Privacy Policy
Last updated 7 November 2026 · version 2026-11-07
Tap In Book (“we”, “us”) is sign-in and attendance software for places where people turn up, at tapinbook.co.uk and at each account’s own web address. It is operated by Property Workflow Systems Ltd, Unit 6, Orchard Business Units, Cockaynes Lane, Alresford CO7 8BZ, and we comply with the UK GDPR and the Data Protection Act 2018.
Two kinds of data, and they are not the same
1. Your account. When you sign up we hold your name, your email address, your place’s name and web address, a securely hashed password (never stored in plain text) and your subscription record — and the same for anybody else you give a login to. For this we are the data controller, and this policy describes it.
2. The people who come to your place. Everything you enter about them: their names, dates of birth if you record them, email addresses and phone numbers, emergency contacts, whatever you add as your own fields, what each of them pays for, and every time they sign in at your door. Where somebody is a junior, this includes a parent’s or guardian’s name and contact details. For this you are the data controller and we are your processor: we hold it and act on it for you, and nothing else. That relationship is set out in the Data Processing Terms, and if one of them has a question about their own data, it is you they need to ask.
We do not use anybody’s data for advertising. We do not sell it or rent it. We do not use it to train anything. We never send the people on your list marketing of our own, and we never show one place’s list to another.
How we use your account data, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Create and run your account, sign you in, show you your place, take payment for the subscription | Contract — we cannot provide the service without it |
| Service email: welcome, email confirmation, password reset, trial and billing notices | Contract |
| Keeping the service secure — sign-in rate limits, the challenge on the sign-up form, logs | Legitimate interests — running a service that is not trivially broken into |
| Answering you when you email us | Legitimate interests |
| Keeping records we are obliged to keep, for example for tax | Legal obligation |
| Storing and processing the records you keep about the people who come, and sending the messages you ask us to send them | Not ours to choose — we act on your documented instructions as your processor. See the Data Processing Terms. |
Who else is involved
Two companies, each for one purpose. Only the one marked (sub-processor) touches the records you keep about the people who come.
- Cloudflare, Inc. (sub-processor) — hosting, the database, file storage, network security, and sending email. The database and the file storage are located in Western Europe. Email covers both our own service email to you and the messages you ask us to send the people on your list. Data is encrypted in transit, and at rest by the underlying storage.
- Paddle (Paddle.com Market Ltd) — our reseller and Merchant of Record. Paddle handles the subscription checkout and billing; we never see or store your card details, and Paddle never receives anything about the people on your list. See Paddle’s own privacy policy.
We give you notice before adding or changing a sub-processor, as set out in the Data Processing Terms.
Where your data goes
The database and any uploaded files are held in Western Europe. Some providers are based outside the UK: Cloudflare is a US company with a global network, and Paddle’s operations include the United States. Where personal data is transferred outside the UK it is protected by the UK’s International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent approved safeguard, under each provider’s data processing agreement.
Cookies and what the tablet keeps
The Service sets two strictly necessary first-party cookies, and no others. There are no advertising cookies, no analytics cookies, and no analytics of any kind.
- A sign-in cookie, which keeps you signed in to the office side.
- A device cookie on a tablet you have paired, which is what lets it reach the sign-in screen. It identifies the tablet, not a person, and it can reach nothing else.
So that the sign-in screen keeps working when the wifi drops, the tablet also stores on itself a copy of the current name list and any sign-ins waiting to be sent. Waiting sign-ins are removed once they have been sent. This is essential to a feature you have switched on and needs no consent — but it does mean a paired tablet holds your name list, which is one more reason to revoke a tablet that goes missing.
Unless you have chosen the sign-in that shows no names. A place may instead switch on a method in which somebody taps their own date of birth and the first letter of their surname, and nothing on the tablet names anybody until the two together match one record. Where that is on, the name list is switched off and the tablet holds no dates of birth — not a copy of your list, not a scrambled form of one, and nothing waiting in the browser to be sent later. Each entry is checked against your records on our side and then forgotten: what somebody typed is not stored, logged or reported anywhere, whether it matched or not. That is the point of it, and it is also why this one method does not work when the tablet has no connection. The tablet says so and asks the person to see the desk, and pressing that button records which tablet and when and nothing about who the person said they were.
The checkout page loads Paddle, which sets its own cookies for payment and fraud prevention. That happens only when you arrive there with something to pay for.
If you leave your email on the sign-up page
If you leave your email to hear when sign-up opens, we keep only the address and the date. We use it for one thing: to email you once, when sign-up opens. After that email we delete it, unless you then open an account. We never share it, and nothing is sent to you before then. To be taken off the list at any time, email hello@tapinbook.co.uk and we’ll delete it.
How long we keep it
Your account and everything in it is kept for as long as the account is open. If you close it, it becomes read-only immediately and everything is deleted 30 days later — the people, the memberships, the timetable, every sign-in and any uploaded file — except anything we are required to keep (for example transaction records for tax). You can change your mind during those 30 days. The nightly backups go too: deleting an account deletes its stored backups and its copies in the separate object storage, in the same operation. Until then we keep the last 30 nights, and the database platform’s own restore points cover roughly the last 30 days; neither is a copy you can request, and your own download from Settings → Your data is.
Your rights
You may access, correct, download or delete your own account data. You can download your records as spreadsheets at any time, and you can delete records from within the app. To exercise any UK GDPR right — access, correction, erasure, restriction, portability or objection — email us at the address below. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).
If you sign in at a place that uses Tap In Book, or you are the parent of somebody who does: that place is the data controller for your records and is who to ask. They can see everything held about you on your own page in their office view, including every sign-in and every message you have been sent, and they can export it or delete it. If you have asked them and got nowhere, write to us at the address below and we will do what we can to help, but we cannot act on your records without their instruction.
Contact
Questions about this policy or your data: hello@tapinbook.co.uk.