Skip to main content

Privacy Policy

Last Updated: October 24, 2026

Introduction

TapToChat.io is operated by JS Trading Ventures LLC, 5140 Howard Street, Skokie, Illinois 60077, United States ("we", "our", "us"), which is the controller of the personal information described here. We take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

Information We Collect

1. Information You Provide

  • Account information (name, email, password)
  • Organization details (company name, website URL)
  • Payment information (processed by Stripe, we don't store card details)
  • Chat conversations and messages
  • Profile information (avatar, bio, phone number)

2. Automatically Collected Information

  • Device information (browser type, OS, device ID)
  • Usage data (pages visited, features used, time spent)
  • IP address and geolocation
  • Cookies and similar technologies
  • Log data (timestamps, errors, performance metrics)
  • How you found us, recorded when you sign up or request a guide: the campaign tags and ad click identifiers on the link you arrived by, the first page you landed on, the site that referred you, and your cookie choices at that moment. Kept in your browser between visits only if you accept analytics or marketing cookies, and the ad click identifiers only if you accept marketing.

3. Information from Third Parties

  • CRM data (if you integrate Salesforce, HubSpot, etc.)
  • Social media profiles (if you connect Facebook, Twitter, etc.)
  • Emails, messages and contact details from the channels and tools you connect, such as Gmail, Outlook, Google Workspace, Slack, Microsoft Teams, Zendesk, Shopify, Zapier, WhatsApp, Messenger and Instagram
  • Payment information from Stripe

People Who Chat With Our Customers

Businesses use TapToChat to talk with their own customers by web chat, email and the other channels they connect. For those conversations the business decides what is collected and why, and we process it on the business's behalf. If you chatted with a business that uses TapToChat, that business is the first place to ask about your information.

  • A record of how each conversation started. Which of the business's channels it came through; who started it (the name, email address, phone number or messaging-platform identifier you gave or the platform provides); the date and time; and the message identifiers the email, text or messaging provider assigned. For email we also keep the provider's checks of whether the message really came from the address it shows. For web chat we also keep your IP address, browser details and country.
  • Opt-out records. When you ask to stop receiving messages, for example by replying STOP or UNSUBSCRIBE, we record the request: the channel, the address or number it applies to, the message you sent, when you sent it, the confirmation sent to you (or, where the text-message provider replied for us, that it did), and for web chat your IP address and browser. When you opt back in, for example by replying START, we record that too, with your message and the confirmation sent to you. If you write in ordinary words that you want to stop, the business's team is asked to confirm it, and we record who confirmed it. These records show that your request was honoured. If you reply HELP to a text or WhatsApp message, the answer we send (the business's name, how to stop, and how to contact it) is kept in the conversation like any other message.
  • The business's owners and administrators can see and export these records. Its other team members see only that an opt-out is in force, not the record behind it.

Messenger, Instagram and WhatsApp

A business can connect its Facebook Page (Messenger), its Instagram professional account or its WhatsApp Business number to TapToChat, so that the messages people send it there reach the business's TapToChat inbox and its team can answer them. If you message a business that has done this, Meta passes your messages to us, and we receive and store, on the business's behalf:

  • Your identifier on that platform: the ID Messenger assigns you for that business's Page, the ID Instagram assigns you for that business's account, or your WhatsApp phone number.
  • Your profile details, when the platform provides them. On Messenger, your first and last name and a link to your profile picture. On Instagram, your name, username, a link to your profile picture, your follower count, and whether you and the business follow each other. On WhatsApp, your profile name.
  • The text of each message you send and when you sent it, and the identifier Meta gives it. For a photo, video, file or other attachment on Messenger or Instagram, we keep its type and the link Meta provides, not the file itself. On WhatsApp we record only that you sent a photo, voice message, video or document, not its content.
  • The business's replies to you, which we send to you through Meta.
  • The record of how the conversation started and any opt-out you make, as described above.

We use this information to deliver the conversation to the business's inbox, to show its team who they are talking to, to send the business's replies to you, and for the AI features the business uses, described under Information Sharing (such as drafted replies, summaries and suggestions, detecting a message's sentiment and intent, and conversation search). We process it on behalf of the business, which decides how its conversations are used. We do not use it for advertising, and none of it goes into the advertising measurement described under Cookies. Apart from Meta, which carries the messages, it reaches only the service providers listed under Information Sharing that run the features the business uses, such as AI-drafted replies. It is kept like any other conversation: until the business deletes its organization, or until it is deleted at your request as described below. Opt-out records and the record of how the conversation started are kept for the periods set out under Data Retention.

To have this information deleted:

  • In the chat. In your Messenger, Instagram or WhatsApp chat with the business, send DELETE MY DATA as a message on its own (or, in Spanish, French, German or Italian, BORRAR MIS DATOS, SUPPRIMER MES DONNÉES, LÖSCHE MEINE DATEN or CANCELLA I MIEI DATI), then confirm within one hour with DELETE CONFIRM (BORRAR CONFIRMAR, SUPPRIMER CONFIRMER, LÖSCHEN BESTÄTIGEN or CANCELLA CONFERMA). We then delete your conversations with that business on that platform, with their messages, the profile details the platform shared with us and the records linked to them, and reply with a confirmation code and a page where you can check the request. Only that business's records of you are deleted: your conversations with other businesses that use TapToChat are not touched.
  • By asking the business. The business's owners and administrators can erase you from its TapToChat inbox, which deletes the same information and gives a confirmation code in the same way.
  • By email. Write to hello+support@taptochat.io naming the business you messaged and the platform, and we will deal with the request together with that business.

In some cases a request cannot be completed straight away. You are then told that it has been received, and the business follows up with you.

If you connected a Facebook Page to TapToChat. Meta sends us a data deletion request when someone who used Facebook Login with TapToChat removes it in their Facebook settings under apps and websites and asks for their data to be deleted. In TapToChat, that is a business's administrator who connected its Facebook Page. We then disconnect the Pages they connected, so that their messages stop reaching TapToChat, delete what came to us through their login and anything else held under the ID Meta sends, and give them a confirmation code with a page where they can check the request. The conversations already in the business's inbox are kept, as they are the business's records. An administrator can also disconnect a Page under Integrations, or delete their account.

Whichever way you ask, we keep the records of your opt-outs and of any consent you gave, while they are in force and for ten years after they end (see Data Retention), because they are what shows that your request to stop was received and honoured. They hold the opt-out message itself, but not the rest of your conversation.

Step-by-step instructions, in each language this site is in, are on our data deletion page.

How We Use Your Information

We use your information to:

  • Provide and maintain our service
  • Process your transactions
  • Send you service-related communications
  • Respond to your requests and support needs
  • Improve our service and develop new features
  • Detect and prevent fraud and abuse
  • Comply with legal obligations
  • Send marketing communications (with your consent)

Information Sharing

Every category of sharing in this section excludes text messaging originator opt-in data and consent, which is never shared with any third parties. A mobile number you give us for text messages goes only to Twilio, so that it can deliver them. See Mobile Messaging below.

We share your information with:

Service Providers

  • Supabase (hosting and database)
  • Vercel (web hosting)
  • Cloudflare (CDN, security and file storage)
  • Stripe (payment processing)
  • SendGrid (email delivery)
  • Twilio (SMS delivery and phone number verification)
  • Anthropic (AI features: the text of a conversation is sent to Anthropic's AI models to draft answers, summaries and suggestions, and to detect a message's sentiment and intent)
  • OpenAI (knowledge base and conversation search: the documents you upload, the messages of conversations your team indexes for search, the words your team types into conversation search and, when AI answers are on, a visitor's question are converted into search vectors)
  • Upstash (background job queue and rate limiting)
  • Render (runs our background worker, which sends queued email and webhooks and syncs connected tools)
  • Sentry (error monitoring)
  • Expo (push notifications to the mobile app)
  • Mixpanel & Google Analytics (analytics)
  • Metricool (website visit analytics, with your consent)
  • Datadog (performance monitoring and masked session replay, with your consent)
  • Google Ads, TikTok, Meta (Facebook and Instagram) and LinkedIn (measuring our advertising, only with your consent to marketing cookies; see Cookies below)

Legal Requirements

We may disclose information if required by law, court order, or government request.

Business Transfers

If we're acquired or merge with another company, your information may be transferred.

Mobile Messaging

If you give us your mobile number and agree to receive text messages, this section explains what we do with it. You can see the exact wording you agree to on our messaging consent page.

  • Mobile information and consent to receive text messages will not be sold, rented or shared with any third parties or affiliates for marketing or promotional purposes. We share your number only with the messaging provider that delivers the messages on our behalf (Twilio), and only so it can deliver them.
  • All the categories of sharing described elsewhere in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. That includes the service providers and the advertising platforms (Google Ads, TikTok, Meta and LinkedIn) listed under Information Sharing.
  • Message frequency varies, depending on the activity in your account.
  • Message and data rates may apply.
  • Reply STOP to any message to opt out at any time, or HELP for help. You can also turn messaging off in your account settings.
  • Consent to receive text messages is never a condition of purchasing anything from us.
  • We keep a record of when you opted in and the exact wording you were shown, so we can answer a question about it later. Opting out is recorded the same way, and an opt-out is honoured permanently.

Data Retention

We retain your information for as long as your account is active or as needed to provide services. Chat conversations and their messages are kept until your organization is deleted; they do not expire automatically, and there is no retention setting. Deleting your account or your organization in Settings → Security erases it at once, except what we keep as evidence of what was agreed about text and WhatsApp messages: the records of consent and of opt-outs and, if your organization registered to send business text or WhatsApp messages, that registration (the business details, the brand and the representatives named in it, with their contact details). Our security audit log, which records actions taken in your organization with the name, email address, IP address and browser of the person who took them, is kept for one year. In the record of how a conversation started, the IP address and browser details are deleted 13 months after the conversation began; the rest of that record is kept with the conversation, and if the business deletes its organization, for ten years after that, then deleted. A messaging registration is likewise kept for ten years after the business deletes its organization, then deleted. Records of consent to text and WhatsApp messages, and opt-out records, are kept for as long as the consent or the opt-out is in force and for ten years after it ends, then deleted. An opt-out ends when the person opts back in or the business removes it. A business's own team member's consent ends when they withdraw it or delete their account. The consent you give a business, and your withdrawal of it, stay in force while that business uses TapToChat, so that your choice keeps being honoured, and end when the business deletes its organization. A new consent restarts the ten years for that person's whole consent history with the business, and a new opt-out or opt-in for their whole opt-out history.

Your Rights

Depending on your location, you may have the right to:

  • Access: Request a copy of your data
  • Correction: Update inaccurate information
  • Deletion: Request deletion of your data
  • Portability: Export your data in a standard format
  • Opt-out: Unsubscribe from marketing emails
  • Objection: Object to certain data processing activities

To exercise these rights, contact us at hello+support@taptochat.io.

GDPR Compliance (EU Users)

If you're in the EU, we comply with GDPR:

  • Legal basis for processing: Contract, consent, legitimate interests
  • Data Protection Officer: dpo@taptochat.io
  • Data is stored in secure, encrypted databases
  • Records of consent to text and WhatsApp messages, and opt-out records, are kept while the consent or opt-out is in force and for ten years after it ends, the same period wherever you are, including the EU, the EEA and the UK. We use one worldwide period on legal advice, so that we, and the business that messaged you, can show what you agreed to and that your request to stop was received and honoured (GDPR Article 17(3)(e), the establishment, exercise or defence of legal claims). Only what the record needs is kept, nothing in it is used for any other purpose, and it is deleted when the ten years end.

CCPA Compliance (California Users)

If you're in California, you have the right to:

  • Know what personal information we collect
  • Request deletion of your personal information
  • Opt-out of the sale of personal information (we don't sell your data)
  • Opt-out of the sharing of personal information for cross-context behavioral advertising. Our advertising tags (see Cookies below) share that you visited our sign-up, email-confirmation or guide pages, and whether you signed up or requested a guide, with Google, TikTok, Meta and LinkedIn, and they run only if you accept marketing cookies; you can switch them off at any time in the cookie settings. A Global Privacy Control signal from your browser is honoured as that opt-out, and it takes precedence over a marketing choice made in the cookie settings.

Children's Privacy

Our service is not intended for children under 13. We don't knowingly collect data from children.

Security

We use industry-standard security measures:

  • TLS 1.3 encryption in transit
  • AES-256 encryption at rest
  • Regular security audits
  • Access controls and authentication

However, no system is 100% secure. Use strong passwords and enable 2FA.

Cookies

We set essential cookies: ones that keep you signed in and secure the sign-in and connect-a-service steps, one that remembers your language, and one that remembers your cookie choices. Analytics (Google Analytics 4, Metricool and Datadog performance monitoring) runs only if you turn it on in the cookie settings linked in the footer of every page, and stops when you turn it off. Google Analytics and Datadog then set their own cookies; Metricool sets none.

Marketing cookies are your choice, and they stay off unless you accept them. If you do, the advertising tags of Google Ads, TikTok, Meta (Facebook and Instagram) and LinkedIn run on our sign-up, email-confirmation and guide pages only. They tell each platform that you visited those pages and whether you signed up or requested a guide, so we can see which ads work and the platforms can show you our ads elsewhere. Like any web request, this includes your IP address and browser details, and each platform uses the data under its own privacy policy. The tags never send your name or email address.

With the same consent, our servers also report a sign-up or an enquiry to those platforms directly, so that it can still be counted when a browser blocks their tags, if the platform can match it to one of its ads. Every platform receives an event identifier, so that it counts the sign-up or enquiry once, and the time it happened. Meta and TikTok also receive your IP address, your browser's user agent, the address of our page and, if you arrived from one of their ads, the click identifier from that link. Google Ads and LinkedIn receive only the click identifier from a link to us in one of their ads, and nothing at all if you did not arrive that way. None of them receives your email address or your name. Without your consent to marketing, nothing is sent from our servers. Our legal basis is your consent, which you can withdraw at any time in the cookie settings; withdrawal stops the tags and these reports, and deletes the cookies the tags set on our domain.

Every cookie and browser-storage item we set is listed, with its purpose and lifetime, in our Cookie Policy.

Changes to This Policy

We may update this policy from time to time. We'll notify you of material changes via email or in-app notification.

Contact Us

Questions about this policy?