Security and data practices

Tapline lets a brand add a product, builds a mobile product page for it, and lets shoppers reach that page by QR code or NFC tag. Tapline is operated by Esipick LLC, 6545 Market Ave. North Ste 100, North Canton, OH 44721, USA.

For how personal data is used and what your rights are, read the Privacy policy.

• Brand users: name, email address, a hash of the password (not the password), the Google or Apple identifier if you sign in that way, and the time of your last sign-in.
• Brand content: products, product pages, and the images and videos a brand uploads.
• Billing: card numbers are entered into Stripe's own form and are not stored by us. We keep the card brand and last four digits that Stripe returns, Stripe identifiers, and order records for tags.
• Shopper emails: when a shopper submits an email address on a brand's page, we store the address, the list name, the consent sentence that was shown, the browser user agent and a keyed hash of the IP address. The brand can see, export and remove these in the portal.
• Scan records: for each scan or tap we store the time, which code was used, the browser user agent, the device type taken from it, the referring page and a keyed hash of the IP address. The record also has country and city fields, which are empty at the moment.
• Contact form: name, email address, company, message and a keyed hash of the IP address. The message is also emailed to our support inbox.
• Sign-in sessions: a hash of each refresh token, the browser user agent and, for the mobile app, a device name. We do not store an IP address for sessions.
• Server logs: our web server writes access logs that include IP addresses. They are rotated daily and 14 daily files are kept.

• Connections to tapline.store use HTTPS. Requests to http:// are redirected to https://.
• The server accepts TLS 1.2 and TLS 1.3 only. The certificate is issued by Let's Encrypt and renewed by certbot on a schedule.
• We send Strict-Transport-Security (two years, including subdomains), Content-Security-Policy, X-Content-Type-Options, X-Frame-Options and Referrer-Policy headers.
• Passwords are stored only as Argon2id hashes.
• Sign-in cookies are HttpOnly, Secure and SameSite=Lax. Refresh tokens are stored as hashes, and each one is revoked and replaced when it is used.
• IP addresses are stored in our database only as a keyed hash (HMAC-SHA-256, with a secret key kept in server configuration), not as the address.
• We limit requests per IP address on sign-in, registration, password reset, the contact form, email capture, scan and tap requests, and AI page generation.
• The database and the job queue listen on the server's loopback address only, so they are not reachable directly from the internet.
• Staff access to the admin area passes through a password prompt at the web server and a separate staff sign-in.

• The application, its database and its job queue run on a virtual private server rented from Hostinger. Public IP geolocation lists that server in Kuala Lumpur, Malaysia.
• Uploaded images and videos are stored in Amazon S3 in the eu-north-1 region (Stockholm, Sweden). Encrypted copies of database backups are stored in the same bucket.
• Every object in that bucket reported server-side encryption (AES-256) when we checked on 15 October 2026.

• The production database is dumped once a day. Each dump is checked with pg_restore --list before older dumps are removed, and the server keeps the last 30 days of dumps.
• After each dump, a copy is encrypted with GPG (AES-256) and uploaded to the S3 bucket in eu-north-1. It is encrypted before it leaves the server.
• A restore of the on-server dump into a scratch database was rehearsed on 6 October 2026, and the restored copy matched production.
• A watchdog runs every 2 minutes and emails us if the last on-server backup or the last off-server copy is more than 26 hours old.

• Google Analytics loads on every page except the public e-label pages under /e/, which load no analytics.
• Tapline sets cookies to keep users signed in (bm_access and bm_refresh), to remember which organization a user has selected (bm_org_id) and, for staff, to keep the staff session (bm_staff_access).

These providers process data for Tapline. Last reviewed: 15 October 2026. Where the location says “Not stated”, we have not verified it.

• Hostinger

  Purpose

  Virtual private server that runs the Tapline application, its database and its job queue.

  Data involved

  Everything the application stores, including the database and server logs.

  Location

  Public IP geolocation lists the server in Kuala Lumpur, Malaysia.

• Amazon Web Services (S3)

  Purpose

  Storage for uploaded images and videos, and for encrypted copies of database backups.

  Data involved

  Files brands upload. Database backups, encrypted before upload.

  Location

  eu-north-1 (Stockholm, Sweden).

• Stripe

  Purpose

  Payments and subscriptions.

  Data involved

  Brand name, email address and organization identifiers; card details entered into Stripe's own form.

  Location

  Not stated.

• Resend

  Purpose

  Sending email: sign-in and password emails, invitations, order updates and contact form notices.

  Data involved

  Recipient address, subject and body of each email.

  Location

  Not stated.

• Anthropic (Claude)

  Purpose

  Drafting product pages and rewriting text. Called through the Claude command-line tool on our server.

  Data involved

  Product name, part number, product and brand web addresses, the brand's notes, product category, organization name, language and any text the brand asks to rewrite. The model may run web searches. Shopper data is not sent.

  Location

  Not stated.

• ElevenLabs

  Purpose

  The Tapline Assistant chat and voice widget on the marketing pages.

  Data involved

  What a visitor types or says to the assistant. The assistant asks visitors to agree to recording before they start.

  Location

  Not stated.

• Google

  Purpose

  Google Analytics, and Sign in with Google.

  Data involved

  Analytics: page views and device data collected by Google's tag. Sign-in: your Google account identifier, name and email address when you choose Google.

  Location

  Not stated.

• Apple

  Purpose

  Sign in with Apple.

  Data involved

  Your Apple account identifier and email address when you choose Apple. Deleting a Tapline account revokes the Apple token.

  Location

  Not stated.

Tapline does not currently hold SOC 2, ISO 27001 or similar certifications. We list our practices above so you can assess them.

• To ask what we hold about you, to have it corrected or to have it deleted, email contact@tapline.store. A person handles these requests by hand. There is no self-service data export yet.
• Deleting a brand user's account replaces the name and email address with placeholders, clears the password hash and the Google and Apple identifiers, ends all sessions, and deletes notifications and device tokens. The account record itself stays, anonymised, because orders and history refer to it. An account that still owns a team or a paid plan cannot be deleted until that is resolved. The web portal has no delete button for accounts today.
• When a brand removes a shopper email, or retires an organization with its products, pages and tags, the records are marked as deleted and hidden. They are not erased from the database.
• No scheduled job deletes scan records, so this page states no retention period for them.
• Backups made before a deletion still contain the data until those backups are removed.

Email contact@tapline.store with what you found and the steps to reproduce it. Please do not access, change or delete other people's data while testing.