Privacy Policy

This Privacy Policy explains how QuickyTap (“QuickyTap”, “we”, “us”), operated by Awwad Karam Awwad Ibrahim e.v., Péterfy Sándor utca, Budapest, Hungary (tax number 62767136), collects, uses, and protects personal data. It applies to our website at quickytap.com, our business dashboard at app.quickytap.com, and the review pages your customers use.

1. Who this applies to

We serve two groups: business customers who create an account to collect reviews, and the end-customers of those businesses who leave a review by tapping a QuickyTap card or scanning a QR code. This policy covers both.

2. Information we collect

From business customers — the account owner’s name and email, business details (name, category, review links, opening hours), login credentials (passwords are stored only as secure hashes), team members you invite, and billing information processed by our payment provider (we never store full card numbers).

From end-customers leaving a review — the star rating and the multiple-choice answers they tap, the review text our system generates from those answers, and limited technical context: device type, browser, operating system, approximate country, language, timestamps, and a pseudonymised identifier derived from the IP address (a keyed hash computed with a secret held only on our servers). We do not ask end-customers for their name or email, and we do not store their raw IP addresses.

Usage data — how the dashboard and review pages are used, for analytics and to keep the service secure and reliable.

From hardware shop buyers — name, email, optional phone number, shipping address and order details, used to fulfil the order, send order emails and issue the invoice.

Digital business cards — the profile details a card owner chooses to publish, and statistics about visits to the card: device type, country, language, which link or button was used, and a per-card pseudonymised visitor identifier derived from the IP address.

3. How we use data

• Provide the service — generate review drafts and route customers to the right review platform.
• Give businesses analytics, insights, and staff performance reporting.
• Process subscriptions and payments, and send service emails (verification, alerts, receipts).
• Keep the platform secure, prevent abuse, and comply with legal obligations.

4. AI-generated reviews

Review drafts are produced by an AI model based on the star rating and multiple-choice answers the customer selects. Those inputs are sent to our AI provider (OpenAI) to generate the text. The customer can read, regenerate, or edit the draft before choosing to post it — the final review is always their choice and their words.

5. Legal basis (GDPR)

Where the EU/UK GDPR applies, we rely on: performance of a contract (to provide the service to businesses), legitimate interests (analytics, security, service improvement, in a privacy-protective way), consent where required, and legal obligation (e.g. tax and accounting records).

6. Service providers we share data with

We do not sell personal data. We share it only with the processors that run our service:

• Vercel — application hosting.
• Supabase — database hosting (EU region, Frankfurt).
• OpenAI — AI generation of review drafts.
• Resend — sending transactional emails.
• Stripe — subscription billing and payment processing.
• Google (Google Analytics), Vercel (Web Analytics) and, when enabled, PostHog — optional website analytics, used only if you accept it (see section 9).

Each processes data only on our instructions. Some providers may process data outside the EEA; where they do, appropriate safeguards (such as Standard Contractual Clauses) apply.

7. Data retention

We keep business account data for as long as the account is active and as needed to provide the service. Review and analytics data are kept while the business exists; a plan limits how much history the dashboard shows, not how long the data is stored, and there is currently no automatic deletion schedule. Billing records are kept as required by law. You can request deletion as described below.

When a business is deleted, its cards, digital profiles, review sessions, imported reviews, analytics, team memberships, uploaded images and subscription billing history are deleted, and any paid subscription is cancelled. Issued tax invoices, a record of the deletion (the business name and payment-provider identifiers) and activity-log entries are kept. Payment, invoicing and other providers keep their own copies under their own terms.

If a business connects its Google Business Profile, we keep a temporary copy of the selected location's Google reviews (rating, text, dates, the owner's replies and the reviewer name and photo link exactly as Google provides them) for at most 30 days after each fetch, only to show them in that business's dashboard. They are kept separate from QuickyTap feedback, are not used for AI or statistics, and are not included in data exports — Google holds the originals. Disconnecting Google deletes the copy and our stored access tokens at once; when the integration is active we also ask Google to revoke QuickyTap's access, and you can remove it yourself under third-party access in your Google Account.

8. Your rights

Depending on your location, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. You can exercise these rights by emailing hello@quickytap.com. If you are in the EU, you may also lodge a complaint with your local data protection authority (in Hungary, the NAIH).

There is no self-service export or account-closure button: requests are handled by our team, and we confirm the request comes from the account holder before acting. Team members who use the dashboard can leave a business from their Profile page. Staff logins open a limited staff page instead of the dashboard and have no Profile page; they can ask the business owner to remove them, or email us as described above. An account that is the only owner of a business can be closed once the business has another owner or has been deleted. Reviewers are not identified by name or email, so to find a review we may need details such as the business, date and time.

9. Cookies and analytics

Necessary storage (always on). We use a small number of cookies and browser-storage entries that the site cannot work without: keeping business users signed in, securing a customer’s review session, remembering your language, keeping your cart and your progress through a review, and remembering your cookie choice itself (for 180 days). These are not used for analytics.

Optional analytics (off unless you accept). With your permission, we use Google Analytics (Google), Vercel Web Analytics (Vercel) and, when enabled, PostHog to understand how our website is used — for example, which pages are visited. These tools are not loaded and nothing is sent to them until you choose “Accept analytics”. If you choose “Reject optional”, or make no choice, they stay off. Once you accept, these tools may store identifiers in cookies or your browser’s storage.

Changing your choice. You can change your choice at any time with the Cookie settings button below or in the site footer. If you withdraw consent, analytics stops and we delete the analytics cookies and stored data that this site can access in your browser.

Review pages. When a customer opens a business’s review page, we record the visit in our own database (with the technical details described in section 2) so the business can see how its review flow performs; a temporary marker in that browser tab stops the same visit being counted twice. This is part of the service we provide to the business and does not depend on the choice above. An optional analytics tool is only told about the visit if you have accepted analytics.

10. Security

Data is encrypted in transit (HTTPS) and passwords are hashed. Visitor IP addresses are stored only as pseudonymised keyed hashes: the IP address cannot be read back from them, but whoever holds our secret key could check whether a given IP address matches, so that key is kept on our servers only. For signed-in accounts, the IP address of each login session is stored with that session so you can review your active sessions. Access to production systems is restricted. No system is perfectly secure, but we take reasonable measures to protect your data.

11. Children

QuickyTap is not directed to children under 16 and we do not knowingly collect their data.

12. Changes

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above and, where appropriate, notified to account holders.

13. Contact

Questions about privacy? Email hello@quickytap.com or write to Awwad Karam Awwad Ibrahim e.v., Péterfy Sándor utca, Budapest, Hungary.

Have this policy reviewed by a lawyer before launch to confirm it meets your specific legal obligations.