Privacy Policy

Last updated: 15 September 2026

TapYou is run by BSI3Q LLC (Brandon, Florida, USA). This page explains exactly what the service stores, why, and who else sees it. We do not sell personal information, we do not show advertising, and we do not track you across other websites.

If you have an account

We store:

• your email address and a securely hashed password (we never see the password itself);
• the display language you choose and which plan you are on;
• your Stripe customer reference, if you subscribe;
• everything you put on your cards: names, job title, company, short bio, address, phone numbers, email addresses, website, social handles, greeting, photo and logo.

Card content is deliberately public: anyone with your card’s link can read it. That is what a business card is for. Cards you have not published are visible only to you.

If someone opens your card

We record that the card was opened, how it was reached (QR code, NFC tag or link), which language the visitor’s phone was set to, and the country their request came from. We do not store IP addresses, and we do not place any tracking cookie on visitors. These counts feed the statistics the card owner sees.

If a visitor chooses to fill in “Share your contact back”, the name, email, phone and note they type are stored and shown to the card owner, who decides what to do with them. If the card owner has switched on the automatic greeting, we send that one email to the address given, and nothing further.

Photographs of paper cards

When you build a card from a photo, or scan a card someone handed you, the image is sent to Anthropic’s Claude API to read the text, then discarded. We never store the photograph. The text that comes back is shown to you for review before anything is saved.

Cookies

We use a session cookie to keep you signed in and a small preference cookie that remembers your display language. There are no advertising or analytics cookies.

Who else processes this data

• Supabase — database, sign-in and file storage;
• Vercel — hosting and delivery;
• Anthropic — reading card photos and drafting follow-up messages (content is not used to train their models);
• Resend — sending notification and greeting emails;
• Stripe — payments; card numbers go to Stripe directly and never reach our servers.

These providers process data on our instructions. Data is stored in the United States.

How long we keep it

Your account and cards stay until you delete them or close your account. Contacts in your inbox stay until you delete them; you can remove one or several at a time. Visit statistics are kept in an aggregated, non-identifying form. When you close your account we delete your cards, images and inbox.

Your rights

You can see and change everything on your card at any time, export your inbox as a CSV file, and ask us to delete your account. If you are in the EU, the UK, California or another place with data protection law, you also have the right to ask for a copy of your data, to correct it, to object to processing, or to complain to your supervisory authority. Write to info@bsi3q.com and we will answer within 30 days.

If someone shared their contact with a TapYou user and wants it removed, write to us and we will pass the request to that card owner, who holds the information.

Children

TapYou is a tool for working professionals and is not intended for children under 13.

Changes

If we change what we collect or who processes it, we will update this page and change the date above, and tell account holders by email when the change is significant.