← Back

Privacy Policy

Last updated: May 2026

Who we are

TapReceipt is operated by Fordify Limited, registered with the UK Information Commissioner’s Office (ICO) as a data controller under registration number ZC164260. If you have any questions about this policy, contact us at info@tapreceipt.co.uk.

What data we collect

• Your email address - only if you choose to receive a digital receipt. You are never required to provide it.
• Your purchase details - item names, quantities, total amount, and date/time of transaction, provided by the retailer's point-of-sale system.
• Review-card taps - some businesses use a TapReceipt card that opens their Google review page instead of a receipt. When you tap one of these we record only the date, time and which card was tapped, so the business can see how often the card is used. No details about you or your device are collected, and nothing is stored on your phone.
• A device identifier - a cookie stored on your device so that, if you choose “Save my email to this device”, future taps at any shop using TapReceipt can send your receipt automatically without re-entering your email. Marketing permission is separate and is per shop.

Why we collect it

• To email you a copy of your receipt when you request one.
• To recognise your device on future visits to any shop using TapReceipt so receipts are sent automatically (only if you choose to be remembered; you can unlink the device at any time from Settings).

How long we keep it

We only keep your personal data for as long as we need it. Specific retention periods are:

• Customer email and device link: 2 years after your last activity. After this we automatically delete your record. You can request earlier deletion via the Settings page on any receipt.
• Receipt records: 7 years (required for UK accounting and tax records). After 2 years your email address is automatically removed from the receipt record, leaving only anonymised transaction data.
• Consent records: 2 years from the date the consent was given, to demonstrate compliance with UK GDPR Article 7.
• Marketing email log: 2 years, then automatically deleted.
• Webhook logs (technical): 6 months, or the most recent 100 entries per merchant, whichever is shorter.
• If you delete your account or unlink your device, your personal data is removed immediately. Receipt records are anonymised but retained for accounting purposes.

Who we share it with

We do not sell your personal data. We share it only with the retailer whose till you tapped, and with the trusted service providers (sub-processors) we use to operate TapReceipt:

• Hetzner Online GmbH (Germany) — hosting and data storage
• Postmark / ActiveCampaign (USA, GDPR Standard Contractual Clauses) — transactional email delivery (receipts, password resets, welcome emails)
• Square, Inc. (USA) — receives sale events when a connected merchant uses Square POS
• iZettle / PayPal (Sweden / Luxembourg) — receives sale events when a connected merchant uses Zettle
• SumUp Ltd (UK / Ireland) — receives sale events when a connected merchant uses SumUp
• Lightspeed Commerce (Canada) — receives sale events when a connected merchant uses Lightspeed POS

All sub-processors are bound by written data processing agreements that require them to handle your data only on our instructions and to keep it secure. They process data on our behalf and are not permitted to use it for their own marketing or other purposes.

We may also disclose your data where required by law, by a court order, or to protect our legal rights.

Your rights (UK GDPR)

Under UK GDPR you have the following rights:

• Right to be informed — you can read this Privacy Policy at any time.
• Right of access — you can request a copy of the data we hold about you. Use the Settings page on any receipt or email us.
• Right to rectification — if any of your data is inaccurate, you can ask us to correct it.
• Right to erasure ('right to be forgotten') — you can delete your data at any time using the Settings page on any receipt, or by emailing us.
• Right to data portability — you can download your data in a machine-readable format from the Settings page.
• Right to restrict processing — you can ask us to stop using your data while we deal with a request.
• Right to object — you can opt out of marketing at any time. Unlink your device in Settings or click "unsubscribe" in any marketing email.
• Right to lodge a complaint — you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113. Our ICO registration number is ZC164260.

To exercise any of these rights, tap Settings on any TapReceipt page, or email info@tapreceipt.co.uk.

Cookies

Cookies we set, all strictly necessary and none used for tracking or advertising: tapslip_device (customer receipt pages — links this device to your email if you choose to be remembered; 12 months); a merchant session cookie (dashboard login; 30 days); an admin session cookie (our staff login; 30 days); and a short-lived cookie used only while completing two-factor sign-in. We do not use analytics or advertising cookies.

The device cookie (tapslip_device) links your device to your email address. This cookie is strictly necessary to provide the service and does not track you across other websites.

Changes to this policy

We may update this policy from time to time. The date at the top of this page will always show when it was last changed.