Terms & Conditions

Last updated 7 November 2026 · version 2026-11-07

These terms govern your use of Tap In Book (“the Service”), sign-in and attendance software for places where people turn up, provided by Property Workflow Systems Ltd, Unit 6, Orchard Business Units, Cockaynes Lane, Alresford CO7 8BZ (“we”, “us”). By creating an account you agree to them.

1. What the Service is

The Service has two halves. A sign-in screen, which you open in a browser on a tablet by your door and which the people who come to your place use to record that they have arrived; and an office side, which you open on a phone or a computer and which shows you who came, how often, who is using more than they pay for and who has stopped coming. You can also keep your people’s details, what each of them pays for, and a weekly timetable.

Each account has its own web address (yourplace.tapinbook.co.uk) and is for the use of your business and the people you give logins to.

What it deliberately does not do. It does not take money from the people on your list, book them onto anything, or open doors. It does not turn anybody away at the sign-in screen: somebody whose membership has lapsed, is frozen or was cancelled is recorded like everybody else and you are told about it afterwards. It is not a check-in screen for a GP surgery, a dental practice or anywhere else that handles health records, and it must not be used as one.

2. Accounts

You must give accurate details and keep your login secure. You are responsible for what happens under your account and for who you give a login to. You must be at least 18 and authorised to accept these terms for your business. Do not use the Service for anything unlawful, and do not attempt to disrupt it, reverse-engineer it or reach another account’s data.

A paired tablet is not a login. Pairing gives a tablet a long-lived credential that can reach the sign-in screen and nothing else — no record about a person, no report and no setting. You can revoke it from Settings at any time, which is what you should do if a tablet goes missing. Anyone who can physically reach a paired tablet can record a sign-in, and while the name list is switched on they can see the names of the people on your list. That is a decision about your own premises, and section 6 covers it.

3. Free trial and subscription

New accounts include a 30-day free trial with no payment details required. After that, continued use needs a subscription: £19 a month or £190 a year. One price covers the whole place and as many tablets as you have doors; we do not charge per device or per person on your list. Prices are in GBP. Any change to a price is notified at least 30 days in advance and, for a yearly subscription, takes effect at your next renewal; you may cancel before it does.

VAT. We are not registered for VAT, so no VAT is charged. The price you see is the price you pay. If we register for VAT in future, we will either add VAT to the price or include it in the price. Either way we will email you at least 30 days before your payment changes, and you can cancel before it does.

If you subscribe before the trial ends you keep the rest of it: your card details are taken at checkout, nothing is charged until the trial would have ended, and if you cancel before then you pay nothing.

What happens if you do not subscribe. The account becomes read-only on the day the trial ends. Nothing is deleted; you can still sign in, look at every person and every sign-in, and download all of it. But you cannot add or change anything, and the tablet by your door stops recording people. We say that plainly here, on the Billing page and in the emails we send before the trial ends, because it is the one consequence that would otherwise be discovered by a queue of people at a door.

Subscriptions are bought on our website. Payments are collected by our reseller and Merchant of Record, Paddle (Paddle.com Market Ltd), whose buyer terms also apply to the purchase; your receipts and VAT invoices are issued by Paddle. Subscriptions renew automatically each month or year until cancelled. See our Refund & Cancellation Policy.

4. The data you keep about the people who come, and who is responsible for it

You own everything you put in. You can download it at any time as spreadsheets from Settings → Your data.

For the records you keep about the people who come to your place, you are the data controller and we are your processor. They are your people; you decided to hold their details, you decide what else to hold, how long to hold it and who to share it with, and you are responsible for having a lawful basis to do so and for telling them. Our Data Processing Terms form part of this agreement, meet Article 28 of the UK GDPR, and apply automatically — there is nothing to request or sign. For your own account details (the people who sign in here, your business name, your subscription) we are the controller, and our Privacy Policy covers that.

Children. If children come to your place, you will be holding personal data about children — and, on the child’s record, a parent’s or guardian’s name and contact details. That is yours to justify, to explain to the parents, and to keep no longer than you need. What the Service does about it is described in section 6 and in the Data Processing Terms: in short, where somebody has a guardian recorded, every message the Service sends about them goes to the guardian and never to the child.

5. Availability, and what we do not promise

We aim to keep the Service available and reliable and we may suspend it briefly for maintenance or updates, but we do not guarantee uninterrupted access. Features may change or improve over time.

Your account is backed up every night. Every night we take a copy of your whole account — the people on your list, their memberships and plans, your timetable, your tablets, every sign-in and every message you have sent — and we keep the last 30 nights of it. Each copy is written twice: once alongside the live database and once into separate object storage, so that a fault which takes out one cannot take out the other. The public demo place is the one account not backed up, because it is rebuilt from scratch every night and there is nothing in it that belongs to anybody.

Some things are deliberately left out of that backup, one of them is your choice, and it is better that you know now than on the morning you need it. Your tablets’ pairing credentials are never copied into it, whatever else you choose. A pairing credential is what lets a tablet reach your sign-in screen, and a backup that carried one could put a tablet you had revoked back on your wall. So if we ever have to restore your account from a backup, every paired tablet will ask for a new pairing code from Settings → Devices. The four-digit PINs are left out as well — unless you switch them on, which is yours to decide in Settings → PINs in your nightly copy and is off to begin with. Left out, a copy of the backup on its own can never be used to try PINs against, and after a restore everybody who signs in with a PIN will need a new one issuing. Switched on, the PINs travel in the backup in the same scrambled form they are stored in — never the four digits themselves, and never the separate secret they are scrambled with — and after a restore nobody needs a new one. Changing the setting applies to the backups taken from that night on; it does not alter the ones already kept. Everything else — every person, every sign-in, every record — comes back as it was.

A backup is our copy, taken so that we can put your account back after a fault at our end. It is not a substitute for your own: download your records from Settings → Your data whenever it matters to you. That download is the copy fully within your control, and it works even when the account is read-only.

6. The tablet by your door, and what it shows

These are decisions about your own premises and your own people. The Service gives you the switches; how you use them is yours.

• The name list shows names. If you switch on the name picker, somebody standing at the tablet sees a row of initials and then the names filed under the one they tap. In a place where everybody trains together that is usually unremarkable. If it is not right for yours, switch it off and use the four-digit PIN instead, which names nobody until the PIN matches, or the date-of-birth method below. You should tell the people who come which of these you are using.
• Signing in with no names on the screen. You may instead choose a method in which somebody taps their own date of birth and the first letter of their surname, and nothing on the tablet names anybody until the two together match exactly one record. If you switch it on, the name list is switched off and cannot be switched back on until you change this choice. Two things follow, and they are yours rather than ours: you are asking people for a date of birth at a screen in a public room, and you should be able to say why you hold one and have told them; and the date of birth is checked against your records on our side, so this one method does not work when the tablet has no connection and the tablet says so and asks the person to see the desk. Nothing about this method makes the Service suitable for a setting excluded by section 1.
• Photographs. The Service does not ask for photographs of anybody and none can be uploaded today. If that changes and you switch it on, somebody’s face appears on a screen in a public room, it is you who has decided that, and you should have told them first.
• Guests. If you switch on “Not on the list?”, a visitor types their name and phone number on the tablet. That record is yours, it is personal data about somebody who is not on your list, and the lawful basis for keeping it and for ringing them afterwards is yours to establish. Where you have switched on the date-of-birth method, that screen does not ask for a phone number at all: it asks a first name and who the person is here to see.
• Sign-ins are attendance records. They say who was in your building, on which day, at what time, and which session it was. Treat them accordingly.
• The confirmation clears itself. After somebody signs in the tablet shows their first name and nothing else, and then clears itself — after three seconds, or two where you have switched on the date-of-birth method — so the next person in the queue does not see who went before them.
• “Please see the desk”. Where the date-of-birth method is on, every screen carries a button that tells you somebody at that tablet needs help. What it records is which tablet and when, and nothing whatever about who the person said they were.
• Working without a connection. When the tablet has no network, sign-ins made with the name list or as a guest are held in that browser and sent when it reconnects, with the time they actually happened. Until they are sent they exist only on that tablet: if it is lost, reset or cleared before it reconnects, they cannot be recovered. A PIN cannot be checked without a connection, and neither can a date of birth — and in both cases the tablet says so rather than pretending. A date of birth is never held on the tablet at all, waiting to be sent or otherwise, which is the point of it: a tablet that leaves the building is not a list of anybody’s dates of birth.

7. What the Service works out, and what remains yours to check

Some of what you see is calculated. You decide what to do about it, and you remain responsible to your own people.

• Allowances and “over allowance”. A week runs Monday to Sunday. A sign-in counts against an allowance only if the membership was active at the moment it happened, so a frozen fortnight counts for nothing and a guest counts against nobody. The figure is a prompt for a conversation, not a decision: the Service never tells anybody they have been coming too often, and it never stops anybody at the door.
• Which session a sign-in belongs to. It is matched to the nearest one on your timetable within a window you set. If nothing matches it is recorded as a plain arrival. If your timetable changes, what was already recorded keeps the session it was recorded against.
• Messages to the people on your list. The “drifting” nudge goes out in your place’s name, from wording you can edit, with replies coming to you. It is off until you switch it on, it honours a person’s opt-out, and where somebody has a guardian recorded it is addressed to the guardian. The content and the contact details are yours, and so is the lawful basis for sending it.
• The daily digest is a report to you about your own place. It is never sent to a person.
• Plan prices are recorded so your reports can say what somebody pays. The Service does not collect that money, does not calculate VAT on it, and is not a bookkeeping service.

8. Cancellation and suspension

You can cancel at any time — see the Refund & Cancellation Policy. We may suspend or close an account that breaches these terms or that we reasonably believe is being used unlawfully, giving notice where we can. On closure you may download your data first.

9. Liability

Nothing in these terms limits or excludes our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be limited. The rest of this section is subject to that.

The Service is provided on a reasonable-efforts basis. We are not liable for loss of profit, revenue, business, contracts, goodwill or anticipated savings, for business interruption, for reputational damage, or for any indirect or consequential loss — in each case however it arises. We are not liable for the acts, failures or outages of services outside our control, including Paddle, your internet connection, the tablet or browser you use, and your email provider.

Subject to the above, our total liability to you for all claims arising in any 12-month period is limited to the greater of the fees you paid us in that period and £500.

The Service is a tool for running your place. It is not legal, data-protection, safety or insurance advice, it is not a fire register or an evacuation list, and it does not replace your own records or your own judgement.

10. Governing law

These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

11. Contact

Property Workflow Systems Ltd
hello@tapinbook.co.uk
+44 7777 511156

Email reaches a person and is the quickest route. The phone number is here because a trader selling at a distance should give one where it exists, not because there is a call centre at the end of it.