Privacy Policy

We collect information you provide directly, information generated by your use of our platform, and information from third-party services.

We use the information we collect to:

• Create, maintain, and secure your TΛPΛT account
• Process payments, transfers, and withdrawals between users
• Calculate and distribute cashback rewards, gas fees, profit sharing, and leadership pool allocations per TΛPΛT's proprietary reward algorithms
• Maintain and operate referral network relationships
• Operate the marketplace, including processing orders and managing fulfillment holds
• Mint, burn, and track TPT token balances and exchange rates
• Detect, prevent, and investigate fraud, abuse, and security incidents
• Comply with applicable laws and regulations, including anti-money-laundering (AML) and know-your-customer (KYC) requirements
• Send transactional notifications related to payments, rewards, and account activity
• Provide customer support and respond to inquiries
• Enforce account activity policies as described in our Terms of Service
• Improve and develop platform features
• Generate aggregated, de-identified analytics for internal business purposes

We do not sell your personal information. We share information only in the following circumstances:

All third-party service providers are contractually required to handle your data in accordance with applicable privacy law and to use it only for the purposes for which it was shared.

TΛPΛT uses Stripe, Inc. to process payments and facilitate fund transfers. When you add funds, withdraw funds, or complete a transaction involving external bank accounts or payment cards, your payment information is transmitted directly to Stripe and is subject to Stripe's Privacy Policy.

TΛPΛT does not store full payment card numbers or bank account credentials on our servers. Stripe handles all sensitive payment data in a PCI-DSS compliant environment.

For users onboarded through Stripe Connect, Stripe collects additional identity and banking information to comply with financial regulations. This information is governed by Stripe's terms and privacy policy in addition to ours.

TΛPΛT is in the process of onboarding with PayMongo Philippines, Inc., a BSP-regulated payment facilitator, to support payment processing in Philippine Peso (PHP) and local methods such as GCash, Maya, and bank transfers. Once active, users transacting in PHP will have their payment and KYC information processed by PayMongo under PayMongo's Privacy Policy in addition to ours. We will update this Policy once the integration is live.

We take the security of your personal and financial information seriously. Our safeguards include:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS (HTTPS)
• Encryption at rest: Sensitive data stored in our Supabase database is encrypted at rest
• Authentication: User accounts are protected by email/password authentication and session tokens managed by Supabase Auth
• Row-Level Security (RLS): Database access is restricted at the row level — users can only access their own data; admin access requires explicit whitelisting
• File storage access controls: User-uploaded files (avatars, listing images) are stored in access-controlled Supabase Storage buckets with per-user path isolation
• Payment isolation: Card numbers and bank credentials are never stored on TΛPΛT servers — all payment data is handled by Stripe in a PCI-DSS compliant environment
• Audit logging: All financial transactions are logged in an immutable ledger and cannot be modified after creation
• Access controls: Administrative access to platform data is restricted to authorized personnel only
• Activity-based protections: Accounts subject to TΛPΛT's activity policies are monitored to protect the integrity of the reward network. Specifics are disclosed in our Terms of Service

No security system is impenetrable. If you believe your account has been compromised, contact us immediately at support@tapat.dev.

We retain your information for as long as your account is active or as needed to provide services, comply with legal obligations, resolve disputes, and enforce our agreements.

• Account data: Retained for the life of your account plus a minimum of 5 years following closure, as required by financial regulations
• Transaction records: Retained indefinitely as part of our immutable financial ledger
• Forfeited account data: Records are retained following forfeiture per our Terms of Service and applicable law
• Profile photos and listing images: Deleted from storage when you remove them or close your account
• Support communications: Retained for 3 years after resolution

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Update inaccurate or incomplete personal information via your account settings or by contacting us
• Deletion: Request deletion of your personal data, subject to legal retention requirements and outstanding financial obligations
• Portability: Request your transaction history and account data in a structured format
• Objection: Object to certain processing activities
• Withdrawal of consent: Where processing is based on consent, withdraw it at any time without affecting prior lawful processing

To exercise any of these rights, contact us at privacy@tapat.dev. We will respond within 30 days. Note that we may need to verify your identity before fulfilling a request, and some requests may be limited by legal obligations.

TΛPΛT is a Progressive Web App (PWA) and uses minimal browser storage:

• Session tokens: Supabase authentication uses secure session tokens stored in browser local storage to keep you signed in
• User preferences: Notification settings and display preferences may be stored in local storage on your device
• No third-party advertising cookies: We do not use advertising cookies, tracking pixels, or analytics trackers for advertising purposes
• Affiliate links: When you click a product link labeled as an affiliate or sponsored link (for example, links to Amazon), the destination site may set its own cookies and track your browsing on that site in accordance with its own privacy policy. TΛPΛT itself does not receive the personal details of those clicks — only aggregate commission reports from the affiliate partner

You can clear browser local storage at any time through your browser settings, which will sign you out of TΛPΛT.

TΛPΛT is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has created an account, please contact us at privacy@tapat.dev and we will promptly close the account and delete the associated data.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the effective date at the top of this page and, where appropriate, by sending a notification to your registered email address. Your continued use of TΛPΛT after changes take effect constitutes your acceptance of the updated policy.

We encourage you to review this page periodically.

SMS Messaging

When you opt in to SMS messaging at account creation (or later in Account settings), TΛPΛT collects and retains the following data to operate the SMS program:

• Your mobile number in E.164 format (e.g., +15551234567)
• Your consent timestamp, IP address, and user agent at the moment of opt-in (as evidence of consent per TCPA and carrier compliance requirements)
• Each message we send you, including a delivery status (delivered, pending, failed) and timestamp
• Any STOP, HELP, or opt-out replies you send, and the corresponding timestamp

How SMS data is used: exclusively for the purposes described in our SMS Messaging Policy — delivering transactional messages, verifying consent when required by carriers or regulators, and honoring opt-out requests.

SMS delivery providers: TΛPΛT uses Amazon Web Services (AWS End User Messaging / SNS) and, for Philippine delivery, Semaphore, to transmit SMS messages. Your mobile number and message content are shared with these providers solely for the purpose of delivering the message to your carrier.

Mobile opt-in data is never shared with third parties for marketing. Your phone number, consent record, and SMS interaction history are not sold, rented, or licensed to any third party.

Retention: Consent records and opt-out records are retained for as long as you have a TΛPΛT account and for up to seven (7) years after account closure, as required by U.S. TCPA recordkeeping obligations. Individual message content may be purged sooner per our general data-retention schedule in §6.

For complete opt-in, opt-out, and program details, see our SMS Messaging Policy.

WhatsApp Messaging

For users outside the United States, TΛPΛT may deliver transactional notifications via WhatsApp instead of SMS. WhatsApp delivery is provided through Meta Platforms, Inc.'s WhatsApp Business Platform. When you opt in to WhatsApp messaging, the following applies:

• Your mobile number in E.164 format is used to identify your WhatsApp account
• Your consent timestamp, IP address, and user agent at the moment of opt-in are retained as evidence of consent
• Each WhatsApp message we send you, including delivery and read status, is logged with a timestamp
• Any STOP, HELP, or "block" responses are recorded and honored automatically

What we send via WhatsApp: account verification codes (OTP), payment confirmations, withdrawal status updates, security alerts, referral and rewards notifications, and other transactional or service messages directly tied to your TΛPΛT account activity. We do not send promotional or marketing messages via WhatsApp.

How to opt out: Reply STOP to any TΛPΛT WhatsApp message, block the TΛPΛT WhatsApp Business contact in your WhatsApp app, or disable WhatsApp notifications in your TΛPΛT Account settings. All three methods are honored automatically.

Data shared with Meta: When you receive a WhatsApp message from TΛPΛT, your phone number and the message content are processed by Meta Platforms, Inc. via the WhatsApp Business Platform for the purpose of delivering the message to your device. Meta's processing of WhatsApp business messaging is governed by the WhatsApp Business Messaging Policy and the WhatsApp Business Data Transfer Addendum. Meta acts as a processor of the message data for transmission purposes and does not use the content of TΛPΛT business messages to target advertising.

WhatsApp messaging providers: TΛPΛT uses Amazon Web Services (AWS End User Messaging Social) as the technical interface to the WhatsApp Business Platform. AWS receives the message and routes it to Meta for delivery to your device.

Standard WhatsApp data charges: WhatsApp messages count against your mobile data plan or Wi-Fi connection rather than your SMS allowance. Standard data rates from your mobile carrier may apply.

If you do not have WhatsApp installed: If we attempt to send you a WhatsApp message and your number is not registered with WhatsApp, or if delivery fails, we may fall back to SMS or email, depending on your account preferences and which channels you have opted into.

Retention: WhatsApp consent records, message logs, and opt-out records are retained on the same schedule as SMS records — for the duration of your TΛPΛT account and up to seven (7) years after account closure.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out: