Privacy policy

1.Who we are

TapCard.pk (“we”, “us”) designs and prints custom Google review cards and payment QR cards for businesses in Pakistan. We are the responsible party for the personal information described here, under the Personal Data Protection Bill and the Prevention of Electronic Crimes Act, 2016 (PECA).

Our information officer can be reached at shoptapcard@gmail.com, or by post at Johar Town, Lahore, Punjab, Lahore 54782.

2.What we collect, and why

We collect only what a transaction and an account actually require.

3.Payment card information

We never see your card details. When you pay by card you are handed over to the payment provider’s own hosted page, you enter your card there, and we receive a reference and — at most — the card brand and last four digits for your receipt.

No card number, expiry date or CVC is ever transmitted to, processed by, or stored on our servers. This keeps our deployment inside PCI-DSS SAQ-A, the smallest possible scope.

4.The people who scan your cards

This is the part that matters most to businesses using our cards, so it is worth being blunt about it.

On a normal card, we see nothing at all. The QR code we print encodes your own Google review link or your own bank QR directly. A customer scanning it goes straight there and never touches our servers. We could not track them if we wanted to.

The exception is a Smart QR card, if you order one. Those route through our short link so you can change the destination later, and for those we record that a scan happened, roughly when, and a coarse device class (iOS, Android, or other). That is the complete list.

We deliberately do not record:

• their IP address,
• any cookie or identifier on their device,
• any device fingerprint,
• their location beyond nothing at all,
• anything that would let us or you recognise the same person twice.

The redirect also sends a Referrer-Policy: no-referrer header, so the site they land on is not told which card sent them.

The consequence is that your scan counts are counts, not people. If you need to know who your customers are, that has to come from what they do at the destination, under that destination’s own privacy terms.

5.Who else sees your data

We share personal information only with the operators we need to run the shop:

• The payment provider — only if you pay by card. Cash-on-delivery and bank-transfer orders involve no payment processor at all.
• The courier — TCS or Leopards receive the delivery name, address and phone number, and the amount to collect on a cash-on-delivery order.
• Our email provider — your email address and the contents of order and support emails.
• Our hosting and database providers — as processors, under contract.

We do not sell personal information, we do not share it for advertising, and we do not give it to data brokers. If a lawful court order or statutory demand requires disclosure, we will comply and, where we are legally permitted to, tell you.

6.How long we keep it

• Order and invoice records — six years, as the Income Tax Ordinance, 2001 requires for business records.
• Account details and design briefs — for as long as your account is open, and for 30 days after you ask us to close it.
• Sign-in attempt logs — 24 hours.
• Scan events — 24 months, then deleted. They contain no personal data at any point.
• Support emails — 24 months.

7.Your rights

You may ask us to:

• confirm what personal information we hold about you, and give you a copy;
• correct anything that is wrong or out of date;
• delete information we no longer have a lawful reason to keep;
• stop using your information for a purpose you object to.

Email shoptapcard@gmail.com from the address on your account and we will respond within 30 days. There is no charge for a reasonable request.

One caveat worth stating plainly: your printed cards keep working after you close your account, because their codes point directly at your own listing or account. What you lose is the stored artwork, which means a future reprint starts from scratch.

If you are unhappy with how we have handled a request, tell us first and we will try to put it right. You can also raise it with the Pakistan Telecommunication Authority, which handles complaints under PECA.

8.How we protect it

• Passwords are stored as bcrypt hashes with a work factor of 12. We cannot read them.
• Sessions are signed, server-side records that can be revoked instantly — changing your password ends every other session immediately.
• All traffic is served over HTTPS with HSTS.
• Payment QR screenshots you send us are used to produce your card and are deleted from our working files once the job is printed. We never store the underlying account credentials, because we are never given them.
• Administrative access is restricted and separately authenticated.

If we ever suffer a breach affecting your personal information, we will notify you as soon as reasonably possible and tell you exactly what was exposed.

9.Changes to this policy

We will post any change here and update the date at the top. If a change materially affects how we use your personal information, we will email account holders before it takes effect.