Support

GDPR and CCPA: how Tapper handles personal data

On this page

Tapper's role

  • Traffic data from your site and ads. Tapper is a processor under GDPR and a service provider under CCPA: it processes that data only to provide its service to you, and you decide why it is collected. A Data Processing Agreement is available and can be signed alongside an NDA: ask support@tapper.ai.
  • Your account data. For the details you and your team give Tapper, Tapper AI Ltd, registered in Delaware, is the controller, as set out in the Privacy Policy at tapper.ai/privacy-policy.

The Terms of Service, Privacy Policy and Data Processing Agreement keep their own defined terms, which can differ from the wording on this site.

What personal data Tapper processes

About visitors to your site

  • The monitoring script reads signals a browser already sends, such as the IP address, the user agent and click data, to tell real visitors from invalid traffic. It collects no names, emails or financial data, and input fields are redacted. An IP address counts as personal data under GDPR.
  • The Google Ads tracking template (with Block) passes each ad click through Tapper on its way to your page. The click carries Google's parameters, such as the campaign, ad group, keyword, device, location and the Google click ID (GCLID).
  • A Salesforce connection (Tapper Vantage) is read-only. Email and phone values from a CRM connection are hashed at ingest; the raw values are never stored.

Only the outputs you configure leave Tapper: see What comes in and what goes out.

About you and your team

Your name, company name and email when you create an account, billing details when you pay, and the technical data any website collects, such as your IP address and browser.

Processing IP addresses and device signals to detect invalid traffic relies on legitimate interests under GDPR Article 6(1)(f). As the controller for your visitors, you decide how consent works on your site. The controls are on Setup > Website > Monitoring:

  • Cookie policy: Region-based, Cookie first or Consent first. Cookie first applies until someone chooses. Only Owners and Admins can change it.
  • Recognise visitors without cookies: on by default for every script.
  • Consent snippets: call window.tapper.consent("GRANTED"); or window.tapper.consent("DENIED"); from your consent banner. Only these two values work, and they are case-sensitive.

See Cookie policy, consent snippets and recognizing visitors without cookies.

How long data is kept

12 months by default, configurable per agreement. When a contract ends, Tapper returns or securely deletes personal data on written instruction and confirms it in writing under the Data Processing Agreement.

Your rights

You can ask to access, correct or delete your personal data, to restrict or object to its processing, and to get a copy in a machine-readable format. Write to support@tapper.ai. Tapper may need to verify your identity first.

Frequently asked questions

Does Tapper sell personal data?

No. Data is never sold or shared beyond the disclosed sub-processors.

Who are Tapper's sub-processors?

Tapper's hosting provider is Google Cloud, in the EU. The full list is in Tapper's security report, available on request from support@tapper.ai.

Does data leave the EU?

Core processing runs in the EU. Where personal data is transferred outside the EEA, Switzerland or the UK, Tapper uses appropriate safeguards, including standard contractual clauses approved by the European Commission. Ask support@tapper.ai for a copy.

How do I stop marketing emails?

Use the unsubscribe option in any marketing email, or write to support@tapper.ai.

How do I make a complaint?

Write to support@tapper.ai first. If you are not satisfied, complain to your local supervisory authority, such as an EU data protection authority, the Swiss FDPIC or the UK Information Commissioner's Office.

Is there an age limit?

Tapper's site and services are not intended for children under 16, and Tapper does not knowingly collect personal data from them.

What if I think my data has been compromised?

Contact support@tapper.ai straight away. Tapper notifies affected individuals and authorities as the law requires.

Still need help?

Chat with our team and mention this article.