Privacy Policy

Tapname.io provides digital visiting cards and a directory of people’s offerings. This notice covers account holders, people browsing cards and listings, and people making reports.

Service

Tapname.io

Legal operator

Computer Port IT Solutions

Registered address

#126, Second Floor, Jaya Mansion, Near Park Lane, SD Road, Secunderabad, Telangana 500003

GSTIN

36AAIFC0167A1ZZ

Phone

+91 91009 61982

Grievance officer

Mr. Ravi Kumar Tenneti

Officer contact

ravikumar@computerport.in

For privacy requests, complaints or questions, email hello@tapname.io or use the details on our contact page. Include the relevant card or listing link and enough detail to understand your request. Never send a password, sign-in code or payment credentials.

• Account and sign-in: your name, email, password hash if you use a password, verification records, account settings, session identifiers and expiry. These operate and protect your account. If you choose provider sign-in, we store its account identifier and the identity details it supplies.
• Your card: contact fields, their audiences, About text, links, uploaded pictures, layout choices and saved versions. These let you create, edit and publish your card. Upload records include file size, dimensions and crop information.
• Your listings and preferences: offering text, category, location, optional price note, contact-channel choices, followed categories and saved listings. These run the directory and personalise your feed.
• Reports and support: the listing, reason and note you report, your account identifier if signed in, and moderation decisions. These help investigate misuse. Messages you email us are used to respond.
• Organisation features, where used: membership, role, department, work details and invitations. These support the organisation’s cards and access settings.
• Billing, where used: payment-provider references, status and received event records. These support configured payment services and record keeping. NFC purchases are handled through the hosted payment page and manual fulfilment. An administrator records the unique payment id, rupee amount, term, optional note, recording operator and time, and any recorded refund. Reminder records store their schedule and attempted/successful delivery state.

We process the information you provide to supply the features you choose, protect the service and handle complaints or legal requirements. Publishing a card or listing makes its public content available to others. Do not upload information you have no right to share.

Standard card fields including name, title, email, phone, address, pronouns, About, WhatsApp, websites and social links default to Everyone. A personal address and custom fields default to the narrower audience. Review each field’s audience before publishing.

Signed in means members of the same organisation, not every account on the site. Only me also allows the organisation’s administrators under the current access rules. Authorised platform administrators can access stored card details for administration and manual NFC fulfilment. A field withheld from a viewer is excluded before the page is served.

Directory contact buttons request a contact value separately; phone numbers from card fields are not embedded in directory pages. Details you type into public listing text are still public. The public card and its contact download include the fields you make public.

Processed images may be publicly retrievable by their image URLs. People can copy public pages or save a contact file. Changing or deleting your account cannot recall copies or contacts already saved on someone else’s device.

We count card and offering opens, QR scans and NFC taps, contact-file downloads, outbound link clicks and directory contact-button taps. A download is not proof that a contact was saved; a contact tap is not proof of a conversation.

These activity records contain the card or offering, action, time, public or colleague audience, coarse country when available, and device class. They do not contain a visitor identifier, raw IP address or raw browser user-agent string. The browser string is classified in memory for these counts.

Security is separate: requests expose network and browser information to the server. Abuse prevention uses hashed network or account identifiers and counters; session records can include hashed network/browser signals where supplied. Operational logs may include account identifiers and errors. This is not a promise that hosting or network providers keep no connection logs.

No advertising or third-party analytics scripts are integrated in the current site. Our own counting pixels do run on card and offering pages.

The application uses cookies for sign-in and its security checks, not advertising. Production sign-in cookies are HttpOnly and Secure, with SameSite=Lax. You can block or remove them in your browser, but sign-in may stop working.

__Host-obverse_session

Keeps you signed in. The cookie lasts up to 30 days. The server ends an inactive session after 7 days and requires sign-in again after at most 30 days.

obverse_oauth_state

Checks that a Google or Microsoft sign-in callback belongs to your browser. Expires after 10 minutes and is cleared when the callback is handled.

obverse_oauth_verifier

Protects the provider sign-in exchange. Expires after 10 minutes and is cleared when the callback is handled.

tapname_card_return

Returns you to the requested card after provider sign-in. Expires after 10 minutes and is cleared when consumed.

The dashboard stores your sidebar width in your browser as obverse.sidebar-width. It is a layout preference with no automatic expiry; clearing site storage removes it. External payment, sign-in and linked sites apply their own cookie policies.

The service runs on a hosting provider, and uploaded originals and processed image copies are kept in object storage.

When configured, Resend receives recipient addresses and message content for account verification, recovery, account notices and NFC renewal reminders. Google or Microsoft receives the sign-in request if you choose that offered provider; we receive basic account identity in return.

When NFC ordering is available, the dashboard opens a Razorpay Payment Page with your name, sign-in email, public phone number if available, and public card link in its URL. You enter shipping and payment information on that page. The NFC code is not sent by this link. Existing configured billing connections may also exchange payment references, status and event records.

Contact and social links open the services you select. Those providers receive information when you use their pages and handle it under their own policies. Information may also need to be disclosed in response to a valid legal requirement.

Card content and saved versions remain while your account uses them. There is no single automatic expiry for every kind of record.

For a personal account, sign in and open Account → Delete My Account, then type your sign-in email. If your account belongs to an organisation, its administrator must remove that membership first.

Deletion removes card versions and contact fields, directory entries, media records, view counts, interests, saved listings, sign-ins, linked provider accounts and recovery/verification records. Listings are removed; ordinary listing text is cleared. Stored-image deletion follows separately and may require a retry if storage fails.

Some records remain: the anonymised account and closed ownership records; reserved card addresses and retired QR/NFC codes; moderation evidence, including reported or moderated listing content; reports detached from the deleting reporter; and existing billing records. NFC payments retain only payment and financial/term snapshots after erasure: payer, recorder and refunder account links are detached and optional notes cleared; the ledger contains no copied name, email or card link. No fixed expiry for all of these retained records is currently implemented. Used card addresses and codes are never assigned to another person; after deletion they return Not found.

Deletion does not itself cancel an existing billing arrangement, resolve a purchase dispute or erase copies held by someone else. Ask us about retained records and backups; we do not promise immediate removal from every external copy.

Edit your card, its audiences, listings and account details through your dashboard. To request access, correction, completion, erasure, withdrawal of consent where consent applies, or nomination of someone to act in the event of death or incapacity, contact us below. Include your account email and the request, without sending credentials. We may need to verify that you are entitled to act for the account.

For privacy requests, complaints or questions, email hello@tapname.io or use the details on our contact page. Include the relevant card or listing link and enough detail to understand your request. Never send a password, sign-in code or payment credentials.

India’s DPDP notice and rights provisions have a phased commencement. Where those rights apply, you may use the Data Protection Board of India’s notified complaint procedure after first seeking grievance redressal with us. The official Act describes those rights. This page does not claim that an in-app export, nomination or consent-management workflow exists.

Withdrawing data needed to provide an account or feature can mean that it can no longer be provided. Legal retention and complaint records may still need to be kept.

The service is intended for adults aged 18 or older. We do not provide a parental-consent flow. Contact us if a child has supplied personal data so the situation can be reviewed.

Changes to this notice will be published here with an updated date. For content complaints and the applicable grievance process, see Terms → Complaints.