This policy explains what personal data Tapworth Ltd ("Tapworth", "we") collects, why, how we store and protect it, and the rights you have over it. It covers three distinct surfaces: this marketing website, the consumer receipt wallet, and the TapScore financial-identity API.
1. Who we are
Tapworth Ltd is a company registered in England and Wales. For all privacy matters, including data-subject requests, contact our data protection lead at hello@tapworth.co.uk. Where we serve regulated identity queries in the United Arab Emirates, we operate under the Abu Dhabi Global Market (ADGM) data-protection regime in addition to the UK GDPR.
2. What we collect, and why
a. On this website
When you submit a form ("get early access", "join the pilot", "request the deck", "partner with us") we collect the details you enter — typically your email, and depending on the form your name, business or fund name, city, and any message. We also record your IP address and the page you submitted from, solely to prevent abuse and de-duplicate submissions. We use this only to respond to your enquiry and to operate the pilot waitlist. We do not run advertising trackers or sell this data.
b. In the consumer wallet
When you claim a receipt by tapping a Tapworth terminal, we capture the itemised contents of that receipt — merchant, line items, quantities, prices, VAT and timestamp — because that is the product. As you use the wallet we hold:
- your phone number, once you choose to verify it (used to secure your wallet and let it follow you across devices);
- your receipt and refund history, stored as an append-only ledger;
- derived spending patterns and insights (e.g. duplicate subscriptions, price changes) generated by the agent;
- your TapScore and the feature breakdown behind it;
- optional push-notification subscriptions and your notification preferences.
An anonymous wallet (a device cookie, no phone number) is created on your first tap; you only become identifiable to us when you verify a phone number.
c. In the TapScore Identity API
When a bank, lender, landlord or insurer queries your TapScore, we record the query, its purpose, the consent that authorised it, and a truncated reference to your account — never your full identity — in an append-only usage ledger.
3. How long we keep things, and where
Money is stored as integer minor units, never floating-point, and the receipt and refund ledgers are append-only — entries are written once and never silently edited. Data is encrypted in transit (TLS) and at rest. Personal data is retained only as long as needed for the purpose it was collected: marketing leads until you ask us to delete them or they go stale; wallet data for the life of your account; identity-query records for the period required by financial record-keeping obligations.
4. Sharing your data
We do not sell personal data, and we are never in the payment flow — we hold no card numbers. Your TapScore and its features are shared with a third party only on your explicit, per-purpose consent, which is time-boxed and revocable at any time from your wallet. A lender who is granted a "tenancy" check for two weeks sees your score for that purpose and that window — nothing else, and nothing after you revoke. Merchants receive only anonymised, aggregated basket analytics, subject to k-anonymity thresholds; they never see your identity. We use a small number of processors (hosting, SMS delivery, error monitoring) bound by data-processing agreements.
5. Your rights
Under the UK GDPR and ADGM data-protection rules you have the right to:
| Right | How Tapworth honours it |
|---|---|
| Access | Request a copy of everything we hold about you. |
| Portability | Export your full wallet — receipts and TapScore — as a single machine-readable JSON file, from the app. |
| Erasure | Delete your account. We unlink you from the ledgers, remove your phone number, profile, insights, notifications, scores and consents, and scrub any personal data from stored receipt images. The de-identified transaction records (which are also the merchant's own records) survive without you attached. |
| Objection / restriction | Revoke any data-sharing consent instantly, or contact us to restrict processing. |
| Rectification | Correct your profile details at any time. |
To exercise any of these, use the controls in the app or email hello@tapworth.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ICO) or the ADGM regulator.
6. Cookies
This marketing site sets no advertising or cross-site tracking cookies. The consumer wallet uses a single first-party, HttpOnly session cookie to keep you signed in — it is a signed credential, not a tracker, and carries no third-party data. Any analytics we use are privacy-respecting and aggregate-only.
7. Children
Tapworth is not directed at children and is intended for users aged 18 and over.
8. Changes to this policy
We will update this page when our practices change and revise the "last updated" date above. Material changes affecting how we use your data will be communicated directly where we hold your contact details.
9. Contact
Questions, requests, or complaints: hello@tapworth.co.uk.