Privacy Policy

TapCard is operated by Laboise eworker Laos enterprise (Tax ID 275618471000, registration 08/04 – 000001253). This is a Lao company. It serves people in Laos and in other countries.

Its Southeast Asia headquarters is at 20 Rue Samsenthai, Vientiane, Lao PDR. Its principal headquarters, for the direction of TapCard and for disputes, is in Ontario, Canada. No separate Canadian street address is published on this page. The company that you contract with is the Lao enterprise named above.

Privacy questions go to hello@tapcard.asia or WhatsApp +856 20 555 280 34.

The laws that apply

Commercial personal information is handled under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA, S.C. 2000, c. 5). Ontario has no general private-sector privacy statute that replaces PIPEDA, so PIPEDA is the Canadian rule for this service. A breach that creates a real risk of significant harm will be notified to the people affected and, where PIPEDA requires it, to the Office of the Privacy Commissioner of Canada.

Because the company is established in Lao PDR, it also follows the Law on Electronic Data Protection No. 25/NA of 12 May 2017 and the Instruction on its implementation No. 2126/MTC of 8 August 2018, supervised by the Ministry of Technology and Communications.

If a person in the European Economic Area or the United Kingdom uses TapCard, they may email us to access, correct, delete, or object to their information. This policy does not claim an EU representative, EU-only hosting, or a certification. We do not sell personal information. We do not claim SOC 2, ISO, or a similar audit.

Who decides

• We decide why account data, setup requests sent to TapCard, and site security records exist. We are accountable for those.
• If you publish a card, you choose what the card says. Visitors who leave their details are writing to you. We store those leads so you can read them. You are responsible for how you use them.
• A visitor can ask us, or the card owner, to delete a lead.

What we store

Only what the product needs:

• Account: name, email, and a hash of the password. We do not store the password itself.
• Card: the name, role, company, phone, email, website, address, social links, bio, colours, and pictures the owner adds, plus whether the card is published.
• Lead: the name, email, phone, company, and note a visitor types on a card, and the time. A hidden field that only robots fill is dropped and not stored.
• Setup request: the same kind of fields from the form for shops that want TapCard.
• Count: a card view adds one to a counter. We do not build a location or device profile from that count.
• QR code: the code on the card is the contact details already on the card, so another phone can offer to save them. Scanning it does not create a new account.

We do not ask for a passport or a national ID. If you subscribe, Stripe stores the payment card. We store only the Stripe customer id, the subscription id, the plan name, and whether the subscription is active. The site does not send email and does not sell rows to anyone.

Why we use it

• To show the card and the QR code.
• To give the card owner the leads from that card.
• To run sign-in and the dashboard.
• To answer a request for a TapCard.
• To stop abuse, including the honeypot on the forms.
• To meet a legal duty in Canada or in Lao PDR.

We rely on the consent you give by creating an account, publishing a card, or submitting a form, and on the limited cases where PIPEDA allows a use without a fresh consent. You can withdraw consent by closing the card or writing to us. Withdrawal does not undo a use that already happened.

Who else sees it

• The card owner sees the leads from their own card.
• Anyone with the card link can see what the owner published on that card.
• A company that hosts the database may process the rows on our instructions. This copy is not on a public host yet. When a public host is in use, its name will be added here.
• We disclose information if Canadian or Lao law requires it, or to answer a court in Ontario.

We do not sell, rent, or trade personal information.

Where it sits

TapCard is offered from Laos and from Canada, and people in other countries may open a card. Information may be stored in Canada, in Lao PDR, or in the country of the host we name later. A transfer outside your country is made so the service can run, and we keep the access limited to that purpose.

How long

An account and its cards stay while the account is open. Deleting a card deletes the leads on that card. Leads stay until the card is deleted or you ask us to remove them. Setup requests stay until we have dealt with them and no longer need them for a record. We do not keep a copy for marketing, because this service does not send marketing mail.

Your choices

• Email hello@tapcard.asia to see, correct, or delete the information we hold about you. We will answer within 30 days.
• A card owner can edit or delete a card from the dashboard. Deleting the card removes its leads.
• There is no self-serve button yet to delete a whole account. Write to us and we will close it.
• You may complain to the Office of the Privacy Commissioner of Canada, and, for processing tied to Lao PDR, to the Ministry of Technology and Communications.

Security

Passwords are stored as a hash. Sign-in uses a session cookie described in the Cookie Policy. Pages are served over HTTPS when the public site is on. These are ordinary safeguards, not a certification.

Children

TapCard is not for children under 16. We do not knowingly keep an account for a child. Write to us if you believe we have.

Changes

If this policy changes in a way that matters, the date at the top will change. Continued use after that date means you have seen the new text. The Terms of Service explain the contract, including Ontario as the place of dispute.