Privacy

Last updated 28 October 2026

Who is responsible

The controller under the GDPR is Vilva Athiban Periyasamy Boominathan, Hiddenseer Straße 1A, 10437 Berlin, Germany (see Impressum). Contact for any privacy question: contact@tapuffin.com.

What we process, and why

Account data — email, a password hash (or your Google account ID if you sign in with Google), name and profile picture from Google if you choose Google sign-in. Purpose: running your account. Legal basis: contract (Art. 6(1)(b) GDPR).
Your card — everything you put on it (details, links, images, design). It is public at your card link because publishing it is the service. Legal basis: contract.
Contacts who save a card — only the fields the card owner asked for (for example name, company, email). These are shared with that card owner. For this data the card owner decides what is collected and how it is used; we process it on their behalf. Visitors can ask the card owner, or us, to delete it.
Teams — organisation name, members, roles and invitations, so owners and admins can manage their team.
Billing — your plan and subscription status. Card details are entered on Stripe’s pages and never reach our servers. Legal basis: contract; invoices are kept as tax law requires (Art. 6(1)(c)).
Wallet passes — for Apple Wallet, an anonymous device identifier and push token per pass so the pass can update; Google Wallet passes are stored by Google under our issuer account. Removing a pass stops updates.
Statistics — we count card views and whether they came from NFC, a QR code or a link. No third-party trackers, no advertising, no selling of data. Legal basis: legitimate interest in showing owners how their card is used (Art. 6(1)(f)).
Server logs — IP address, time and requested page, kept briefly to keep the service secure and to stop abuse such as password guessing. Legal basis: legitimate interest.
Emails — we send account emails (confirmation, password reset, invitations). We don’t send marketing.

Cookies

We only use strictly necessary cookies: one that keeps you signed in and a short-lived one that remembers where to return after Google sign-in. No analytics or advertising cookies, so there is no consent banner.

Service providers

Oracle Cloud Infrastructure (Frankfurt, Germany) — hosting, database, backups and sending email.
Stripe — payments and invoices.
Google — Google sign-in (if you use it) and Google Wallet passes.
Apple — delivering updates to Apple Wallet passes.

Stripe, Google and Apple may process data outside the EU. Where they do, transfers rely on the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses.

How long we keep data

Account and card data stay until you delete them or your account. Contacts stay until the card owner deletes them. Backups are kept for up to 30 days. Billing records are kept as long as tax law requires.

Your rights

You can ask for access, correction, deletion, restriction, data portability, and object to processing based on legitimate interest. Email contact@tapuffin.com. You may also complain to a supervisory authority, for example the Berliner Beauftragte für Datenschutz und Informationsfreiheit.