Privacy Policy
Effective 1 November 2026
This policy explains what personal information [Your company name (Pvt) Ltd] (“we”) handles when you use TapTruly, why, and your rights. Questions: privacy@taptruly.com.
Two kinds of information
- Account information about the people who use TapTruly (business owners and their teams). For this we are the controller.
- Feedback information that businesses collect from their own customers through TapTruly: ratings, comments and, if the business adds them, the customer’s email, the agent’s name and a ticket number. For this the business is the controller and we are its processor: we use it only to provide the service to that business. If you rated a business and have a question, please contact that business.
What we collect
- Account details: name, email, business name, team roles, and your settings.
- Billing details: billing name, address, phone and company details. Card details are handled by PayHere or Stripe; we never see or store full card numbers.
- Feedback: ratings, comments, selected reasons, and the details a business includes in its links.
- Security and technical data: sign-in events, a record of important account changes, and a one-way scrambled (hashed) version of IP addresses used for spam and abuse protection. We don’t store raw IP addresses for ratings.
Why we use it
- To provide TapTruly: collecting ratings, showing reports, sending alerts and reports you ask for (performing our contract with you).
- To keep the service secure and stop fraud, spam and fake ratings (our legitimate interest).
- To take payments and keep financial records (legal obligation and contract).
- To tell you about important changes to the service. We don’t sell personal information, and we don’t use it for advertising.
AI summaries
Only if a business owner turns them on: comments are sent to Anthropic (Claude) to create a summary for that business, with email addresses and phone numbers removed first. Anthropic doesn’t use this data to train its models.
Who we share it with
We use these service providers, under contracts that require them to protect the data:
- Supabase: Database, sign-in and file storage (Region you choose (e.g. Singapore))
- Vercel: Hosting the website and app (Global)
- Resend: Sending emails (alerts, reports, sign-in) (USA)
- PayHere: Card and mobile payments in LKR (Sri Lanka)
- Stripe: Card payments in USD (USA / Ireland)
- Anthropic (Claude): AI summaries, only if a business turns them on (USA)
Some providers are outside Sri Lanka. Where data is transferred abroad, we rely on the safeguards required by law. We may also share information if the law requires it.
How long we keep it
- Account and feedback data: while the account is open. Owners can delete a customer’s data, or the whole account, at any time from Settings.
- Unconfirmed clicks (for example from email scanners): deleted after 30 days.
- Billing records: as long as tax law requires (usually up to 7 years).
- Backups are overwritten on a rolling basis, so deleted data disappears from them within about 30 days.
Security
Data is encrypted in transit, every business’s data is kept separate by database rules, sensitive keys are stored encrypted, and team members can protect their accounts with two-step verification.
Your rights
You can ask to access, correct or delete your personal information, object to or limit how we use it, or withdraw consent where we rely on it. Email privacy@taptruly.com; we reply within one month. If you’re not happy with our answer, you can complain to the Data Protection Authority of Sri Lanka.
Cookies
We only use cookies needed to keep you signed in and secure, and to remember which business you’re working in. We don’t use advertising or tracking cookies. The website may remember in your browser that you’ve closed a promotion.
Changes
We’ll post changes here and tell account owners about important ones.
Contact
[Your company name (Pvt) Ltd], [Registered address], Sri Lanka. Privacy questions: privacy@taptruly.com.