Privacy

Your privacy at TapEm

What we collect, why, who helps us run TapEm, how long we keep it, and how to have it deleted — in plain words.

Last updated September 28, 2026

Who we are

TapEm (tapem.io) is operated by Yugenox Corporation, a company incorporated in Ontario, Canada. We build one-tap pages for independent restaurants and ship the NFC stands that open them. For anything about your information, write to help@tapem.io.

If you build or run a page

Finding your restaurant

What you type in the restaurant search is sent to Google Places to find matches. If you tap “I’m at my restaurant”, your phone’s location is used once to list the places around you: it goes to Google for that search, and we don’t save it.

Your page

We build the page from your restaurant’s public Google listing (name, address, hours, photos, rating and public reviews) and your restaurant’s own website. An AI service writes the page’s wording from that public information. You can change anything on the page afterwards.

When a page is built on tapem.io we record the IP address it was built from, with the time and the restaurant, to enforce the free-build limit and stop abuse. If you arrived from one of our ads, or Meta’s pixel on our home, /build or /order page has already set its cookie in your browser, we also keep with the build: the campaign tags and click ID of your visit, your browser’s identification string (browser and device type) and Meta’s _fbp/_fbc cookie values, so a later purchase can be matched to the ad (see Advertising measurement). We keep these build records for 12 months, then delete them; only the campaign tags stay with your page, so we still know which ad it came from (see How long we keep it).

Email

We keep the email addresses you give us for your page, and use them to send your sign-in links and your Monday report. Resend, our email provider, delivers those emails. When someone asks for a sign-in link, we record the address typed and the IP address it came from to stop abuse, and delete that record after 30 days, at the next weekly clean-up.

Payments and shipping

Payments go through Stripe’s checkout. Stripe collects your card; we never see or store the card number. We receive your name, email, phone number and shipping address so we can ship your stand and connect the payment to your page. Stripe’s own privacy policy covers what Stripe does with your data.

Advertising measurement (Meta)

We advertise TapEm on Facebook and Instagram. To learn whether those ads work, we use the Meta Pixel on tapem.io’s home page, /build and /order — and nowhere else. It is not on restaurants’ pages, the page editor, sign-in pages or this page.

On those three pages, the pixel tells Meta that a page was viewed and when a step happens: the builder opened, a new page went live, a look was saved, a plan button was tapped. These events don’t include your name, email, phone number or your restaurant’s name. Meta also receives what any website visit sends — your IP address, browser details and the page address (on /order, opened from your page, that address includes your page’s web name) — and reads or sets its own cookies (_fbp and _fbc) to recognise your browser and the ad you clicked.

When a stand or a plan is paid for, our server reports the purchase to Meta through its Conversions API: the amount and currency, a hashed (SHA-256, not readable) copy of the email used at checkout, and the browser, IP address and ad-click identifiers from the visit where the page was built (while we still keep them — see How long we keep it), so Meta can match the sale to its ad.

When you first arrive on one of those three pages, your browser keeps the campaign tags from the link you followed (utm_… and Meta’s fbclid) in its local storage — or, if that first visit had none, those of your first visit that does — and sends them with a page build, so we know which ad a new page came from.

Third parties, including Meta, may use cookies, web beacons and similar storage to collect or receive information from tapem.io and elsewhere on the internet, and use it to provide measurement services and to target ads. You can opt out of ads based on that information:

• Meta: your Facebook ad preferences (the same settings apply to Instagram).
• In Canada: YourAdChoices.ca (Digital Advertising Alliance of Canada).
• In the US: optout.aboutads.info (Digital Advertising Alliance).
• Or block third-party cookies, or clear this site’s data, in your browser settings.

Site statistics

We count visits with Vercel Web Analytics — which pages are viewed, where visitors came from, their country and type of device. It uses no cookies and doesn’t identify you or follow you to other sites.

If you’re a guest on a restaurant’s page

• No ad tracking. Restaurant pages don’t load the Meta Pixel, and we set no cookies on them for you.
• Taps and button presses. We log each tap of a stand and which button was pressed, with the time and your browser type, so the owner gets weekly counts. No name, no IP address, no cookie.
• Text list. If the restaurant offers “Get deals by text” and you sign up, we store your phone number, the name you give (if any), the consent sentence you were shown, the time, your IP address and browser type — the record that you asked to join. Only that restaurant sees its list. No texts are sent yet; before any are, you’ll get a confirmation and a way to stop.
• Private feedback. A message you send through a restaurant’s feedback form — and any contact details you choose to add — goes to that restaurant’s owner.
• Photos and fonts. A page’s photos and fonts load from Google’s servers and its logo from the restaurant’s own website, which see your IP address and browser details like any image request.

Cookies and browser storage

Stripe sets its own cookies on its checkout and billing pages, under Stripe’s policy.

Who helps us run TapEm

• Vercel — hosts the website; like any web host, it sees the IP address of each request.
• Supabase — hosts our database.
• Google — Places search, listing details and photos.
• An AI service — writes page wording from public listing information.
• Resend — sends sign-in links and weekly reports.
• Stripe — payments and the billing portal.
• Meta — advertising measurement, as described above.

They may process information outside Canada, including in the United States, where it is subject to local law.

How long we keep it

• Sign-in link requests: 30 days (removed at the next weekly clean-up).
• Owner email addresses and page content: as long as the page exists.
• Tap and button logs: as long as the page exists, for the owner’s reports.
• Text-list sign-ups and private feedback: until the restaurant or you ask us to delete them, or the page is deleted.
• Build records (the IP address, time and restaurant of each page build, and the browser type and ad-click details saved with it): 12 months, then deleted at the weekly clean-up. The campaign tags showing which ad a page came from stay with the page.
• Orders and payment records: as long as tax law requires — in Canada, generally six years.

Your choices

Email help@tapem.io to ask what we hold about you, to correct it, or to delete it — from the address concerned, or with the phone number you used for a text list. We reply within 30 days. To stop the Monday report, reply to it or write to us.

If you’re not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

TapEm is a service for businesses and isn’t directed at children.

Changes

When this changes, we update this page and the date at the top.