01Who We Are
tappr ("we", "us", "our") is a SaaS platform that helps Instagram sellers create product links, manage orders, and accept payments. tappr is operated by ArunKumar V, a sole proprietorship registered in Erode, Tamil Nadu, India.
This Privacy Policy applies to all users — whether you are a seller (someone who creates a store on tappr) or a buyer (someone who purchases from a tappr store).
By using tappr, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use our platform.
02What We Collect
Information you provide directly
🏪
Sellers
Name, email, password, Instagram handle, phone, store name, UPI IDs, payment QR codes, product details and images
🛍️
Buyers
Name, phone number, email (optional), delivery address, order details and payment method used
📱
WhatsApp
Phone numbers used for order notifications sent via our WhatsApp Business account
Information collected automatically
Product page views and click counts (aggregated, not personal) Device type and browser when you visit tappr IP address for security and fraud prevention Order timestamps and transaction metadata Payment information
tappr does not store credit or debit card numbers. Payments are processed directly via UPI (GPay, PhonePe) between buyers and sellers. tappr only stores the payment method used (e.g., "GPay") for order records.
03How We Use Your Information
To run the platform — create your store, manage products, process orders To send notifications — WhatsApp alerts for new orders, status updates, and low stock To show order tracking — buyers can track orders via unique order links To prevent fraud — rate limiting on orders, detecting suspicious activity To improve tappr — aggregated analytics to understand which features are used most To comply with Indian law — tax records, GST compliance as required We do not sell your personal data to third parties. We do not use your data for advertising. tappr is completely ad-free.
04Who We Share Data With
We share data only with trusted service providers who help us run tappr:
Infrastructure and Storage
Supabase — database, authentication, and file storage Communication
WATI — WhatsApp Business API for order notifications Between Sellers and Buyers
When you place an order, your name, phone number, and delivery address are shared with the seller so they can fulfil your order. This is essential to the service.
All third-party providers are bound by data processing agreements and are prohibited from using your data for their own purposes.
05Data Storage and Retention
All data is stored on Supabase infrastructure with encryption at rest and in transit (TLS/SSL) Seller account data is retained as long as the account is active Order data is retained for 7 years to comply with Indian GST and tax regulations If you delete your account, personal data is deleted within 30 days except where required by law Product images are stored in Supabase Storage with public read access 06Cookies and Local Storage
tappr uses minimal cookies and browser storage:
Authentication session — to keep you logged in as a seller (essential, cannot be disabled) Cart data — stored in your browser so your cart persists across page reloads Sidebar preference — whether your dashboard sidebar is collapsed or expanded We do not use advertising cookies, tracking pixels, or third-party analytics cookies.
07Your Rights
Under the Information Technology Act 2000 and the Digital Personal Data Protection Act 2023 (India), you have the right to:
Access — request a copy of all personal data we hold about you Correct — update incorrect information via your Settings page Delete — request deletion of your account and personal data Portability — export your order history and product data as CSV Withdraw consent — opt out of WhatsApp notifications at any time via Settings To exercise any of these rights, email us at privacy@tappr.shop. We will respond within 30 days.
08Security
All data is encrypted in transit using TLS 1.3 Passwords are hashed using bcrypt — we never store plain text passwords Seller payment details (UPI IDs) are only accessible to authenticated sellers Order access tokens are randomly generated 32-character hex strings Row-level security (RLS) is enabled on all database tables 09Children's Privacy
tappr is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us immediately and we will delete it.
10Changes to This Policy
We may update this Privacy Policy from time to time. When we make significant changes, we will:
Update the "Last updated" date at the top of this page Send a notification to registered sellers via email Show an in-app banner for 7 days after the change