Privacy Policy

1. Information We Collect

• Accounts and business contacts: names, email addresses, phone numbers, business details, account identifiers, authentication information and staff roles.
• Orders and operations: items purchased, amounts, taxes, tips, discounts, receipts, refunds, transaction identifiers, inventory, staff activity and operational records.
• Customer features: contact details you or a merchant provide, order instructions, delivery or collection details where applicable, loyalty activity and communication preferences.
• Billing and payments: subscription and processor account identifiers, payment status, billing details and limited payment-method information such as brand and last four digits. Payment providers, including Stripe or Square depending on the integration, handle sensitive payment details through their services.
• Support and uploads: messages, forms, attachments, product images and other content you choose to provide. Do not put full payment-card details, passwords or unnecessary sensitive information in support messages.
• Devices and website use: device and app version, browser information, network connection information, security and error logs, and optional website analytics described below. Some features request camera, Bluetooth, local-network or location access; you can manage device permissions in your operating system.

We receive information directly from you, from the merchant whose service you use, from connected payment or business services, and from your device when you use the service. Device permissions and processor verification requirements vary by product.

2. How We Use Information

We use information to provide accounts, orders, payments, receipts, subscriptions, merchant operations and cloud synchronization; respond to requests; communicate about the service; diagnose faults and protect accounts; maintain required records; and meet legal obligations. Marketing preferences are separate from operational messages.

Taply Support SMS

2D Data Solutions LLC operates the Taply POS support messaging program. This section also covers the support SMS preference in the Restaurant admin. Support messaging disclosure: October 11, 2026 (v1).

We use the mobile number you provide, the restaurant account it belongs to, the identity of the signed-in user saving the preference, and a record of the consent choice, disclosure version and time. When messaging is used, support-message content and delivery or opt-out information may also be processed to provide the requested assistance and respect your preferences.

Your mobile information and consent

We do not sell or share mobile numbers or SMS opt-in data with third parties or affiliates for their marketing or promotional purposes. SMS consent is specific to Taply’s support program and is not transferred to another sender or used to enroll you in marketing.

Authorized service providers, including Twilio for messaging and our hosting and database providers, may process information only as needed to deliver and operate the service, maintain consent records, protect accounts and fulfill applicable obligations. This operational processing does not permit those providers to use your consent for their own marketing.

Your choices

Providing a number alone does not opt you in. You must check the separate consent box and save it. You can decline and continue using Taply, turn off support texts in Settings, or reply STOP. Consent records and opt-out information may be retained to document your choices and prevent unwanted messages, under the retention principles in our general privacy policy.

For questions or privacy requests, email support@taplypos.com. Do not include passwords or full payment-card details.

See the Taply Support SMS terms for message types, frequency, rates and STOP/HELP instructions.

Hugsy website assistant

Hugsy helps visitors find information in Taply’s public website using a search-and-answer algorithm in their browser. It downloads an index of public website text and matches questions locally. Chat questions and conversation transcripts are not sent to Taply or an AI provider.

The conversation remains in the open page’s memory until it is reset or reloaded. Hugsy does not use cookies or browser storage to save messages. Opening a suggested page is normal website navigation and follows the website analytics preferences described below. Hugsy cannot access merchant accounts or perform transactions.

You can download the current conversation as a text file on your own device. This does not send it to Taply or create a support ticket. Hugsy also offers demo and support inquiry forms. Draft contact details stay in the page’s memory until you review them and choose to send the request. Reloading the page clears unfinished drafts. The inquiry includes your name, email address, selected product, business name if supplied, message and a request reference. Demo inquiries also include the originating page path and identify Hugsy as the source. Your chat transcript is not automatically included.

Submitted inquiries use Taply’s existing Netlify form service and are handled under this policy to respond to your request. Closing Hugsy after sending does not withdraw the inquiry. The form’s acknowledgement is not a confirmed demo booking or a live support conversation. Other demo, contact and support links open the relevant website pages.

When no confident website answer is found, Hugsy may offer an optional link to ChatGPT. Opening that link does not send your question or conversation. You can choose to copy a question and paste it there; information you then submit to ChatGPT is governed by OpenAI’s terms and privacy practices. The website chat does not make OpenAI API calls.

Hugsy phone assistant

The Hugsy phone assistant is a separate service from the website chat. It identifies itself as an AI assistant. Twilio connects the call and OpenAI processes live conversation audio to understand your questions and generate spoken answers. Relevant conversation context and results from permitted support lookups are also processed to answer your request.

We process call identifiers, phone numbers, call timing and connection information to operate and protect the service. Private restaurant lookups require account verification and are limited to the authorized restaurant. Support cases may retain your description of the issue, steps tried and checked findings. We also retain verification and support-action audit records; these are different from a call recording.

When optional call recording is offered, an announcement explains the purpose before recording begins. To continue without recording, press 1 during the announcement. If you stay on the line without opting out, recording may begin after the announcement. Your choice is separate from using Taply, receiving support or agreeing to text messages.

Consented recordings are stored with Twilio and are available only to authorized Taply support reviewers for up to 30 days. Reviewers use them to investigate support issues, check answer quality and improve approved support instructions and knowledge. We do not use these recordings to fine-tune an AI model or create a copy of your voice. We do not save full call transcripts for model training.

You can ask Hugsy to stop recording during the call. This withdraws permission for further recording and requests deletion of any saved recording for that call. You can also request deletion through the privacy contact below. Recordings become unavailable for staff playback when consent is withdrawn or the retention period expires; deletion requests are retried if the provider does not confirm completion. Minimal consent, access and deletion records are retained separately. Hugsy stops recording before requesting its call-specific support code or accessing private restaurant records.

Choosing an unrecorded call does not stop the live audio processing needed to provide the AI conversation. Provider processing and retention are governed by their service terms and controls, including OpenAI’s API data controls. This is separate from Taply’s optional recording and review workflow.

Do not share passwords, login verification codes, full card numbers, CVVs or API keys during a call. If you prefer not to use the AI phone service, email support@taplypos.com. Privacy requests use the contact process below. A support SMS opt-in does not give permission to record your calls or use them to train a model.

3. Storage, Security and Retention

Depending on the product, information is stored on your device and in our hosted services. We use access controls, encrypted network connections and other safeguards appropriate to the service. No storage or transmission method can be guaranteed completely secure.

We retain information for the purposes above, considering the account relationship, merchant instructions, applicable recordkeeping duties, disputes, security needs and backup lifecycles. Financial records may need to remain after a privacy request; eligible personal details can be removed or de-identified without changing completed transaction history. We do not promise that deleting an account immediately deletes every record or backup.

4. Information Sharing

We do not sell personal information or share it for cross-company targeted advertising. We do not use personal information for targeted advertising.

We disclose information as needed to the merchant serving you and its authorized staff, and to providers supporting hosting, databases, authentication, payments, email or SMS delivery, error diagnostics and connected business features. These can include Netlify, Supabase, Stripe, Square, Apple or Google sign-in, Sentry and the communication providers used by the relevant product. Optional merchant integrations receive information when enabled for that merchant.

Some merchant features use Google Gemini to extract menu or inventory records from document text and to generate shift summaries. When these features are requested, the relevant document text or shift information is sent to Google for processing. Include only information needed for the task. This is separate from Hugsy's local website search described above.

We may also disclose information when required by law, to protect rights and service security, at your direction, or in connection with a business transaction subject to applicable protections. A linked external service has its own privacy practices.

5. Your Privacy Choices and Requests

Depending on your state, the information and the applicable law, you may have rights to access, correct, delete or obtain a copy of personal information; opt out of specified processing; appeal a decision; and exercise rights without unlawful discrimination. Exceptions can apply, including for transaction records and security.

Email support@taplypos.com with the subject “Privacy request”. Tell us the request type, the Taply product and the merchant involved, if any. Do not send a password, full card number or government ID in your initial request. We may need proportionate information to verify identity or an authorized agent's authority. You may appeal a denied request by replying and asking for a privacy appeal.

For information a merchant controls, you can contact that merchant directly. We will help route requests and assist the merchant as appropriate. Marketing emails provide an unsubscribe method; unsubscribing does not stop necessary receipts or account messages. You can change optional website analytics in Privacy settings.

6. Merchant Responsibilities

Merchants are responsible for their collection notices, lawful instructions, communication permissions and responses to customer and employee requests. Use only information needed for the relevant feature. Marketing consent must not be inferred from a payment or a request for a receipt.

7. Children’s Privacy

Taply does not offer services directed to children under 13 or knowingly collect their personal information without a lawful basis and any required parental consent. Merchant account representatives must be authorized to act for their business. This is separate from a merchant's age checks for age-restricted goods.

If you believe a child under 13 has provided personal information through Taply, contact support@taplypos.com with the relevant product or merchant. We will investigate and take appropriate steps, including working with the merchant to stop unauthorized collection and remove information where required.

8. Security Incidents

We investigate suspected security incidents and provide notices required by applicable law. You can report a concern to support@taplypos.com.

9. Account Deletion

Use the account deletion control where available or contact support. Deleting an app from your device does not delete its cloud account or cancel a subscription. Manage subscription cancellation separately in Billing and retain the provider's confirmation. Merchant payment-processor accounts are managed with the relevant provider.

In Taply Restaurant, an owner or administrator can use Delete Account for their own signed-in account. The confirmation explains the consequences before you choose OK. Once deletion is confirmed, your sign-in credentials and restaurant access are removed. Another owner keeps access to the restaurant; a restaurant closes only when its last owner deletes their account.

For a restaurant closed this way, we retain its profile and contact details and Taply-hosted logo and menu images for 30 days after closure, then remove them through scheduled cleanup. This does not erase required transaction, billing, tax, security, legal or audit records. Retained records follow the purposes described above.

Account and privacy requests remain subject to identity checks and necessary retention described above. Unresolved payments, subscriptions or linked services may need to be reconciled before a restaurant can close. A merchant's request must not erase completed financial history or another person's account.

10. Cookies and Privacy

Essential cookies and similar browser storage support sign-in, security and requested features. Optional website analytics use browser storage to understand page visits and demo requests and stay off until you accept. We do not run advertising trackers or session replay on the marketing site. Optional analytics are not used on customer ordering pages.

When enabled, analytics use a random tab identifier with a 30-minute inactivity limit. Events include selected marketing page paths, demo-link clicks, form starts and submission outcomes, limited campaign labels and broad referral categories. The analytics code does not read form contents or collect full referring URLs. Hosting providers separately process connection information to serve and protect the site.

A submitted demo request can be linked to its campaign and session through a request reference. Those follow-up records are business records, not anonymous statistics. Contact us about access or deletion. Our event store is configured for removal of events older than 90 days; inquiry records follow the retention purposes above.

Accept or reject optional analytics on your first visit, or change your choice here at any time. Your preference is saved in this browser across visits until changed or cleared; other browsers and origins may have separate storage. Global Privacy Control and Do Not Track keep optional analytics off. Rejecting analytics does not prevent browsing or submitting a request.

See Cookies & privacy for more detail.

11. Changes to This Notice

We update the date when this notice changes and provide additional notice or request consent where required. A notice update does not itself grant consent for optional analytics.

12. Contact

2D Data Solutions LLC — Taply Privacy Team
support@taplypos.com