Privacy Policy
How we collect, use, and protect merchant and customer data.
1. Information We Collect from You as a Merchant
• Account data: name, email, phone number, store name and description, logo.
• Payment data: billing details (full bank card data is not stored with us; it is processed through an approved external payment gateway).
• Usage data: login logs, the settings you configure (System Prompt, the model used), and statistics of your use of the platform.
• Your customers' data (Sub-processing): as a Data Processor on your behalf, we store your store's customer conversation data (name, phone number, conversation content) on your behalf, with you as the Data Controller toward your customers.
2. How We Use Your Data
• Operating your account and providing the contracted service.
• Communicating with you regarding invoices, technical updates, and subscription status.
• Improving service quality through aggregated and anonymized analytics.
• Marketing communication (offers, new features) — this is entirely optional, and you can unsubscribe at any time without affecting your core service.
3. Data Retention Period
• Your account data: throughout the subscription period, and for 90 days after cancellation for retrieval purposes, then permanently deleted.
• Invoice data: retained for the period required by Egyptian law.
• Your customers' data stored on your behalf: subject to the same retention policy you set in your settings, otherwise the platform's default period (6 months) applies.
4. Your Rights
You have the right to request a copy of your data, correct it, or delete your account entirely (subject to the legal obligations to retain certain records, as in clause 3). You can export your store's data (products, conversations) directly from the dashboard, or by requesting it from technical support.
5. Sharing Data with Third Parties
We share your data only with:
• AI providers (to run the chatbot), with only the minimum necessary.
• The payment gateway provider (to process invoices).
• The email service provider (to send notifications).
• Government authorities where required by law.
We do not sell your data to any third party for marketing purposes under any circumstances.
6. Data Security
We apply technical measures (encryption, restricted access permissions, monitoring through error-tracking systems) to protect your data. In the event of a security breach affecting your data, we will notify you within a reasonable time.
7. Your Relationship with Your Customers
As a merchant using a chatbot to serve your customers, you are the legally responsible party (Data Controller) for your customers' data toward them, and you must:
• Inform your customers that they are talking to an AI-powered system.
• Obtain their necessary consent if you use their data for marketing purposes.
The platform (TapSaaS) acts solely as a Data Processor with respect to your customers' data, and executes your instructions regarding how it is processed and deleted.
8. Data We Receive from Facebook and Instagram (Meta)
When a business connects its Facebook Page or Instagram professional account to TapSaaS, we receive the following from Meta, only for that business's own Page and account:
• Messages that people send to the Page on Messenger or to the Instagram account by Direct Message, and the replies sent back.
• The sender's public profile: first and last name (on Instagram: name and username) and a link to their profile picture. We request it only after the person has messaged the business, and refresh it at most once every 7 days.
• Comments on the business's own Facebook posts and Instagram media, and posts and comments in Facebook groups that the business's Page manages: the comment text, the commenter's name or username, and the link and text of the post.
• The name and id of the connected Page and Instagram account, and the access token Meta issues for them (stored encrypted).
Why we use it: to show the business who it is talking to in its TapSaaS inbox, to let the business and its AI assistant answer these messages, and to send the automatic public and private replies to comments that the business has set up. We do not use this data for advertising, we do not sell it, we do not share it with other businesses, and we do not combine it across businesses.
How long we keep it: for as long as the business's TapSaaS account is active, under the retention periods in section 3. It is deleted no later than 90 days after the business closes its account.
How to delete it: anyone can ask us to delete the data we hold about them, as explained on our Data Deletion page: https://aichatbot.tapsaas.net/data-deletion. A business can also disconnect its Page or Instagram account at any time from Channels in its dashboard; no new data reaches TapSaaS after that.
9. Contact Us
For any question about this policy or your data, or to make a data request, email support@tapsaas.net.