
We collect three categories of information. First, business owner information when you create an account or contact us. including your name, email address, phone number, business name, and details about your business (such as your Google Business Profile link). Second, end-customer contact information collected via your scan-flow lead-capture form. including name, phone number, and email address. but only with the explicit consent of the end customer at the moment of collection. Third, usage data collected automatically when you or your customers use the Service. including IP addresses (used for rate limiting and abuse prevention), browser and device information, access logs, scan events, and rating submissions. Payment information is processed by our third-party payment processor; we do not store credit card numbers or full bank details on our systems.
We use the information we collect to deliver and operate the Service, process subscriptions and payments, provide customer support, prevent abuse and fraud (including rate limiting and AI-credit protection), comply with legal obligations, and improve the Service through aggregate, non-identifying analytics. We do not sell, rent, or share personal information with third parties for advertising or marketing purposes.
Under the Digital Personal Data Protection Act, 2023, we process personal data on the basis of: (a) explicit consent given by the data principal (the business owner for account data, the end customer for lead-form data), (b) legitimate uses such as fraud prevention, security, and compliance with legal obligations, and (c) contractual necessity to deliver the Service you have purchased.
Account data is retained while your account is active and for 180 days after account deletion or your written deletion request. End-customer lead contact information follows the same 180-day retention after deletion. Hard deletion is performed by an automated daily process. Financial records (subscription invoices, payment receipts) are retained for 8 years as required by Indian tax law and the Income Tax Act, even where you have requested account deletion. Aggregate, non-identifying analytics may be retained indefinitely.
We use trusted third-party providers for hosting infrastructure, payment processing, transactional email delivery, AI generation, customer support tools, and analytics. These providers process data only as needed to deliver their services to us and are contractually bound by confidentiality and data-protection commitments. We do not sell, rent, or share your data with third parties for advertising or marketing purposes. Where required by applicable law, we may disclose information in response to valid legal process, to protect our rights and the safety of our users, or to comply with regulatory obligations.
We implement industry-standard security measures to protect personal information against unauthorized access, alteration, disclosure, or destruction. These include encryption in transit (TLS), encryption of sensitive data at rest, role-based access controls with least-privilege principles, audit logging of administrative actions, and incident response procedures. No method of transmission over the internet or electronic storage is 100% secure; we work continuously to improve our security posture but cannot guarantee absolute security.
You have the right to access the personal data we hold about you, correct inaccuracies, request erasure, withdraw your consent, and seek redress with the Data Protection Board of India if you believe we have violated your rights. To exercise any of these rights, email us at privacy@tapreview.in. We respond to all rights requests within 30 days, as required by the DPDP Act. You may also nominate another individual to exercise your rights in the event of your death or incapacity.
Some of our service providers may be located outside India. Where personal data is transferred internationally, the transfer is conducted under standard contractual safeguards consistent with the requirements of applicable Indian law, including the DPDP Act. We do not transfer personal data to jurisdictions specifically restricted by the Government of India.
The Service is not directed at minors under 18 years of age, and we do not knowingly collect personal information from minors. If you believe we have collected information from a minor without verifiable parental consent, contact us at privacy@tapreview.in and we will delete the information promptly.
We may update this Privacy Policy from time to time. If we make material changes, we will notify business owners via the dashboard banner and/or email at least 14 days before the changes take effect. Continued use of the Service after the effective date of any update constitutes acceptance of the revised policy.
For privacy-related questions, requests, or complaints, contact us at privacy@tapreview.in. We aim to respond to all inquiries within 5 business days and to formal rights requests within 30 days as required by the DPDP Act.
TapReview is independent and is not affiliated with, endorsed by, or sponsored by Google LLC. Google, Google Maps, and Google Business Profile are trademarks of Google LLC. Our platform facilitates and encourages the submission of reviews to Google's services on behalf of our customers. All other trademarks referenced on the Service are the property of their respective owners.