Tapper's GDPR and CCPA compliance

Tapper processes personal data in line with the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). Its role, hosting, sub-processors, retention, breach response and your rights are in GDPR and CCPA: how Tapper handles personal data, and its security controls in How Tapper secures your data.

Personal data collection

Tapper uses the IP address, with other data points, to decide whether a session is invalid and to exclude it from your ads. The IP address is personal data under the GDPR, and the other data points may be too, depending on their nature.

GDPR Article 6(1)(f) allows processing personal data, including IP addresses, without explicit consent where it is necessary for the legitimate interests of the controller or a third party, unless the data subject's interests or fundamental rights and freedoms override them.

Tapper is a "Processor" under the GDPR and a "Service Provider" under the CCPA. It processes the personal data it collects only to provide its service to the customers who authorized the collection.

Transfers

Core processing runs in the EU on Google Cloud. Optional features may involve additional transfers, as described in that feature's documentation.

Rights and requests

Individuals can ask to access, rectify or delete their personal data, and for portability, restriction of processing or objection to processing, by writing to support@tapper.ai. The privacy policy explains how: tapper.ai/privacy-policy.

Data Processing Agreement

The Tapper Data Processing Agreement can be signed alongside the NDA (Security, data and privacy report). It defines Tapper as the Processor and the customer as the Controller, and sets out their rights and obligations.