Where your data lives
Your account and your customers’ records are stored in the European Union. The database is in Ireland. The application functions that read and write it run in Dublin. Neither is a default we inherited — both are pinned in configuration.
A few providers process elsewhere for a narrow job: sending email, monitoring errors, issuing wallet passes, and the scheduler that triggers our own background tasks. Each one is named on the sub-processor page, with where it processes and what covers the transfer.
- Database: Ireland (eu-west-1)
- Application functions: Dublin (dub1)
- Every sub-processor published, with location and safeguard
- A published list beats a promised one — check ours against any competitor’s
What your customers can ask for — and what you can do about it
Your customers have rights over their data, and you are the one who has to answer them. Answering should not mean opening a support ticket with your software vendor and waiting.
Every right below is a button in your dashboard, not a request form to us.
- Export one customer’s complete record
- Correct details that are wrong, with the change written to the activity log
- Restrict processing while a dispute is open (Article 18)
- Erase or anonymise — which also revokes their wallet passes, unregisters the device from notifications and cleans up the payment records
- A suppression list, so an erased customer cannot be quietly re-created by a CSV import
- Retention you choose — never, 12, 24 or 36 months — enforced nightly, automatically
Cookies and tracking: there aren’t any
No Google Analytics. No Meta pixel. No Hotjar. No ad network. No cross-site profiling. Page views on the public site are counted by Vercel Web Analytics with no cookie and nothing stored on your device. Read our cookie policy and count them — the consent-required list is one item long, and it exists so a partner who referred you gets credit.
Our consent banner gives “Accept” and “Reject” the same size and weight, because refusing should be no harder than agreeing. Most banners do not, and the ones that do not are telling you something.
Who can see your data — including us
Most data leaks are not break-ins. They are too many staff with too much access, shared logins, an export nobody remembers, or a former employee who was never removed.
So the controls that matter are the boring ones:
- Row-level isolation in the database between businesses, with automated cross-tenant tests in CI
- Per-permission staff roles — adjusting a balance and touching billing are separate grants
- Two-factor sign-in: every login except a staff login can add an authenticator app, and from then on every sign-in asks for its code. The owner can require one of every owner, admin and location manager
- An append-only activity log you can read and filter, with CSV export
- When we support you, our access is read-only. We do not sign in as you.
- That support access needs multi-factor authentication with a fresh check on every page that shows data, and every view is written to an audit ledger
- A team access review screen, so you can see who has what and remove it
Money
When your customer tops up a balance or buys a gift card, the payment runs on your own connected Stripe account. The money is yours and never passes through ours.
Prepaid balance is real money that someone handed you, so it is treated like it:
- Balance tables are read-only to ordinary sessions; every write goes through a reviewed server-side path
- Chargebacks and fraud warnings reverse the balance and freeze the card automatically
- Manual adjustments are capped, require a written reason, and each one is recorded in the activity log
- If you close a programme, it winds down open-ended: customers spend what they paid for, with no deadline, and the programme closes itself only once every balance is zero
- The security work behind this started with a written threat model of 25 findings. The fixes were tested against a copy of the production schema before anything shipped.
Who you are actually dealing with
Some loyalty vendors resell someone else’s platform under their own brand. That is not automatically wrong, but it means another company you were never told about is processing your customers’ data — and that company decides how fast a security issue gets fixed.
TAPPI is built and operated by us. There is no white-label platform behind it, no hidden processor in the chain. The sub-processor list is the whole list.
What we have not built yet
This is the section most vendors leave out, which is exactly why it is here. If a supplier cannot tell you what their gaps are, they either do not know or will not say.
- Two-factor does not cover staff logins. Staff sign in with the login and password the owner sets, so give each one only the permissions they need.
- The database does not check two-factor yet. The dashboard and our API ask for the code; the database’s own access rules do not yet, so change a leaked password straight away.
- The TAPPI Business phone app, used to set up chips, does not ask for the two-factor code yet.
- No independent penetration test. We have threat-modelled our own money paths and fixed what we found; nobody external has been paid to break in.
- No ISO 27001 or SOC 2 of our own. Our infrastructure providers hold theirs — that is theirs, not ours, and we will not present it as if it were.
- Some third-party connection tokens are not encrypted at the application layer beyond the database’s own encryption.
- Deployed NFC chips are not write-protected yet. Someone with an NFC phone and physical access can rewrite a chip to point elsewhere. They cannot read your data or reach your account.
- No contractual uptime guarantee. There is a status page; there is not yet an SLA.
- No ICO registration and no VAT registration yet. The company, TAPPI Technologies Ltd, was formed on 24 September 2026 (England and Wales, no. 17478870); registering with the UK data-protection regulator is the next filing, and this line moves when it is done.
The documents
Not a sales summary of the documents — the documents. Every one of these is live, dated, and links to the others.
- Privacy policyWhat we do with personal data, our lawful basis for each use, how long we keep it and your rights.
- Cookie policyEvery cookie and storage item we set, itemised. No advertising cookies, no tracking pixels, no cross-site tracking; page views counted without cookies.
- Terms of serviceThe agreement between TAPPI and the business using it. Plans, billing, cancellation, liability.
- Data processing agreementOur Article 28 agreement. Applies automatically from signup — nothing to sign, countersigned copy on request.
- Sub-processorsEvery third party that can touch your data, what it does, where it processes and under what safeguard.
- SecurityWhat protects your data, what we have not built yet, and how to report a vulnerability.
- Acceptable use policyWhat you may not do with TAPPI, and what happens if you do it anyway.
- Website terms of useThe terms for browsing thetappi.com, separate from the service agreement.
- AccessibilityWhat we do, what is known to fall short, and how to tell us about a barrier.
- Aviso legalQuién es el titular de thetappi.com: datos identificativos de la sociedad conforme al artículo 10 de la LSSI. En español.
- Mobile app privacyThe TAPPI Business app for encoding NFC chips, and what it does and does not collect.
Questions worth asking any loyalty vendor
Ask these of us, and of everyone else you are considering. The useful part is not our answers — it is comparing how easily each vendor can give theirs.
Do you provide a data processing agreement?
Yes, published, and it applies from signup without anything to sign. Countersigned copy on request.
Can I see your current sub-processor list?
Yes — it is a live page, not a schedule in a PDF. Check that any vendor’s link actually resolves.
How much notice before you add a sub-processor?
30 days, with a right to object and to leave if we cannot resolve it.
Where is my customers’ data stored?
Ireland, with functions in Dublin. Both pinned, not defaults.
Can my customers’ data leave the EU?
Only for the narrow purposes listed on the sub-processor page, each with a named safeguard.
How is consent recorded?
Per channel, with an append-only consent log, written in one atomic statement so concurrent changes cannot drop an entry.
Are email, push and tracking consent separate?
Yes, and joining a programme does not imply marketing consent.
Can I export one customer’s data?
Yes, from the dashboard, without contacting us.
Can I erase one customer?
Yes — and it revokes their wallet passes, unregisters push, and cleans up payment records rather than leaving orphans.
What stops an erased customer being re-imported?
A hashed suppression list scoped to your business.
How long is customer data kept?
You choose: never, 12, 24 or 36 months. A nightly job enforces it.
Can staff be stopped from seeing everything?
Yes. Permissions are granular and there is an access-review screen.
Are staff actions and exports logged?
Yes, to an append-only ledger you can read, filter and export.
Can your team see my data?
Read-only, MFA-gated with a step-up check on each page, never as an impersonated session, and every view is logged.
What happens when I cancel?
A 30-day grace period in which you can export everything and reopen, then deletion. Customer money is refunded or wound down first.
What is your breach process?
You are told within 48 hours of us becoming aware. You decide on regulator and customer notification, as controller.
Have you had a penetration test?
No — and you should ask every vendor this, because the honest answer is more useful than the flattering one.
Do you own the platform, or resell someone else’s?
We build and run it. No white-label, no hidden processor.
What can I not do with your product?
Read the acceptable use policy. It bans paying for reviews in any form, asking only the customers you expect to be happy, cherry-picking reviews and fake ones. Our own review page asks nobody for a rating first and gives nothing in return for a review. A vendor with no clear limits on review incentives or on unpaid gift cards has thought less about this than you have.
What have you not built yet?
See the section above. If a vendor has no answer to this question, that is the answer.
Something here not good enough?
Tell us. A gap you point out is worth more than a compliment. Security issues have their own route on the security page.