HelloTap Privacy Policy

Esta página está disponible solo en inglés por ahora.

Effective date: {EFFECTIVE DATE}

HelloTap is a product of AG47 Ventures LLC ("HelloTap," "we," "us").

This policy explains what information we collect when you use hellotap.app, our digital business cards, the card assistant, and the receptionist (the "Service"), how we use it, who we share it with, and the choices you have. It covers two groups of people:

• Card owners: people and businesses who sign up and make HelloTap cards.
• Visitors: people who view a HelloTap card, tap a link on it, chat with its assistant or receptionist, or send their details through a card.

If you have questions, email us at support@hellotap.app.

1. Information we collect

Information you give us when you sign up and use your account

• Account details: your name, email address, and password. We store your password only as a hash, never in plain text. If you sign in with Google or Apple, we get an ID from that provider that links it to your account. With Apple, you can choose to share a private relay email instead of your own. If you sign in with an emailed link, we store a short-lived sign-in code.
• Business and team details: your company name, your plan, and your role on your team.
• Alert settings: the phone number and email you want alerts sent to, and which alerts you've turned on, including text alerts, and whether you've opted in to the weekly stats email.
• How you found us: which page, card, or team led you to sign up, and the referral code you used, if any.

Information you put on your card

Your card is a public profile. It can include your display name, title, company, phone number, email, bio, website, tagline, location, license number, photos (headshot, logo, gallery, and share image), reviews, insurance carrier and certificate link, your choice of template, interests (on templates that have them), and how you'd like people to contact you. If you use the card assistant or receptionist, it can also include your services, prices, service area, hours, greeting, and answers to common questions. If you lock a card with a password, we store that password only as a hash.

Photos and logos you upload to your card are stored at public web addresses. Anyone who has the link to one of those image files can view it, even if your card is unlisted or password-locked.

Information about your leads and contacts

• When a visitor sends their details through a card or its assistant, we collect what they enter, such as their name, phone number, email, company, job title, where you met, the service they want, their ZIP code, the time they picked, and a note. We also record that they agreed to the consent message shown on the form, and the wording of that message (in English or Spanish, depending on the card's language).
• When a visitor chats with a card's assistant, we process their messages so the assistant can answer.
• When the receptionist is turned on, a card owner can let an AI receptionist answer visitors' messages on their card. It's off unless the owner turns it on. We send the visitor's messages and the facts the owner gave the receptionist (such as services, prices, service area, and hours) to Anthropic's Claude models through Vercel's AI Gateway to generate replies. Under their terms, these providers don't use this data to train models and delete it within a limited time, except content flagged for safety.
• Contacts you add or manage in HelloTap, such as names, emails, phone numbers, companies, titles, notes, next steps, and due dates.

If you're a card owner, you're responsible for having the right to add other people's information and for how you use it.

Billing information

Payments are handled by Stripe. We don't receive or store your full card number. Stripe collects your payment details, email, and billing address as needed. We receive and keep Stripe IDs for your customer record, subscription, invoices, payments, and any refunds or disputes, plus your subscription status, trial use, add-ons, and payment history.

AI Card Designer

When you use the AI Card Designer, we send what you type, the earlier messages in your current chat (these stay only on the open page and aren't saved in your browser), and some of your card details (name, company, title, location, headline, bio, and colors) to Anthropic's Claude models through Vercel's AI Gateway, which may send the request to Anthropic or to a cloud provider that hosts Claude. They process it to generate design and text suggestions. Under their terms, these providers don't use this data to train models and delete it within a limited time (Anthropic deletes API inputs and outputs within 30 days), except content flagged for safety, which may be kept longer under their policies. We keep the suggested changes and the AI's replies. We don't store a separate copy of your prompts in our database.

Information we collect automatically

When anyone views a card or taps a link on it, we record:

• What happened (for example, a view, a link tap, or a saved contact) and which link was used.
• A random visitor ID and session ID stored in cookies (see Section 5), and whether the visitor has been there before.
• The referring page and where the visit came from (for example, a QR code or shared link).
• Approximate location: city and country only. This comes from location headers our hosting provider adds to each request. We don't collect precise location.
• Browser and device type: your browser's user-agent text, cut to 300 characters.

IP addresses. We don't store your IP address with your activity. To stop spam and abuse, we turn your IP address into a one-way hash and keep it with a short-lived counter that limits how often someone can do things like send a lead, book a time, open a locked card, or use the AI Card Designer. Expired counters are deleted regularly.

When a form uses spam protection, Cloudflare Turnstile checks your browser to confirm you're a person, and we receive only its pass or fail result.

2. Where we get information

• From you, when you sign up, build your card, change settings, chat with a card's assistant or receptionist, or send your details through a card.
• From card owners, when they add or import contacts, or add notes about them.
• From sign-in providers like Google (or other sign-in options, if we offer them), when you choose to sign in with them.
• From Stripe, about your payments, subscription, refunds, and disputes.
• Automatically, from your browser and our hosting provider when you visit a card or use the Service (see Section 1).
• From referral links, when you arrive through someone's referral link.

3. How we use information

We use information to:

• Run the Service: create your account, sign you in, show your card, run the card assistant and receptionist, and save your settings.
• Show card owners how their card is doing: views, taps, leads, bookings, and the approximate city and country they came from.
• Send leads and bookings to card owners, including the lead's details and a contact file (.vcf).
• Send the emails and texts described in Section 6.
• Process payments, trials, renewals, add-ons, refunds, and disputes, and run our referral program.
• Run the AI Card Designer when you use it.
• Keep the Service safe: limit abuse, prevent fraud, and block accounts that break our Terms or dispute payments.
• Let our team know when someone signs up. When you create an account, we get an email and a text with your name, email, company, and how you found us.
• Provide support and answer your questions.
• Follow the law and enforce our Terms.

4. How we share information

We don't sell your personal information. We don't share it for cross-context behavioral advertising. We don't use advertising pixels or ad trackers. We don't share personal information with other companies for their own marketing.

We share information only in these ways:

With service providers who help us run HelloTap. They may use it only to provide their services to us.

Provider	What they do
Vercel	Hosting: runs the Service, adds approximate location to requests, and stores uploaded images (Vercel Blob)
Neon	Database: stores our data
Stripe	Processes payments, trials, subscriptions, add-ons, invoices, and the billing portal
Apple	Sign in with Apple, when you choose it: Apple shares your name and email (or a private relay email) with us.
Google	Sign-in with Google. Google Fonts, which your browser loads from Google when you view a card, so Google receives your IP address.
Vercel AI Gateway and Anthropic	AI features: the AI Card Designer and, when turned on, the card's AI receptionist.
Resend	Sends our emails
Cloudflare	Spam and bot protection (Turnstile) on some card forms, such as lead and booking forms, when it's turned on. Cloudflare receives your IP address and browser and device signals to check that you're a person.
Twilio	Text messages: sends our text alerts.

To comply with the law and protect people. We may share information when the law requires it, such as in response to a valid legal request, or to protect the safety of people. If we find content that appears to sexually exploit a child, we preserve it with related account information and report it to the National Center for Missing & Exploited Children (NCMEC), which may share it with law enforcement.

With the public, when you publish a card. Your card and the images on it are meant to be seen by anyone who has the link.

Visitor details go to the business

When you chat with a HelloTap business's card, assistant, or receptionist, or send your details through its card, we share your name, phone number, email, and request with that business owner. If the business owner turned on text alerts, we may send some of these details to them by text, such as your name, number, request, and any time you booked. The business owner also sees view and tap activity, including approximate city and country.

For these details, HelloTap acts on the business's behalf. We use them to provide the Service to that business. What the business does with your details is up to them, not us, so contact the business with questions about how it uses them. We don't use visitor leads for HelloTap's own marketing, and we don't email or text visitors to promote HelloTap. After you send your details through a card, the card may show you an optional offer, on the page only, to make your own HelloTap card. If you choose to sign up, we use what you enter to start your account.

With your team. Your team's account owner and people who manage your team's cards can see those cards, their leads, bookings, contacts, and stats.

With social sites you choose. The share buttons on a card are plain links to Facebook, X, LinkedIn, and Nextdoor. We don't load their code on the page. Nothing is shared until you click and post.

For legal and safety reasons. We may share information if the law requires it, to respond to valid legal requests, to protect people's safety, or to protect our rights or the Service.

If our business changes. If HelloTap is sold, merged, or reorganized, information may move to the new owner, who must follow this policy.

5. Cookies and analytics

We use our own cookies to run the Service and to count card activity. Our analytics are first-party only. We don't use Google Analytics or any other third-party analytics or advertising cookies.

Cookie	What it does	How long it lasts
taplink_session	Keeps you signed in to HelloTap	30 days
taplink_vid	Random visitor ID for card stats	1 year
taplink_sid	Groups one visit for card stats	12 hours
ht_ref	Remembers the referral link you used	30 days
ht_lead_invite, ht_lead_invite_oauth	Carries a lead's sign-up from a card to account setup, including during Google or Apple sign-in	Up to 30 minutes
ht_unlock_...	Remembers that you unlocked a password-locked card	7 days
ht_signup_consent	Remembers that you agreed to the Terms and Privacy Policy (and are 18+) while you sign up with Google or Apple	30 minutes
__Secure-authjs.session-token (may be split into .0, .1)	Sign-in session	30 days, refreshed every 24 hours
__Host-authjs.csrf-token	Protects sign-in from forged requests	Until you close your browser
__Secure-authjs.callback-url	Where to send you after sign-in	Until you close your browser
__Secure-authjs.pkce.code_verifier	Secures the Google sign-in exchange	15 minutes
__Secure-authjs.state	Secures the Google or Apple sign-in exchange	15 minutes
__Secure-authjs.nonce	Secures the Google or Apple sign-in exchange, if the provider uses it	Until you close your browser

We also store a short tag in your browser's session storage that notes where your visit came from. It's cleared when you close the tab.

You can block or delete cookies in your browser settings. If you block them, signing in and some features won't work.

Do Not Track. Some browsers send a "Do Not Track" signal. There isn't one agreed standard for how to respond, so we don't change how the Service works when we get one. We don't track you across other websites, and we don't allow other companies to track you on HelloTap for advertising.

6. Emails and text messages

We use Resend to send email and Twilio to send texts.

• Messages we always send when needed: sign-in links, billing and payment reminders, and other account notices. You can't opt out of these while you have an account.
• Card alerts: if you turn them on, we email or text you when your card is viewed, a link is tapped, or you get a lead. Turn them off anytime in your alert settings.
• Weekly stats email: this is off unless you opt in. Turn it off in your settings, or click the unsubscribe link in any weekly email.

Text messaging

• Texts to card owners. HelloTap texts card owners only after they opt in by turning on text alerts.
• Texts to visitors. If you send your details through a HelloTap card, its assistant, or its receptionist, the business may text you about your own request. Those texts come from that business, not from HelloTap. To stop them, reply STOP to the business or contact the business.
• Consent isn't a condition of purchase. You don't have to agree to receive texts to buy or use anything.
• Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help.
• To stop texts from HelloTap, reply STOP to any text, or turn off text alerts in your settings. For help, reply HELP or email support@hellotap.app. Replying STOP also turns off text alerts. If you reply START, you'll need to turn alerts back on in your settings.
• We don't sell or share your mobile number or text opt-in with third parties for marketing.
• Mobile opt-in data and consent are not shared with any third parties, except providers that help us deliver the messages.

If you're a visitor and you send your details through a card, any calls, texts, or emails you get afterward come from that business, not from HelloTap. Contact the business to stop them.

7. How long we keep information

We keep your account information, card stats, leads, bookings, and contacts while your account is open. Deleting a card, a lead, or your team's account also deletes the bookings tied to it. Rate-limit counters with hashed IP addresses expire after a short time and are deleted regularly. AI token packs expire 12 months after purchase.

When an account is deleted, its team, cards, card stats, leads, bookings, alerts, contacts, notes, and pipeline stages are deleted from our database. When a team owner removes a team member, that member's card, card stats, and alerts, and the leads and bookings tied to it, are deleted the same way. Contacts already saved to the team's CRM stay. Files the team owner added to that card stay in the owner's account. Any leftover files we can't match to a card or design are deleted within 30 days. We keep some records after deletion when we need them to prevent fraud or handle disputes. For example, if a payment was disputed, we keep a record of the dispute and the email, sign-in IDs, and Stripe customer ID on the account, which we use to block new sign-ups. Stripe also keeps its own payment records. We delete your account data within 30 days of your deletion request. Copies in our backups roll off within 30 days. We keep records we must keep for tax, billing, fraud, or legal reasons. For example, payment records are kept by Stripe and by us, typically for up to 7 years.

Deleting your account also cancels any subscription and deletes the files stored for your account, including the photos and images you uploaded to your cards, files made with the AI Card Designer, and your photo vault. If content on an account is under a legal hold, such as content we've reported to NCMEC, we keep it for as long as the hold lasts and as long as the law requires, even after the account is deleted.

8. Your choices: review, change, or delete your information

• Review and change: sign in to update your account details, card, alert settings, and weekly email choice anytime.
• Delete your account: email us at support@hellotap.app to have your account deleted. There isn't a delete button in the app yet.
• Other requests: email support@hellotap.app if you want a copy of your information, want us to fix something you can't change yourself, or want us to remove something. Visitors who sent their details to a business can ask us too. We may also point you to the business, since it decides how it uses your details.

We may need to confirm your identity before we act on a request.

9. Your California privacy rights

Notice at collection

This table sums up the personal information we collect, based on the categories in California law. Section 1 has the details, Section 2 lists where it comes from, Section 3 explains how we use it, Section 4 lists who we share it with, and Section 7 explains how long we keep it.

Category	Examples	Shared with
Identifiers	Name, email, phone number, sign-in IDs, random visitor ID	Service providers; the business you contact; your team
Customer records	Billing address and payment records (held by Stripe), company, contact details	Service providers; your team
Commercial information	Plan, trial, add-ons, purchases, refunds, and disputes	Service providers
Internet or other electronic activity	Card views and taps, referring page, browser and device type, chats with a card's assistant	Service providers; the business whose card you view
Approximate location	City and country only	Service providers; the business whose card you view
Electronic information	Photos you upload	Service providers; your team
Professional information	Job title, company, license number, insurance details	Service providers; the public (if on your card); the business you contact
Account login	Email and password (stored only as a hash)	Service providers

We use your account login only to sign you in and keep your account secure. We don't use or share sensitive personal information to infer things about you.

We don't sell personal information, and we don't share it for cross-context behavioral advertising. That includes the personal information of people under 16. Because we don't sell or share, there's nothing to opt out of.

Your rights

If you live in California, you can ask us to:

• Tell you what personal information we have about you and give you a copy.
• Delete your personal information.
• Correct personal information that's wrong.

To make a request, email support@hellotap.app. You can also have someone you authorize make a request for you. We'll confirm we got it and respond within 45 days, as California law requires. We won't treat you differently for making a request. We may keep some information when the law allows, for example to prevent fraud or complete a transaction. If you're a visitor, we may pass your request to the business you contacted, since we hold those details on its behalf.

As explained in Section 4, we don't sell personal information, we don't share it for cross-context behavioral advertising, and we don't share it with other companies for their own direct marketing.

California Online Privacy Protection Act

You can review and change your information as described in Section 8. Section 5 explains how we respond to Do Not Track signals. The effective date at the top of this page shows when this policy last changed, and Section 12 explains how we tell you about changes.

10. How we protect information

We use reasonable safeguards to protect your information. For example, we store passwords only as hashes and limit repeated attempts to sign in to locked cards. No system is perfectly secure, so we can't guarantee that your information will never be lost, misused, or accessed without permission. Keep your password private and tell us right away at support@hellotap.app if you think your account has been compromised.

11. Children

HelloTap is not for anyone under 18. We don't knowingly collect personal information from children under 13. If you think a child under 13 has given us personal information, email support@hellotap.app and we'll delete it.

12. Changes to this policy

We may update this policy. When we do, we'll change the effective date at the top. If we make a material change, we'll tell you by email or with a notice in the Service at least 15 days before it takes effect. Other changes take effect when we post them, with the updated effective date. If you keep using HelloTap after a change takes effect, the updated policy applies.

13. Contact us

HelloTap, a product of AG47 Ventures LLC Email: support@hellotap.app