Data Processing Agreement

Last updated 30 October 2026

This agreement is part of the Terms of service between Esipick LLC (“Tapline”, the “Processor”) and the business that holds a Tapline account (the “Brand”, the “Controller”). It applies when Tapline processes personal data for the Brand and the General Data Protection Regulation (EU) 2016/679 (“GDPR”) or a similar law applies. It takes effect when the Brand accepts it in Tapline, or when it first uses Tapline after we published it, and lasts as long as Tapline processes that data.

1. What this covers

Subject matter and purpose: running the Brand's Tapline pages, QR codes and tags: showing pages to shoppers, counting scans, collecting email sign-ups, showing the Brand's product records, and passing data to tools the Brand connects (for example webhooks, Klaviyo, Shopify).
People: shoppers and other visitors who open the Brand's pages or scan its codes, and who sign up to its lists.
Data: scan records (time, device type, referrer, country and city when available, a keyed hash of the IP address, never the address itself), email addresses with the consent text and time, and anything else a shopper enters on a Brand's page. Tapline does not ask for special categories of data and the Brand must not collect them through Tapline.
Tapline's own data about the Brand's staff (accounts, billing) is not covered here. Tapline is the controller of that data; see the Privacy policy.

2. What Tapline does

Processes the data only on the Brand's documented instructions: these terms, the Terms of service, and what the Brand sets up in the product. If Tapline thinks an instruction breaks data protection law, it says so.
Makes sure people who can reach the data are bound by confidentiality.
Keeps appropriate security measures (GDPR Art. 32), listed in Annex 1.
Helps the Brand answer shoppers' requests (access, correction, deletion, objection) and meet its other duties, including impact assessments and contacting a regulator, as far as the nature of the processing allows. If a shopper asks Tapline directly, Tapline passes the request to the Brand.
Tells the Brand without undue delay after becoming aware of a personal data breach affecting the Brand's data, with what it knows about what happened, the data and people involved, and what it is doing.
Deletes the Brand's data when the account is closed, or returns it first on request (an export), unless the law requires keeping it. Data in backups is removed as the backups expire.
Gives the Brand what it reasonably needs to check that Tapline follows this agreement, including answers to written questions. An on-site audit needs reasonable notice, a confidentiality agreement and must not disrupt other customers.

3. Sub-processors

The Brand agrees that Tapline may use the sub-processors in Annex 2 and may add or replace others. Tapline puts the current list on this page and, for a change that affects shoppers' data, gives the Brand at least 14 days' notice by email or in the product. The Brand can object on reasonable data protection grounds within that time; if the parties cannot agree, the Brand may close the account. Tapline puts the same data protection duties on each sub-processor and stays responsible for them.

4. Transfers outside the EU and UK

Tapline is based in the United States, the servers that run Tapline are in Kuala Lumpur, Malaysia, and some sub-processors are in the United States. Where personal data covered by GDPR is transferred to a country without an adequacy decision, the transfer relies on the standard contractual clauses approved by the European Commission (Decision (EU) 2021/914), or another mechanism GDPR allows. The parties agree that, where needed, those clauses (Module Two, controller to processor, and Module Three for sub-processors) are part of this agreement, with the details in this agreement and Annexes 1 and 2 filling them in, and with Irish law and courts for them.

5. What the Brand does

The Brand is the controller: it decides why shoppers' data is collected and must have a legal basis for it.
The Brand tells shoppers what it does with their data (its own privacy notice) and gets their consent where the law needs it, for example for marketing emails. Tapline's sign-up block records the consent text shown.
The Brand must not use Tapline to collect data it is not allowed to collect.

6. Liability, law and changes

Liability under this agreement is subject to the limits in the Terms of service, except where the law does not allow a limit. The law that governs the Terms governs this agreement, except for the standard contractual clauses in section 4. If this agreement conflicts with the Terms on personal data, this agreement wins. We may update this agreement for legal or product reasons; the date at the top shows the version, and for a material change we ask the Brand to accept the new version in Tapline.

Annex 1. Security measures

Encryption in transit (HTTPS) and encrypted secrets, tokens and off-site backups.
Passwords stored hashed; two-factor authentication for Tapline staff; access limited to those who need it.
Keyed hashes in place of stored IP addresses; rate limiting; separation of each Brand's data.
Separate production and staging systems; daily backups; a written breach response procedure.

Annex 2. Sub-processors

Hostinger: hosting of the servers that run Tapline, in Kuala Lumpur, Malaysia.
Amazon Web Services (eu-north-1, Stockholm): uploaded media and encrypted backups.
Resend: transactional email.
Klaviyo: only if the Brand connects it, to receive consented email sign-ups.
Shopify: only if the Brand connects it; Tapline reads product data and sends no shopper data.
Stripe, Google, Apple, Anthropic and ElevenLabs process data for Tapline's own purposes (billing, sign-in, analytics with consent, page drafts, the assistant); they do not receive shoppers' data from a Brand's pages.

Contact

Esipick LLC, 6545 Market Ave. North Ste 100, North Canton, OH 44721, USA. contact@tapline.store.

1. What this covers

Subject matter and purpose: running the Brand's Tapline pages, QR codes and tags: showing pages to shoppers, counting scans, collecting email sign-ups, showing the Brand's product records, and passing data to tools the Brand connects (for example webhooks, Klaviyo, Shopify).

People: shoppers and other visitors who open the Brand's pages or scan its codes, and who sign up to its lists.

Data: scan records (time, device type, referrer, country and city when available, a keyed hash of the IP address, never the address itself), email addresses with the consent text and time, and anything else a shopper enters on a Brand's page. Tapline does not ask for special categories of data and the Brand must not collect them through Tapline.

Tapline's own data about the Brand's staff (accounts, billing) is not covered here. Tapline is the controller of that data; see the Privacy policy.

2. What Tapline does

Processes the data only on the Brand's documented instructions: these terms, the Terms of service, and what the Brand sets up in the product. If Tapline thinks an instruction breaks data protection law, it says so.

Makes sure people who can reach the data are bound by confidentiality.

Keeps appropriate security measures (GDPR Art. 32), listed in Annex 1.

Helps the Brand answer shoppers' requests (access, correction, deletion, objection) and meet its other duties, including impact assessments and contacting a regulator, as far as the nature of the processing allows. If a shopper asks Tapline directly, Tapline passes the request to the Brand.

Tells the Brand without undue delay after becoming aware of a personal data breach affecting the Brand's data, with what it knows about what happened, the data and people involved, and what it is doing.

Deletes the Brand's data when the account is closed, or returns it first on request (an export), unless the law requires keeping it. Data in backups is removed as the backups expire.

Gives the Brand what it reasonably needs to check that Tapline follows this agreement, including answers to written questions. An on-site audit needs reasonable notice, a confidentiality agreement and must not disrupt other customers.

3. Sub-processors

4. Transfers outside the EU and UK

5. What the Brand does

The Brand is the controller: it decides why shoppers' data is collected and must have a legal basis for it.

The Brand tells shoppers what it does with their data (its own privacy notice) and gets their consent where the law needs it, for example for marketing emails. Tapline's sign-up block records the consent text shown.

The Brand must not use Tapline to collect data it is not allowed to collect.

6. Liability, law and changes

Annex 1. Security measures

Encryption in transit (HTTPS) and encrypted secrets, tokens and off-site backups.

Passwords stored hashed; two-factor authentication for Tapline staff; access limited to those who need it.

Keyed hashes in place of stored IP addresses; rate limiting; separation of each Brand's data.

Separate production and staging systems; daily backups; a written breach response procedure.

Annex 2. Sub-processors

Hostinger: hosting of the servers that run Tapline, in Kuala Lumpur, Malaysia.

Amazon Web Services (eu-north-1, Stockholm): uploaded media and encrypted backups.

Resend: transactional email.

Klaviyo: only if the Brand connects it, to receive consented email sign-ups.

Shopify: only if the Brand connects it; Tapline reads product data and sends no shopper data.

Stripe, Google, Apple, Anthropic and ElevenLabs process data for Tapline's own purposes (billing, sign-in, analytics with consent, page drafts, the assistant); they do not receive shoppers' data from a Brand's pages.