Privacy Policy
DRAFT · Version privacy-draft-2026-08-29-v4 · Last updated August 29, 2026
This draft describes current product behavior at a high level and flags subjects that require a counsel-approved policy. It is intentionally incomplete and is not legal advice.
A current list of subprocessors (vendors that process data on our behalf) lives at /trust and revs independently of this Privacy Policy.
1. Information we handle
The client platform handles account details (name, email, authentication records), organization and project content, feedback and QA artifacts, support communications, billing contacts and invoice metadata, and operational/security logs needed to provide and secure the service.
Counsel must approve the final categories, legal bases, and any jurisdiction-specific notices.
2. How we use information and who helps us
Information is used to authenticate users, operate and secure the platform, deliver client work, communicate about the service, bill for paid features, and meet applicable obligations.
Processors currently used by the platform (generated from the platform's own processor registry so this list cannot drift from the code):
Anthropic (Claude API / claude CLI) — Cloud LLM for typed, non-verbatim projections: intake-consultation reasoning, planner/generation prompt composition (subscription-billed via the claude CLI), and prospect/lead research.
Neon (PostgreSQL) — Primary application database.
Vercel — Application hosting, build pipeline, and file (Blob) storage.
Microsoft 365 (Graph, app-only) — Outbound transactional email (account and lifecycle notices).
Stripe — Billing and invoicing (invoice-then-pay; no stored-card auto-charge).
Dropbox Sign (HelloSign) — E-signature for NDAs and engagement contracts.
Sentry — Error monitoring (error events only; PII collection disabled). Status: evaluated not armed.
See also the Subprocessors page at /trust for purpose, data categories, and effective date in table form.
3. Cookies and similar technologies
The platform uses only essential cookies and local browser storage — sign-in, security, and saved preferences (like theme and dismissed notices). TapQuality currently installs no analytics, advertising, or third-party tracking technology, so there is no optional cookie category and no consent decision to make; the on-screen notice is informational and can be dismissed.
4. Retention criteria
We keep account, brief, and project information while your account is active and the engagement requires it, and afterward as needed for legitimate legal, security, dispute, or accounting obligations. Retention length depends on the record type (account credentials and auth logs, project/work product, billing records, and support communications each follow different operational needs). You can request deletion from the portal or by emailing privacy@tapquality.ai; a person reviews the request before data is removed to prevent accidental loss.
Criteria we use when deciding how long to keep a record include: whether the account or engagement is active; whether the record is needed to provide the service; legal, tax, and accounting requirements; security and fraud-prevention needs; and whether a deletion or export request is pending. Final retention schedules and deletion exceptions must be supplied or approved by counsel.
5. Your rights
Depending on where you live and applicable law, you may have rights to: access the personal information we hold about you; correct inaccurate information; delete information; export or receive a portable copy; object to or restrict certain processing; appeal a decision we make about a privacy request; and lodge a complaint with a supervisory authority.
To exercise these rights, use in-product controls where available or email privacy@tapquality.ai. We may need to verify your identity before acting on a request. Some rights are subject to legal exceptions (for example, retaining invoices required for tax records).
Pending counsel — not approved · do not rely on as final terms
6. International transfers
TapQuality and several subprocessors operate in the United States. If you access the Services from another country, your information may be processed in the United States or other locations where our providers operate.
[PENDING COUNSEL — transfer mechanism.] Counsel must specify the contractual or statutory transfer safeguards (for example, standard contractual clauses or successor mechanisms) that apply to cross-border transfers. No specific transfer mechanism is claimed by this draft.
7. Security, children, and changes
We apply reasonable technical and organizational measures appropriate to the nature of the Services. No method of transmission or storage is perfectly secure.
The Services are directed to business users; they are not intended for children under 16 (or the equivalent minimum age in your jurisdiction).
We may update this Privacy Policy by posting a new version with an updated version stamp and last-updated date. This page revs independently of Terms, Acceptable Use, and Subprocessors. Material changes will be signaled through the Services or by email when practical.
8. Privacy contact
Privacy questions and requests: privacy@tapquality.ai. General support: support@tapquality.ai or tap@tapquality.ai. Postal inquiries may be directed to TapQuality AI LLC; counsel will confirm the formal mailing address for privacy notices.