Last updated: 2026-08-14
Welcome to TapReview. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our website, business dashboard, customer-facing scan flow, and related services (collectively, the "Service"). By using the Service, you agree to the practices described in this policy. This policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023 ("DPDP Act").
We collect three categories of information. First, business owner information when you create an account or contact us. including your name, email address, phone number, business name, and details about your business (such as your Google Business Profile link). Second, end-customer contact information collected via your scan-flow lead-capture form. including name, phone number, and email address. but only with the explicit consent of the end customer at the moment of collection. Third, usage data collected automatically when you or your customers use the Service. including IP addresses (used for rate limiting and abuse prevention), browser and device information, access logs, scan events, and rating submissions. Payment information is processed by our third-party payment processor; we do not store credit card numbers or full bank details on our systems.
We use the information we collect to deliver and operate the Service, process subscriptions and payments, provide customer support, prevent abuse and fraud (including rate limiting and AI-credit protection), comply with legal obligations, and improve the Service through aggregate, non-identifying analytics. We do not sell, rent, or share personal information with third parties for advertising or marketing purposes.
Under the Digital Personal Data Protection Act, 2023, we process personal data on the basis of: (a) explicit consent given by the data principal (the business owner for account data, the end customer for lead-form data), (b) legitimate uses such as fraud prevention, security, and compliance with legal obligations, and (c) contractual necessity to deliver the Service you have purchased.
Account data is retained while your account is active and for 180 days after account deletion or your written deletion request. End-customer lead contact information follows the same 180-day retention after deletion. Hard deletion is performed by an automated daily process. Financial records (subscription invoices, payment receipts) are retained for 8 years as required by Indian tax law and the Income Tax Act, even where you have requested account deletion. Aggregate, non-identifying analytics may be retained indefinitely.
We use trusted third-party providers for hosting infrastructure, payment processing, transactional email delivery, AI generation, customer support tools, and analytics. These providers process data only as needed to deliver their services to us and are contractually bound by confidentiality and data-protection commitments. We do not sell, rent, or share your data with third parties for advertising or marketing purposes. Where required by applicable law, we may disclose information in response to valid legal process, to protect our rights and the safety of our users, or to comply with regulatory obligations.
We implement industry-standard security measures to protect personal information against unauthorized access, alteration, disclosure, or destruction. These include encryption in transit (TLS), encryption of sensitive data at rest, role-based access controls with least-privilege principles, audit logging of administrative actions, and incident response procedures. No method of transmission over the internet or electronic storage is 100% secure; we work continuously to improve our security posture but cannot guarantee absolute security.
You have the right to access the personal data we hold about you, correct inaccuracies, request erasure, withdraw your consent, and seek redress with the Data Protection Board of India if you believe we have violated your rights. To exercise any of these rights, email us at hello@tapreview.in. We respond to all rights requests within 30 days, as required by the DPDP Act. You may also nominate another individual to exercise your rights in the event of your death or incapacity.
Some of our service providers may be located outside India. Where personal data is transferred internationally, the transfer is conducted under standard contractual safeguards consistent with the requirements of applicable Indian law, including the DPDP Act. We do not transfer personal data to jurisdictions specifically restricted by the Government of India.
The Service is not directed at minors under 18 years of age, and we do not knowingly collect personal information from minors. If you believe we have collected information from a minor without verifiable parental consent, contact us at hello@tapreview.in and we will delete the information promptly.
We may update this Privacy Policy from time to time. If we make material changes, we will notify business owners via the dashboard banner and/or email at least 14 days before the changes take effect. Continued use of the Service after the effective date of any update constitutes acceptance of the revised policy.
For privacy-related questions, requests, or complaints, contact us at hello@tapreview.in. We aim to respond to all inquiries within 5 business days and to formal rights requests within 30 days as required by the DPDP Act.
TapReview offers Sign in with Google and an optional Google Business Profile connection. This section explains, in addition to the general practices above, exactly what Google user data we access, how we use it, and how you control it. Sign in with Google: When you choose to sign in or sign up with Google, we receive basic profile information from your Google Account, specifically your name, email address, and Google account identifier. We use this only to create and secure your TapReview account and to sign you in. We never receive your Google password. Google Business Profile connection: Connecting your Google Business Profile is optional and begins only when you, the business owner, explicitly click Connect and grant access on Google's consent screen. We request the Google Business Profile scope (https://www.googleapis.com/auth/business.manage). With your authorization, and only for the specific business location you select, we access: (a) your business profile information such as name, categories, description, opening hours, services, website, and phone number; (b) your profile performance insights such as views, calls, and direction requests; and (c) your Google reviews, including each review's rating, text, and the reviewer's public display name and photo, together with the ability to post replies that you write. How we use Google data: We use this data solely to provide the features you connect it for, namely to show your profile insights and reviews inside your TapReview dashboard, to help you draft and post replies to your own reviews, and to let you update your own business information on your own listing. We never post reviews on your behalf and we never generate or submit fake reviews. We do not use Google user data for advertising, and we do not sell it. How we store Google data: Your Google OAuth access and refresh tokens are encrypted at rest and are used only to make requests to Google on your behalf. Profile, insights, and review data synced from Google are stored so we can display them in your dashboard, and are retained only while your Google Business Profile connection is active. Sharing and AI: We do not sell Google user data and we do not use it for advertising. We transfer it only as necessary to provide the features you connect it for, namely: to our secure cloud hosting and infrastructure providers; and, when you ask us to draft a review reply or a profile description, to the third-party AI processing provider that generates that draft, which receives only the content needed for that specific request and processes it under our instructions and confidentiality terms. We do not use Google user data to develop, improve, or train our own or any generalized or standalone artificial intelligence or machine learning models. Aside from these cases, we transfer Google user data only to comply with law or in connection with a merger or acquisition under equivalent protections. Limited Use: TapReview's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Revoking access and deletion: You can disconnect your Google Business Profile at any time from the integrations page in your TapReview dashboard, and you can review or revoke TapReview's access at https://myaccount.google.com/permissions. When you disconnect, or when you delete your TapReview account, we delete the stored Google OAuth tokens and the Google data synced for that connection, subject to the retention and legal-hold periods described above. For any question about Google data, contact us at hello@tapreview.in.
TapReview is independent and is not affiliated with, endorsed by, or sponsored by Google LLC. Google, Google Maps, and Google Business Profile are trademarks of Google LLC. Our platform facilitates and encourages the submission of reviews to Google's services on behalf of our customers. All other trademarks referenced on the Service are the property of their respective owners.