Privacy policy

This policy explains how [Tapfuel legal entity] (“Tapfuel”, “we”, “us”) handles personal information when you visit tapfuel.works, use the Tapfuel app at https://app.tapfuel.works, or receive text messages from a brand that uses Tapfuel.

Who this policy is about

Tapfuel is a platform that businesses use to run text-message (SMS) marketing. That gives us two different roles:

Our customers and their users. When a business signs up, we decide how the account information is used. This policy covers that information directly.
Our customers’ contacts. When a brand uses Tapfuel to collect consent and send messages, the brand decides whom to text and why. We handle those contacts’ information on the brand’s behalf and only to provide the service to that brand. If you receive texts from a brand, that brand’s own privacy policy also applies, and the brand is the right first contact for questions about its messages.

Information we collect

From people who use the app

Account and profile: your name, email address, the accounts and brands you belong to, and your role in each.
Sign-in: we use Google Identity Platform to sign you in. If you sign in with email and password, Google Identity Platform stores and checks the password; Tapfuel never sees it. If you sign in with Google, we receive your name, email address and Google account ID.
Workspace content: brand names and settings, consent wording, campaigns, links, segments and the other things you create in the app, plus an audit log of changes.
Messaging provider credentials: the API keys or tokens for the messaging provider account you connect, and its sender numbers and registration IDs. Credentials are encrypted before they are stored.

About a brand’s contacts

Contact details: phone numbers, and any CRM ID or other fields the brand chooses to import or sync.
Consent records: when and how a person opted in or out, the wording they agreed to, and signed receipts that prove it. Opt-outs are permanent for that brand.
Messages: the content of messages a brand sends or receives through Tapfuel, and their delivery status from the brand’s messaging provider.
Link visits: when someone opens a brand’s click-to-text link, we record the link, the time, the referral code in the link and basic technical information such as the browser type and IP address. We use this to count visits, attribute them to campaigns and prevent abuse.

From visitors to our websites

Our servers and Google Cloud keep standard request logs, including IP address, browser type and the page requested, for security and troubleshooting. We do not write phone numbers or message content to these logs. At the time of this update, tapfuel.works and the Tapfuel app use no advertising or analytics cookies. The app stores your sign-in session in your browser so you stay signed in.

Google user data

Tapfuel requests only the basic sign-in scopes from Google (your name, email address and account ID). We use them only to create your Tapfuel sign-in, keep you signed in, and show your name in the app. We do not use Google user data for advertising, we do not sell it, and we do not transfer it to anyone except as needed to provide sign-in, for security, or where the law requires it.

Tapfuel’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we use information

To provide the service: run campaigns, send messages through the brand’s provider, record consent and opt-outs, host link pages and produce reports.
To keep accounts secure, prevent fraud and abuse, and enforce our terms.
To support customers and tell them about changes to the service.
To meet legal obligations, such as keeping records of consent and honoring opt-outs.

We do not sell personal information, and we do not use a brand’s contacts for any purpose other than providing the service to that brand.

Brands, not Tapfuel, decide whom to text. If you no longer want messages from a brand, reply STOP to any of its messages. Tapfuel records the opt-out and blocks that brand from texting you again. Reply HELP for help from the brand.

Mobile phone numbers and consent information collected for text messaging are not shared with third parties or affiliates for their own marketing or promotional purposes.

Service providers that run Tapfuel for us, under contracts that limit their use of the data. Our main provider is Google Cloud (hosting, database, encryption keys and sign-in).
The brand’s messaging provider. Messages go out through the provider account the brand connects, such as Twilio. That provider handles message content and phone numbers under its agreement with the brand.
Tracking pixels a brand chooses. A brand can add pixels from Meta, Google, TikTok or LinkedIn to its link pages. When it does, the page shows a notice, and those companies receive information about the visit under their own policies.
The law and safety. We may disclose information when the law requires it, or to protect people, our customers or Tapfuel from harm or fraud.
Business transfers. If Tapfuel is merged, acquired or sells its assets, information may transfer as part of that deal, under this policy’s protections.

Health information

Tapfuel is not built for protected health information, and customers agree not to upload it.

Where information is stored

Tapfuel stores its data with Google Cloud in the United States.

How long we keep information

Account information is kept while the account is open and deleted within a reasonable period after it closes, unless the law requires us to keep it longer.
Consent records and opt-outs are kept for as long as they are needed to prove consent or honor an opt-out, which can be after the brand’s account closes.
Request logs are kept for a limited period for security and troubleshooting.

Security

Connections to Tapfuel are encrypted. Messaging provider credentials are encrypted with a key for each account, and those keys are themselves protected by Google Cloud’s key management service. Access to customer data is limited to people who need it to run the service. No system is perfectly secure, so please contact us at once if you believe your account has been compromised.

Your choices and rights

You can see and change most of your account information in the app. You can ask us to access, correct or delete your personal information, or to stop a use you object to, by writing to privacy@tapfuel.works. Depending on where you live, you may have further rights under local law, and we will honor them.

If you are a brand’s contact, please send requests to the brand first. If you write to us, we will pass your request to the brand and help it respond.

Children

Tapfuel is a service for businesses and is not directed to children. We do not knowingly collect information from anyone under 18.

Changes to this policy

We will update this page when our practices change and change the date at the top. If a change is significant, we will tell account owners by email or in the app before it takes effect.

Contact

[Tapfuel legal entity]
Email: privacy@tapfuel.works