Privacy notice

1. Who we are

TapQuote is a service operated by Jack Tyrrell, a sole trader trading as "TapQuote" ("we", "us", "our"). Jack Tyrrell is the data controller for the personal data described in this notice, except where stated otherwise below. You can contact us about anything in this notice at privacy@tap-quote.com.

2. Our role as controller and as processor

We are the controller for data about you, our subscriber - your account and billing-related records. Where you enter details about your own customers into TapQuote, you are the controller of that data and we act as your processor, handling it only on your instructions and only to provide the service to you.

3. Personal data we collect

• Account data: your name, email address, business or trading name, business address, phone number, and login credentials (passwords are stored only as salted hashes).
• Business content: your price list, job templates, quotes, invoices, business logo and branding settings.
• Customer records you enter: the names, addresses, phone numbers and email addresses of your own customers.
• Support data: the content of messages you send us and our replies.
• Usage and technical data: log records, device and browser type, approximate location derived from IP address, IP address, and error diagnostics.
• Cookies and similar identifiers: see section 10.
• Billing-related data: your subscription status, plan, renewal dates and the last four digits and card type where our payment provider makes those available. We do not collect or store full card numbers.

4. Why we use it, and our legal basis

• To create and run your account and provide the service - legal basis: performance of our contract with you.
• To take payment, manage your subscription, and handle invoicing and tax - legal basis: performance of our contract and compliance with a legal obligation.
• To provide customer support - legal basis: performance of our contract.
• To keep the service secure and prevent fraud and abuse - legal basis: our legitimate interests in protecting the service and its users.
• To fix faults, monitor performance and improve the product - legal basis: our legitimate interests in running and improving a reliable service.
• To send service and administrative messages such as billing notices and material changes to these documents - legal basis: performance of our contract.
• To send marketing emails about TapQuote - legal basis: your consent, or our legitimate interests where permitted for existing customers. You can opt out at any time.
• To meet accounting, tax and other legal duties, and to establish or defend legal claims - legal basis: legal obligation and legitimate interests.

5. Who we share it with

We share personal data only with the following categories of recipient, and only as far as needed:

• Merchant of Record: our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle acts as an independent controller for payment data and receives the information needed to sell the subscription to you, manage your subscription, take payment, prevent fraud, calculate and remit tax, issue invoices, and handle refunds and billing enquiries. Paddle's own privacy notice is available at paddle.com/legal/privacy.
• Hosting and database providers, who store the service data in the European Union (Ireland).
• Email delivery, error monitoring and analytics providers, who process technical and contact data on our instructions.
• Professional advisers such as accountants and lawyers, where needed.
• Public authorities, regulators or courts, where we are legally required to disclose data.
• A buyer or successor, if the business is sold, merged or reorganised.

6. Where your data is stored, and international transfers

Service data - your account, business content and your customer records - is stored in the European Union (Ireland). Some of our providers, including Paddle and certain support and monitoring tools, may process limited data outside the UK and EEA. Where that happens, the transfer is covered by an adequacy decision or by the UK and EU Standard Contractual Clauses together with appropriate additional safeguards.

7. How long we keep it

• Account and business content: for as long as your account is open, and then deleted or anonymised within 90 days of account closure, unless you ask us to delete it sooner.
• Customer records you entered: deleted with your account on the same 90 day timetable, or immediately when you delete them inside the app.
• Billing, invoicing and tax records: retained for 7 years to meet UK and Irish accounting and tax requirements.
• Support correspondence: up to 3 years from the last contact.
• Security and access logs: up to 12 months.
• Marketing contact records: until you withdraw consent or object, and then suppressed so we do not contact you again.

8. Your rights

Under UK and EU data protection law you have the right to access your personal data, to have inaccurate data corrected, to have data erased, to restrict or object to processing (including to direct marketing at any time), to data portability, and to withdraw consent where processing is based on consent. Email privacy@tap-quote.com and we will respond within one month. You may also complain to a supervisory authority - the UK Information Commissioner's Office (ico.org.uk) or the Irish Data Protection Commission (dataprotection.ie).

9. Security

We apply appropriate technical and organisational measures, including encryption in transit (HTTPS/TLS) and at rest, row-level security in the database so that records are readable only by the business account that created them, hashed passwords, least-privilege access controls for administrators, and logging and monitoring. No system can be guaranteed completely secure, but we review these measures regularly and will notify you and the relevant regulator of a qualifying personal data breach without undue delay.

10. Cookies

We use strictly necessary cookies and local storage to keep you signed in, keep your session secure and remember basic preferences - these are required for the service to work. We use limited analytics cookies to understand aggregate usage, and our payment provider sets cookies during checkout for fraud prevention and payment processing. We do not use advertising cookies. You can block or delete cookies in your browser settings, but strictly necessary cookies cannot be turned off without breaking sign-in.

11. Children

TapQuote is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.

12. Changes to this notice

If we make a material change we will tell you by email or in the app before it takes effect. The date below shows when this notice was last updated.

13. Contact

Jack Tyrrell, trading as TapQuote. Email privacy@tap-quote.com for any privacy question or to exercise your rights. For questions about a payment, an invoice or a refund, contact Paddle at paddle.net.