Privacy policy

Last updated: [DATE — fill in before this page goes live]

This policy explains what personal data onetap collects, why, and what rights you have — under the Norwegian Personal Data Act (implementing the EU/EEA General Data Protection Regulation, GDPR) and the Norwegian Electronic Communications Act (Ekomloven) §2-7b for cookies and similar storage. For the cookie-specific detail, see the cookies page.

1. Who we are

[COMPANY NAME — fill in]
[ORGANISATION NUMBER — fill in]
[REGISTERED ADDRESS — fill in]
Contact for privacy questions: [PRIVACY CONTACT EMAIL — fill in]

2. What data we collect

Guests who tap or scan a card — none. onetap does not log IP addresses, set tracking cookies, or fingerprint devices for this flow; it only records which card and (in aggregate) which device type and channel were used, with no way to identify a specific visitor. This is a deliberate product decision, not an omission.

Venue owners — business name, category, city, contact email, and (only if you use the neighbour-comparison feature) your Google Places listing details.

Shop customers — name, email, and shipping address entered at checkout, and the order itself. If you search for your business before ordering, we also process the Google Places result you select (business name, address, rating).

Admin/venue login — an admin password (never stored in plain text) or, for venue owners, a one-time magic-link email tied to your account.

3. Why we process it (legal basis)

Order and account data: to perform the contract you enter into with us by placing an order or creating a venue account (GDPR Art. 6(1)(b)). Basic abuse/rate-limit protection: our legitimate interest in keeping the service reliable (Art. 6(1)(f)). Analytics and marketing cookies, if you enable them: your consent (Art. 6(1)(a)), which you can withdraw at any time — see cookie settings.

4. Who we share data with

We use a small number of processors to run the service: a transactional email provider (Resend or Postmark) to send order confirmations and login links; Google (Places API) when you search for your business; Cloudflare Turnstile, when enabled, to verify browsers and protect business search from automated abuse; and our hosting/database providers. Turnstile verification applies to business search, not to visitors following an NFC or QR review link. We only work with processors that offer appropriate safeguards for any transfer of data outside the EU/EEA (such as the EU Standard Contractual Clauses). We do not sell personal data.

5. How long we keep data

Order records are kept for as long as required by Norwegian bookkeeping law (bokføringsloven), currently 5 years from the end of the accounting year. Venue account data is kept for as long as the account is active, plus a reasonable period after closure for legal/accounting purposes. [RETENTION DETAILS — refine before this page goes live if any category needs a different, more specific period.]

6. Your rights

You have the right to access, correct, or delete your personal data, to restrict or object to certain processing, to receive a copy of your data in a portable format, and to withdraw consent at any time without affecting processing already carried out. To exercise any of these, contact us at [PRIVACY CONTACT EMAIL — fill in]. You can also complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) if you believe your data has been mishandled.

7. Changes to this policy

We'll update the "last updated" date above if this policy changes, and where the change is material, we'll make that clear on this page.

This page is a starting point, not legal advice — review it with a Norwegian lawyer or Datatilsynet's own guidance before relying on it for a live, customer-facing product.