Support

GDPR and CCPA: how Tapper handles personal data

For the traffic data it collects on your behalf, Tapper is a processor under GDPR and a service provider under CCPA: it processes that data only to provide its service to you. For your own account details, Tapper is the controller.

Tapper's role

  • Traffic data from your site and ads. In the Security page's words, "Tapper acts as a processor under GDPR and a service provider under CCPA." You, the customer, decide why that data is collected. A Data Processing Agreement is available and can be signed alongside an NDA: ask support@tapper.ai.
  • Your account data. For the details you and your team give Tapper, Tapper AI Ltd, registered in Delaware, is the controller, as set out in the Privacy Policy at <https://tapper.ai/privacy-policy>.

Tapper's Terms of Service, Privacy Policy and Data Processing Agreement are legal documents and keep their own defined terms, which can differ from the wording used in this support site.

What personal data Tapper processes

About visitors to your site

  • The monitoring script reads the signals a browser already sends with every request, such as the IP address, the user agent and click data, and uses them to tell real visitors from invalid traffic. It collects no names, emails or financial data, and input fields are redacted. An IP address counts as personal data under GDPR.
  • The Google Ads tracking template (on Block + Lift workspaces) passes each ad click through Tapper before the visitor lands on your page. The click carries Google's parameters, such as the campaign, ad group, keyword, device, location and the Google click ID (GCLID).
  • A Salesforce connection (Tapper Vantage) is read-only. The Security page states that email and phone values from a CRM connection are hashed at ingest and the raw values are never stored.

What leaves Tapper is limited to what you configure: "IP exclusions and blocked audiences to your ad accounts, and conversion values with a click ID to Google Ads. No email, phone, hash, name or CRM content is sent."

About you and your team

Your name, company name and email address when you create an account, billing details when you pay, and the technical data any website collects, such as your IP address and browser.

Processing IP addresses and device signals to detect invalid traffic relies on legitimate interests under GDPR Article 6(1)(f). As the controller for your visitors, you decide how consent works on your site, and Tapper gives you the controls on the entity's Website monitoring tab:

  • Cookie policy: Region-based, Cookie first or Consent first. Cookie first applies until someone chooses. Only Owners and Admins can change it.
  • Recognise visitors without cookies: on by default for every script.
  • Consent snippets: call window.tapper.consent("GRANTED"); or window.tapper.consent("DENIED"); from your consent banner to tell Tapper the visitor's answer. Only these two values work, and they are case-sensitive.

Details are in Cookie policy, consent snippets and recognizing visitors without cookies.

How long data is kept

"Data is retained for a default of 12 months, configurable per agreement." When a contract ends, Tapper returns or securely deletes personal data on written instruction and confirms it in writing under the Data Processing Agreement.

Your rights and how to use them

You can ask to access, correct or delete your personal data, to restrict or object to its processing, and to receive a copy in a machine-readable format. Write to support@tapper.ai. Tapper may need to verify your identity before acting on a request.

Frequently asked questions

Does Tapper sell personal data?

No. The Security page states that data is "never sold or shared beyond the disclosed sub-processors."

Who are Tapper's sub-processors?

Tapper's hosting provider is Google Cloud, in europe-west1. The full sub-processor list is part of Tapper's security report, which is available on request from support@tapper.ai.

Does data leave the EU?

Core processing runs on Google Cloud in europe-west1. Where personal data is transferred outside the EEA, Switzerland or the UK, Tapper uses appropriate safeguards, including standard contractual clauses approved by the European Commission. You can ask support@tapper.ai for a copy.

How do I stop marketing emails?

Use the unsubscribe option in any marketing email, or write to support@tapper.ai.

How do I make a complaint?

Write to support@tapper.ai first. If you are not satisfied, you can complain to your local supervisory authority, such as an EU data protection authority, the Swiss FDPIC or the UK Information Commissioner's Office.

Is there an age limit?

Tapper's site and services are not intended for children under 16, and Tapper does not knowingly collect personal data from them.

What if I think my data has been compromised?

Contact support@tapper.ai straight away. Tapper notifies affected individuals and authorities as the law requires.

Still need help?

Chat with our team and mention this article.