Privacy Policy

Who is responsible

Etunimi Sukunimi, Finland, hello@tapsa.io, is the controller of the account data described below. For your store's data we act as your processor under the Data Processing Agreement.

Account data

Name, email address and password (stored only as a one-way hash), or your Google account's name and email if you sign in with Google.

Sign-in sessions with the IP address and browser they came from, kept while the session is valid, to keep your account secure.

The company name and the answers you give when you sign up, your settings, and the feedback you send us.

Which sections of Tapsa you open, counted per day (not what you look at in them), so we can see what is useful.

Purpose and basis: providing the service under our contract with you, and our legitimate interest in keeping it secure and improving it.

Store data

Orders (amounts, dates, products, country, where the visit came from), products, stock levels, and figures from the ad and email tools you connect.

We never store your customers' names, email addresses, phone numbers or addresses. A buyer is represented only by a keyed one-way code, enough to tell repeat buyers apart and impossible to turn back into a person.

Where data is kept and who processes it

Data is stored in the EU, in Finland. Access keys to your connected services are encrypted. We use these service providers:

• Google Cloud (Google Cloud EMEA Ltd): hosting and database, in the europe-north1 region (Hamina, Finland).
• Anthropic (Anthropic PBC, USA): the Ask Tapsa assistant. It receives your store's summed-up figures needed to answer a question, never customer identifiers. Anthropic does not train its models on this data.
• Resend (Resend Inc., USA): sending account emails such as invitations, password resets and reports.

Transfers to the USA rely on the EU–US Data Privacy Framework or the EU's standard contractual clauses.

How long

Account data is kept while you have an account and deleted within 30 days after you delete it.

Store data is deleted when the store is removed from Tapsa or uninstalled in Shopify (Shopify asks us 48 hours after uninstalling), and at the latest within 30 days, including backups.

Cookies

Tapsa uses only the cookies needed to keep you signed in, and stores a few preferences (such as light or dark mode) in your browser. No advertising or tracking cookies.

Your rights

You can ask to see, correct, export or delete your personal data, and object to processing based on legitimate interest, by writing to hello@tapsa.io. You can also complain to the Finnish Data Protection Ombudsman (tietosuoja.fi).

Changes

We'll tell you about material changes in the app or by email. Version 2026-10-17.