Privacy Policy

1. Who We Are

Tappa Software Solutions is a sole proprietorship registered in the Province of Manitoba, Canada (Registration No. 10157481), with a registered address at 100 Innovation Drive, 4th Floor, Suite B, Winnipeg, Manitoba. We operate the Tappa platform — a subscription management and analytics SDK for indie iOS developers — available at tappa.live.

For privacy matters, you may reach us at legal@tappa.live or hello@tappa.live.

2. Information We Collect

2.1 Account Information

When you register for a Tappa account, we collect:

• Full name and email address
• Password (stored as a one-way bcrypt hash — we cannot read it)
• Your iOS app name and App Store Connect details you choose to provide
• Company or studio name (optional)

2.2 Payment Information

Billing is processed by our payment processor. We do not store your credit card numbers or banking details on our servers. We retain billing records (plan, amount, date, invoice ID) as required by Canadian tax law.

2.3 SDK Integration Data

When you integrate the Tappa SDK into your iOS app, the SDK sends us subscription event data originating from Apple’s StoreKit and App Store Server Notifications, including:

• App Store transaction IDs and receipt data
• Subscription status, product identifiers, and renewal dates
• Anonymised or pseudonymised device tokens (no personally identifiable data about your end-users is sent unless you explicitly pass it)

2.4 Usage and Technical Data

We automatically collect certain technical information when you use the Tappa dashboard or our API:

• IP address, browser type, and operating system
• Pages visited, time spent, and navigation paths
• API call logs (endpoint, timestamp, status code — no payload body unless required for debugging with your explicit consent)
• Error logs and performance metrics

2.5 Communications

If you contact us by email or through our support channels, we retain those communications and any information you include to help resolve your query.

3. How We Use Your Information

• Service delivery — to provision your account, process SDK events, and display your revenue dashboard.
• Billing — to charge for your chosen plan and issue invoices.
• Product improvement — to understand how the platform is used and prioritise features.
• Security — to detect fraud, abuse, or unauthorised access and protect our systems.
• Communications — to send transactional emails (receipts, alerts, password resets) and, where you have opted in, product news and release notes.
• Legal compliance — to meet our obligations under Canadian law (PIPEDA / Law 25) and applicable international regulations.

4. Legal Basis for Processing

Where applicable privacy law requires a legal basis, we rely on:

• Contract — processing necessary to provide the services described in our Terms of Service.
• Legitimate interests — security monitoring, fraud prevention, and aggregate analytics.
• Consent — marketing emails and optional analytics cookies (you may withdraw at any time).
• Legal obligation — record retention required by Canadian tax and corporate law.

5. Sharing and Disclosure

We do not sell your personal data. We may share it with:

• Service providers — hosting, payment processing, error monitoring, and email delivery, each bound by data processing agreements.
• Apple Inc. — to verify App Store receipts and receive server notifications via Apple’s official APIs.
• Legal authorities — when required by court order, regulation, or to protect our legal rights.
• Business transfers — in the event of a merger or acquisition, subject to equivalent privacy protections.

6. Data Retention

We retain your account data for as long as your account is active and for six years thereafter, as required by Canadian tax law. SDK event logs are retained for 24 months and then purged or anonymised. You may request earlier deletion (see Section 7).

7. Your Rights

Depending on your jurisdiction, you may have rights to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data (“right to be forgotten”)
• Object to or restrict certain processing
• Receive a portable copy of your data
• Withdraw consent where processing is consent-based

To exercise any of these rights, email legal@tappa.live. We will respond within 30 days. We may need to verify your identity before acting on requests.

8. Cookies and Tracking

We use cookies and similar technologies on tappa.live. For full details on what we set and how to control them, see our Cookie Policy.

9. Security

We use TLS encryption in transit and encryption at rest for sensitive fields. Access to production systems is restricted to authorised personnel via multi-factor authentication. No method of transmission over the internet is 100% secure, however, and we cannot guarantee absolute security.

10. International Transfers

Our infrastructure is primarily hosted in Canada and the United States. If we transfer your data outside Canada, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses or equivalent mechanisms) consistent with PIPEDA requirements.

11. Children’s Privacy

The Tappa platform is intended for developers aged 18 and over. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice on our website at least 14 days before the change takes effect. Your continued use of Tappa after the effective date constitutes acceptance of the revised policy.

13. Contact

For privacy inquiries or to exercise your rights:

• Email: legal@tappa.live
• General: hello@tappa.live
• Post: Tappa Software Solutions, 100 Innovation Drive, 4th Floor, Suite B, Winnipeg, Manitoba, Canada