Last updated: 19 October 2026
TAPPI runs no advertising cookies, no tracking pixels and no cross-site tracking. There is no Google Analytics, no Meta pixel, no Hotjar, no ad network and no cross-site profiling on this site. Page views on our public pages are counted by Vercel Web Analytics, which sets no cookie and stores nothing on your device (section 5). The complete list of what we do set is below — it is short on purpose.
Anything that is not strictly necessary waits for your consent. Our banner gives "Accept" and "Reject" the same size and weight, because refusing should be no harder than agreeing. You can change your mind any time with Cookie settings in the footer.
These are set without consent because the site cannot work without them. Under UK PECR regulation 6 and Spanish LSSI article 22.2 they are exempt.
| Name | What it does | Lasts |
|---|---|---|
| tappi_consent | Records whether you accepted or rejected. Without it we would ask you on every page. | 6 months |
| sb-… (Supabase) | Keeps you signed in and protects against cross-site request forgery. Only set once you log in. | Session, refreshed while you stay signed in |
| tappi_app_lang | Remembers which language you chose for your dashboard. Unlike the preferences in section 3, this one is a cookie and our server reads it, because the page is put together in your language before it reaches you. Only set once you log in or pick a language. | 1 year |
| tappi_org | Remembers which account your dashboard shows, if your login can open more than one (for example a partner who looks after several businesses). Only set when you switch account, and checked against what you may open on every page. | 1 year |
| tappi_partner_join | Carries what you typed on the TAPPI Partners sign-up form (your name, email, phone and language) to the step where you type the code we email you, so you don’t type it twice. Signed and readable only by our server. Only set while you join as a partner. | 30 minutes |
| tappi_site_lang | Remembers that you have seen our public site, and in which language. The first time someone opens a Spanish page from a country where Spanish is not spoken, we show the version in that country’s language if our site has one (German in Germany, for example), or the English version otherwise; this cookie is what stops us doing it again, so the language you pick in the language menu stays put. It holds a language, never your country or location. | 1 year |
| tappi_active_location | Remembers which of your venues you are looking at in the dashboard. Only set once you log in. | Until you change it |
| tappi_till_ask | Remembers that you pressed "Not now" when your dashboard asked which till you use, so it stops asking on this browser. It holds your account’s ID and nothing else. Only set if you press it. | 1 year |
| Cloudflare Turnstile | An anti-bot check on the contact and partner application forms, the email step of the loyalty-programme designer, and the website assistant. Set only when you open a form or the assistant. | Minutes, per challenge |
| Name | What it does | Lasts |
|---|---|---|
| tappi_ref | If you arrived through a TAPPI Partner’s referral link or QR code, this remembers their code and the date of that first visit, so the partner gets credit if you get in touch or create an account. Set by our server, never by a script on the page. Only the first partner’s code is kept. | 90 days |
That is the entire consent-required list: one item, one purpose. If you reject, or later withdraw, we delete it. A referral code that arrives before you have answered is held for that browser tab only and discarded if you say no.
These are not cookies, and they are written only because you asked for a setting or used a feature. Apart from the assistant’s conversation, described below, they never leave your browser.
| Name | What it does | Lasts |
|---|---|---|
| tappi-theme | Your light or dark mode choice. | Until you clear site data |
| tappi-chat | Keeps your conversation with the website assistant while the tab is open, so it survives moving between pages. | Until you close the tab |
| tappi-currency | Which currency you asked to see prices in on the pricing pages. | Until you clear site data |
| tappi-partner-academy | For TAPPI Partners: which modules of the partner academy you marked as done. It holds the modules’ names and nothing else, and it stays on this device. | Until you clear site data |
| tappi-quiz | Keeps your answers to "Design your loyalty programme" (/start) while the tab is open, so a reload does not lose them, and once you finish, which result to show (with your country’s two-letter code if we do not work there yet). It never holds the email, name or phone you type. | Until you close the tab |
One thing to be precise about with tappi-chat: the stored copy stays in your tab, but each message you send is transmitted together with the conversation so far — to us, and on to the AI provider that generates the reply, listed on our sub-processor page. We do not keep the conversation after the reply is sent; what we record is a count of messages and what they cost us. Close the tab, or use "Start again" in the assistant, and the stored copy is gone.
And with tappi-quiz: each answer is also sent to us as you go, without your name, email or IP address, so we can see which questions people stop at. Your email reaches us only if you choose to have your programme sent to you.
We run Sentry to catch errors so we can fix them. It is configured with personal-data collection switched off and session replay disabled — it does not record your screen, your IP address or your inputs. It reports the error, the page it happened on and your browser version.
We treat this as strictly necessary security and availability monitoring rather than tracking. It is the one judgement call on this page, and we would rather tell you about it than leave it out.
On our public pages — the home page, pricing, partners, the loyalty quiz, trust, support and these legal pages — we count page views with Vercel Web Analytics and measure page speed with Vercel Speed Insights. Vercel already hosts this site (it is on our sub-processor list). Neither sets a cookie, neither stores anything on your device, and neither can follow you to another site: a visit is told apart from the next by a hash that changes every day and cannot be turned back into you.
What they receive is the page path, the page you came from, your country, and your device and browser class. The query string is stripped before it is sent, so a partner code, a sign-in token or a language choice in the address never leaves your browser. The signed-in dashboard and every page that belongs to a venue or to one customer — the tap page, wallet cards, menus, gifts, rewards — are never counted at all.
Because nothing is stored on your device, UK PECR regulation 6 and Spanish LSSI article 22.2 do not apply to it and we do not ask for consent. We list it anyway: a counter you did not know about is still a counter.
A few signed-in screens (in the dashboard and the partner portal) load map images from OpenStreetMap, CARTO and OpenFreeMap. When a map loads, your browser contacts those services directly and they see your IP address. They are independent of us and none of your customers' data is sent to them.
Booking a call on the home page shows Calendly’s calendar inside our page. Calendly is independent of us: when the calendar loads it can set its own cookies and ask for your consent to them in its own banner. It loads only when you open the booking window.
Wallet passes are held by Apple and Google in your phone's wallet app, under their own terms — nothing on this website controls that.
If we add anything that sets a cookie, this page changes in the same release. Questions: hello@thetappi.com. For what we do with personal data more generally, see the privacy policy.