Privacy policy

Jan Louis Hillbrand

Diebrocker Str. 214

32051 Herford

Email: info@taptex.cloud

Phone: 0160 4748567

(hereinafter “we”, “us” or “TapTex”)

This statement informs you which personal data we process when you visit our website taptex.cloud, create an account, order a TapTex sign or tap a sign as a visitor — and which rights you have. As a rule we only process the data necessary for operation, performance of the contract and legal obligations.

TapTex is hosted at Vercel Inc. When the website is called up, the hosting provider automatically records technical information (IP address, date/time, page called up, browser type, referrer URL) in server log files. This is technically necessary in order to deliver the page to you and to detect attacks/misuse (Art. 6 (1) (f) GDPR, legitimate interest in operation and security). Log files are deleted automatically after 30 days at the latest, unless they are needed to investigate a specific security incident.

In addition, we count page views in order to see how heavily the website is used: all that is stored is the time, the area of the site accessed (such as “/produkte”) and the language version. No IP address, no identifier, no cookie and no other data that could establish a link to you are stored; individual views cannot be attributed to a person or a device, nor combined into a visit. This is therefore a plain tally without any personal reference. Nothing is stored on or read from your device for this purpose (§ 25 TDDDG), and no consent is required. These entries are deleted after 90 days.

When you register we collect your email address, your password (encrypted/hashed, never stored in plain text — managed by our authentication provider Supabase) and the household name you choose. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR).

Within your household we store: doorbell and parcel requests (time, selected reason, voluntary door note, optional callback number), presence status, household members or labels, and drop-off locations. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR).

Visitors who tap a sign do not have to register. We only store what a visitor enters voluntarily, linked to the respective sign ID — not to a real identity. The visitor’s IP address may be processed briefly to detect misuse (rate limiting against prank ringing) (Art. 6 (1) (f) GDPR).

If you activate push notifications, your browser creates a unique push endpoint — an address at the push service of your browser manufacturer — together with two cryptographic keys. We store this information with your account and use it exclusively to deliver doorbell and parcel notifications to you. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR); storing the endpoint on your device is based on your consent, which you give by activating it (§ 25 (1) TDDDG).

Delivery itself runs, for technical reasons, via your browser’s push service: Google (Firebase Cloud Messaging) for Chrome, Edge and most Android browsers, Apple (Apple Push Notification service) for Safari and on iOS, Mozilla for Firefox. The content of each notification is end-to-end encrypted and is only decrypted on your device — the push services can read neither sender, reason nor a door note. All they can see is that a message is being delivered to your endpoint.

On the lock screen we deliberately show little: the name of your household and the reason, but no door notes, callback numbers or other information from visitors. For details you have to open the dashboard and log in.

You can withdraw your consent at any time: in the dashboard under “Notifications” via “Deactivate for this device”, or in the settings of your device or browser. When you deactivate it in the dashboard we delete the stored endpoint immediately. Endpoints permanently reported as invalid by the push service (for instance after uninstalling the app) are removed automatically. The withdrawal does not affect the lawfulness of processing carried out up to that point.

TapTex can be installed as an app on a phone or computer. For this your browser registers a so-called service worker and stores a small program shell locally on your device: logo, icons and a notice page in case there is no connection. This is strictly necessary to operate the function you requested (§ 25 (2) no. 2 TDDDG) — on the iPhone notifications are delivered exclusively to installed web apps.

Only these impersonal components are cached. Your dashboard, your doorbell history, server responses and visitor pages are deliberately not stored locally — no personal data ends up there. You remove this data again by uninstalling the installed app or deleting the website data in your browser.

We send transactional emails (confirmations, invitations to sub-accounts, receipts) via our service provider Resend. A data processing agreement pursuant to Art. 28 GDPR is in place with Resend.

We process payments exclusively via the payment service provider Stripe. You enter your payment data (e.g. credit card number) directly at Stripe on a page hosted by Stripe — it never passes through our own servers at any point. Stripe’s privacy notices apply in addition (stripe.com/privacy).

We only use technically necessary cookies, in particular the session cookie with which our authentication provider Supabase recognises you after logging in. We use no tracking, no analytics and no advertising cookies.

Besides cookies we store on your device: the service worker script and the program shell of the installable app (see section 6a) as well as — only if you activate it — the push endpoint for notifications (see section 6). For the technically necessary components no separate consent is required under § 25 (2) no. 2 TDDDG or Art. 6 (1) (b) GDPR, which is why we do not display a cookie banner. For the push endpoint we obtain your consent expressly before anything is stored.

We use the following service providers, with each of whom data processing agreements or standard contractual clauses are in place:

Supabase (database & authentication, server location Frankfurt am Main/EU)

Stripe (payment processing)

Resend (transactional email)

Vercel (hosting/delivery of the website)

In addition there are the push services of the browser manufacturers, provided you have activated notifications — Google (Firebase Cloud Messaging), Apple (Apple Push Notification service) and Mozilla. They deliver the notification to your device but cannot read its content because it is end-to-end encrypted (see section 6). Since the delivery path is determined solely by your choice of browser, this integration is not structured as processing on our behalf.

Your data is not passed on beyond these purposes unless we are legally obliged to do so.

Individual service providers (including Stripe, Resend, Vercel) may process data partly outside the EU/EEA, in particular in the USA. In these cases we ensure an adequate level of data protection through EU standard contractual clauses (Art. 46 GDPR), or the providers are certified under the EU-US Data Privacy Framework.

If you activate push notifications, delivery runs via your browser’s push service; with Google and Apple this involves processing in the USA. Both companies are certified under the EU-US Data Privacy Framework. Only your push endpoint and the encrypted message are transmitted — the services cannot see the content. If you want to avoid this transfer, simply do not activate push; all other TapTex functions remain usable unchanged.

We store your data for as long as your account exists. Your doorbell history remains visible in the dashboard for as long as your household exists and is removed when it is deleted. Statutory retention periods of six or ten years apply to accounting records (§ 257 HGB, § 147 AO) — we delete these documents only after the period has expired.

You have the right at any time to:

information about the data we store (Art. 15 GDPR)

rectification of incorrect data (Art. 16 GDPR)

erasure of your data (Art. 17 GDPR)

restriction of processing (Art. 18 GDPR)

data portability (Art. 20 GDPR)

object to processing (Art. 21 GDPR)

withdraw a consent you have given, with effect for the future (Art. 7(3) GDPR) — the lawfulness of processing carried out until then is unaffected

You can change your display name directly in the dashboard under “Settings”. For all other matters — information, deletion of your account, export of your data or other requests — contact us informally at info@taptex.cloud. We handle your request within the statutory period of one month.

Providing your data is neither required by law nor by contract, and you are not obliged to provide it. Without it we cannot perform the function in question: no account without an email address, no sign shipped without a delivery address, no notification without a push endpoint. No disadvantage arises for you beyond the function concerned.

Automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place.

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestr. 2–4, 40213 Düsseldorf.

We adapt this privacy policy as soon as our services or the legal situation change. The version current at the time of your visit applies.