Privacy Policy

Last updated: May 2026

Who we are

TapReceipt is operated by Fordify Limited. If you have any questions about this policy, contact us at fordifylimited@gmail.com.

What data we collect

• Your email address - only if you choose to receive a digital receipt. You are never required to provide it.
• Your purchase details - item names, quantities, total amount, and date/time of transaction, provided by the retailer's point-of-sale system.
• A device identifier - a cookie stored on your device so that future taps at the same shop can send your receipt automatically without re-entering your email.

Why we collect it

• To email you a copy of your receipt when you request one.
• To recognise your device on future visits so receipts are sent automatically (only if you opt in).

How long we keep it

We only keep your personal data for as long as we need it. Specific retention periods are:

• Customer email and device link: 2 years after your last activity. After this we automatically delete your record. You can request earlier deletion via the Settings page on any receipt.
• Receipt records: 7 years (required for UK accounting and tax records). After 2 years your email address is automatically removed from the receipt record, leaving only anonymised transaction data.
• Consent records: 2 years from the date the consent was given, to demonstrate compliance with UK GDPR Article 7.
• Marketing email log: 2 years, then automatically deleted.
• Webhook logs (technical): 6 months, or the most recent 100 entries per merchant, whichever is shorter.
• If you delete your account or unlink your device, your personal data is removed immediately. Receipt records are anonymised but retained for accounting purposes.

Who we share it with

We do not sell your personal data. We share it only with the retailer whose till you tapped, and with the trusted service providers (sub-processors) we use to operate TapReceipt:

• Hetzner Online GmbH (Germany) — hosting and data storage
• Postmark / ActiveCampaign (USA, GDPR Standard Contractual Clauses) — transactional email delivery (receipts, password resets, welcome emails)
• Square, Inc. (USA) — receives sale events when a connected merchant uses Square POS
• iZettle / PayPal (Sweden / Luxembourg) — receives sale events when a connected merchant uses Zettle
• SumUp Ltd (UK / Ireland) — receives sale events when a connected merchant uses SumUp
• Lightspeed Commerce (Canada) — receives sale events when a connected merchant uses Lightspeed POS

All sub-processors are bound by written data processing agreements that require them to handle your data only on our instructions and to keep it secure. They process data on our behalf and are not permitted to use it for their own marketing or other purposes.

We may also disclose your data where required by law, by a court order, or to protect our legal rights.

Your rights (UK GDPR)

Under UK GDPR you have the following rights:

• Right to be informed — you can read this Privacy Policy at any time.
• Right of access — you can request a copy of the data we hold about you. Use the Settings page on any receipt or email us.
• Right to rectification — if any of your data is inaccurate, you can ask us to correct it.
• Right to erasure ('right to be forgotten') — you can delete your data at any time using the Settings page on any receipt, or by emailing us.
• Right to data portability — you can download your data in a machine-readable format from the Settings page.
• Right to restrict processing — you can ask us to stop using your data while we deal with a request.
• Right to object — you can opt out of marketing at any time. Unlink your device in Settings or click "unsubscribe" in any marketing email.
• Right to lodge a complaint — you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

To exercise any of these rights, tap Settings on any TapReceipt page, or email fordifylimited@gmail.com.

Cookies

We use a single functional cookie (tapslip_device) to link your device to your email address. This cookie is strictly necessary to provide the service and does not track you across other websites.

Changes to this policy

We may update this policy from time to time. The date at the top of this page will always show when it was last changed.