Privacy Notice

• Account data — your name, work email address, and (optionally) your Slack/Teams handle, plus your role, job function, and availability within your workspace. Authentication credentials (passwords, MFA factors) are managed by our identity provider (Clerk) and are not stored by Tap.
• Usage data — product analytics events about how the application is used, collected through PostHog. We use identified-only profiles; anonymous visitors are not profiled.
• Diagnostic data — error and performance data collected through Sentry, configured to exclude personal data.
• Billing data — if your workspace pays for Tap, billing is handled by Stripe. Payment card details go directly to Stripe; Tap does not see or store card numbers.
• What we do NOT collect — Tap does not accept file uploads of any kind, and does not store the contents of your work, which remain in your own tools (e.g., Figma, Adobe).

We process personal data to:

• provide and operate the service (performance of a contract / legitimate interests);
• secure the service, prevent abuse, and debug issues (legitimate interests);
• process payments and manage subscriptions (contract / legal obligation);
• communicate service and account information (contract / legitimate interests);
• understand and improve product usage in aggregate (legitimate interests).

Where Tap provides the service to your employer or organization, that organization is the controller of your account data and Tap acts as its processor under a Data Processing Agreement (available on request).

We do not sell personal data. We share data only with the subprocessors needed to run the service — Clerk, Stripe, Neon, Render, Resend, Sentry, Inngest, and PostHog — each under appropriate data-protection terms. The current list and purpose of each is on our Security & Trust page. We may also disclose data where required by law.

Our primary infrastructure is US-based. Where personal data is transferred from the EEA/UK, we rely on the Standard Contractual Clauses (with the UK Addendum).

We retain account data for the life of the account. If your workspace stops paying, it converts to read-only and is not deleted; data can be restored by resuming payment. Activity logs are retained for 6 months and database backups per our provider's retention window. We delete or return data on termination as described in our DPA.

Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to the processing of your personal data, and to withdraw consent. Because your organization is usually the controller of your account data, please direct requests to your organization; we will assist them as required. You may also contact us at the address below, and you have the right to complain to your local data protection authority.

We protect personal data with encryption in transit and at rest, server-enforced access controls, strict per-workspace isolation, an append-only activity log, and automated backups. See our Security & Trust overview for detail.

We use essential cookies for authentication and session management (via Clerk), and product analytics (PostHog) to understand how the application is used.

Tap is a workplace tool and is not directed to children. We do not knowingly collect personal data from anyone under 16.

We may update this notice from time to time. Material changes will be communicated through the service or by email, and the effective date above will be updated.

Questions or requests: security@tapworkcycle.com, or write to Tap Work Cycle LLC, 2501 Chatham Rd Suite N, Springfield, IL 62704. Data protection contact / DPO: Tap Work Cycle LLC (security@tapworkcycle.com).