Acceptable use policy

• fraud, money laundering, handling the proceeds of crime, or identity theft;
• breaching consumer protection, data protection, electronic marketing, gambling, financial services or product safety law;
• breaching sanctions, or dealing with a sanctioned person or territory;
• hosting or distributing unlawful content.

You may not:

• run a programme designed to mislead — promising a reward you do not intend to honour, or changing the rules retroactively so an earned reward disappears;
• artificially generate or inflate stamps, points, visits, balances or rewards, whether to flatter your own numbers or to extract value;
• refuse to honour prepaid balance or a gift card a customer has paid for, including after you stop using TAPPI;
• apply an expiry to money a customer has paid you where the law does not allow it;
• set up a programme that is really a deposit-taking, e-money or investment product;
• collect customer data through a card for a purpose unrelated to running the programme;
• impersonate another business or brand, or run a programme that could put our Apple or Google Wallet credentials at risk.

Your TAPPI review page treats every customer the same: everyone gets the button to write a public review and the option to send you a private message, and nobody is asked for a rating first. TAPPI offers no reward for a review and has no rating filter. The way you ask for reviews has to meet the same standard. You may not:

• ask customers how they rate you before deciding whether to invite a public review, or invite only the customers you expect to be happy — whether through TAPPI, a sign, a staff script, another tool or any other means;
• offer or give anything in return for a review — a discount, stamp, points, gift, cashback or prize-draw entry — whatever the review says;
• discourage a customer from leaving a public review, tell them they cannot leave one, or present the private message as a replacement for it;
• suppress, conceal or cherry-pick negative reviews, or present a selection of reviews on your own site as though it were your complete public rating;
• write, buy, commission or solicit fake reviews, including reviews from staff, friends or anyone posing as a customer.

Review platforms have their own rules, Google's included, and you must follow those as well.

You may not:

• send marketing to someone who has not given valid consent where consent is required, or who has opted out;
• ignore an unsubscribe, or make opting out harder than opting in;
• disguise a marketing message as a transactional one;
• send harassing, abusive, threatening or deceptive messages;
• import a customer list you did not collect lawfully. Putting a list into a compliant system does not make an unlawfully collected list lawful.

• do not collect, store or share personal data without a lawful basis;
• do not use TAPPI to profile people in ways your own privacy notice does not disclose;
• do not infringe anyone’s copyright, trade marks or other intellectual property in the content you upload — card artwork included;
• do not disclose confidential information you are not entitled to share.

• no probing, scanning or testing the security of our systems without authorisation — our security page tells you how to do it with authorisation;
• no action that degrades the service for other users;
• no accessing accounts, data or systems you are not authorised to reach;
• no bots or scrapers, except through our published API;
• no reverse engineering, decompiling or disassembling the service;
• no reselling or sublicensing access without our written agreement;
• no malware, phishing kits or denial-of-service tooling.

That includes everything your staff do with the logins you create, and everything done through an API key you issue. Remove access when someone leaves.

We may — but are not obliged to — monitor use of the service to check compliance and investigate suspected breaches. Where we find one, we act proportionately:

• Warning. For a minor or first breach, written notice and a period to put it right.
• Suspension. For a repeated or more serious breach, temporary suspension while we investigate.
• Termination. For a severe or persistent breach, we end the agreement. Where customers hold prepaid balance or unredeemed gift cards, we will try to give them a route to their money first — but that obligation is yours, not ours.
• Removal. We may remove or disable content, cards or programmes that breach this policy, with or without notice.
• Reporting. We may report a breach to the police, a regulator or an affected third party where that is appropriate.

If you think someone is misusing TAPPI, tell us at hello@thetappi.com with as much detail as you can. Security vulnerabilities go to our security page instead.

We may update this policy. Where a change is material we give at least 30 days' notice where practicable.