Privacy Policy

1. Two different groups of people

TapReview involves two distinct relationships, and your rights differ depending on which one applies to you.

• Merchants — businesses that hold a TapReview account and place tap cards in their premises. Webinos decides how merchant account information is handled, so for that information Webinos is the organisation accountable to you.
• Customers — people who tap a merchant card and leave a rating or feedback. That feedback is collected for the merchant, on the merchant instructions. The merchant is the organisation accountable for it. Webinos stores and transmits it on their behalf and does not use it for its own purposes.

2. What we collect when you tap a card

No account is required and none is created. We collect only what you actively enter on the feedback screen:

• Your rating, from one to five stars. This is the only required item.
• Your name and written comment, if you choose to give them. These are requested only on ratings of three stars or below.
• Your email address or telephone number, if you choose to give them so the business can follow up. These can be attached only within one hour of submitting your rating, and only once.
• Which card was tapped, and the date and time.

3. What we do not collect from you

We want to be specific here, because policies are often vague exactly where it matters.

• We place no advertising or analytics cookies on the feedback page, and we use no third-party tracking or analytics service anywhere in TapReview.
• We do not collect your location, device identifiers, or browsing history, and we do not build a profile of you.
• Your IP address is read from the network request and held briefly in server memory to limit how many submissions can come from one connection. It is never written to our database and is discarded within minutes.
• We never see or handle payment card details. Customers are not asked for payment at all.

4. What we collect from merchants

When a business creates a TapReview account we collect:

• The business name, the public link name you choose, and the Google review page you want customers directed to.
• Your email address, and the address you want low-rating alerts sent to.
• Your password, which is hashed by our authentication provider. It is never stored in readable form and is not visible to us.
• Your subscription status, trial and renewal dates, and the identifiers our payment processor assigns to you. Full card numbers are held by Stripe and never reach our systems.

5. Why we use this information

Feedback is used to show the merchant their ratings and comments, to alert them by email when a rating of three stars or below is left, and to pass on any contact details a customer chose to share so the business can respond.

Merchant account information is used to operate the account, authenticate logins, take payment, send service messages, and provide support.

We do not sell personal information, we do not share it for advertising, and we do not use feedback content to train machine-learning models.

6. When you are sent to Google

If you give a rating of four or five stars, your browser is sent to the business Google review page so that you can post publicly if you wish. Your rating is recorded for the business before that happens.

We do not send your name, comment, email or telephone number to Google. Once you arrive there, the Google privacy policy governs what happens, and anything you write on Google is published under Google terms rather than ours.

7. Who else processes this information

We use a small number of service providers. Each is bound to use the information only to provide their service to us:

• Supabase — database hosting and merchant authentication.
• Stripe — subscription payments and billing. Stripe handles card details directly and is independently responsible for them.
• Resend — delivery of low-rating alert emails to merchants.
• Our web hosting provider, which serves the application itself.

8. Where information is stored

Some of these providers store or process information outside Canada, including in the United States. Information held in another country may be accessible to that country authorities under its own laws.

We choose providers that offer contractual protections for information transferred outside Canada. If you would like to know where a particular category of information is held, ask us and we will tell you.

9. Cookies

The public feedback page sets no cookies at all.

The merchant dashboard sets cookies that are strictly necessary to keep you signed in. They carry your session and nothing else. There are no advertising, profiling or analytics cookies anywhere in TapReview, which is why you are never asked to accept any.

10. How long we keep it

Feedback is kept for as long as the merchant account exists, because it is that business record of its own customers. When a merchant account is deleted, its cards and all associated feedback are deleted with it.

Merchant account information is kept while the account is open, and afterwards only where we are required to retain it — for example billing records kept for tax purposes.

A merchant can delete individual cards, and the feedback attached to them, from their dashboard at any time.

11. How we protect it

Traffic is encrypted in transit. Database access is restricted per account at the database level, so one merchant cannot read the data of another. Administrative credentials are held server-side only and are never exposed to the browser. Public submission endpoints are rate limited. Passwords are hashed.

No system is perfectly secure and we will not claim otherwise. If a breach occurs that presents a risk of serious injury, we will notify the people affected and the relevant regulator, as the law requires.

12. Your rights

Under Canadian federal privacy law and, in Quebec, under the Act respecting the protection of personal information in the private sector, you may:

• Ask what personal information we hold about you, and receive a copy of it.
• Ask us to correct information that is inaccurate or incomplete.
• Ask us to delete information, or to stop distributing it, where the law allows.
• Withdraw consent you previously gave, subject to legal and contractual limits.
• Receive computerised information you gave us in a structured, commonly used format.
• Complain to a regulator if you are not satisfied with our response.

13. How to exercise them

Write to privacy@webinos.ca. We will respond within thirty days.

If your request concerns feedback you left at a business, that feedback forms part of that business records. We will pass your request to them, help them act on it, and tell you that we have done so.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, or — in Quebec — to the Commission d’accès à l’information du Québec.

14. Children

TapReview is intended for businesses and their adult customers. It is not directed at children and we do not knowingly collect information from a child. If you believe a child has given us information, contact us and we will delete it.

15. Changes to this policy

If we change this policy we will update the effective date above. Where a change materially affects how we handle information already collected, we will tell merchants by email before it takes effect.

16. Contact

Webinos, operator of TapReview.

Privacy enquiries: privacy@webinos.ca

General enquiries: support@webinos.ca

Website: webinos.ca