Privacy notice

Last updated: October 2026. This explains what Tap & Smile does with personal data under UK GDPR and the Data Protection Act 2018.

Who we are

Tap & Smile is a small business based in Chichester, West Sussex, UK. We are the controller of the data described below. Contact: info@tapandsmile.co.uk.

If you tap or scan one of our cards

• What happens: your phone opens a link on our website, which sends you straight to the business's Google, Instagram, WhatsApp or other page. To do this your IP address and browser type reach our server, as with any website.
• What we keep: a daily total of taps and clicks for the business. To avoid counting one visit twice we also create a one-way scrambled code from your connection and browser. It changes every day, cannot be turned back into your IP address, and is deleted within 24 hours. We do not store your IP address and we do not build profiles.
• Why (lawful basis): legitimate interests. The business needs to know whether its cards work, and this is the least intrusive way to count.
• Cookies: none for visitors. Our pages may remember on your device only that you closed the "add to home screen" tip. If you sign in to edit your own business card, we set one essential cookie that keeps you signed in for 6 hours. It is not used for tracking or advertising.
• Who sees it: our hosting provider Cloudflare handles requests on our behalf and may keep standard security logs. Once you reach Google, Instagram, WhatsApp or another site, its own privacy policy applies.

If you are a business that uses our cards

• We store your business name, your links, your logo and, if you want weekly summaries, a contact email address. If you give a card a name, such as a place or a team member's first name, that name appears in your own results panel. We use these to provide the service you asked for (contract) and to email you your weekly results.
• Your results panel opens with a private code or link that we give only to you. Daily tap totals are kept while you are a customer.
• You can stop the weekly email at any time with the link at the bottom of each email. We keep your details while you are a customer and delete them when you ask. When a business is removed, its details and totals are kept for 20 days in case it was a mistake, then permanently deleted.
• If we make you a digital business card, we store the name, photo, up to three extra photos with short captions, WhatsApp number, workplace and links you give us. They are shown publicly on your card page, so only give us what you are happy to show. We only receive the photos you choose to upload. We never get access to your photo library, camera roll or location, and we remove hidden data such as location from the photo before we save it. You can remove your photo at any time. Card pages ask search engines not to list them. You can change your card yourself with a private password, or ask us to change or delete it. If you add an email address for weekly card numbers, we use it only to send them and you can stop them at any time. If a wrong code is entered we keep a one-way scrambled code of the connection and a count for up to 24 hours, then delete it, to stop guessing.
• To stop people guessing panel codes, if a wrong code is entered we keep a one-way scrambled code of the connection and a count for up to 24 hours, then delete it. If it is locked we may open WhatsApp so you can message us.
• Emails are sent through Resend. Questions and support requests that you send us on WhatsApp are handled through WhatsApp.

Where data goes

Cloudflare and Resend process data on our behalf and may do so outside the UK, with the safeguards required by UK law. We do not sell data and we do not use it for advertising.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict it or to object to how we use it. Email info@tapandsmile.co.uk. Because tap counters do not identify anyone, we usually cannot find an individual visitor in them. If you are unhappy with how we handle data, please tell us first at the address above and we will acknowledge your complaint within 30 days. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.