Privacy Policy.
Contents
- Who We Are
- Scope & Applicable Law
- Information We Collect
- Information We Do NOT Collect
- How We Use Your Information
- Payment Processing (Stripe)
- Analytics & End-User Data
- Data Retention
- Data Security
- Sharing & Disclosure
- Third-Party Services
- Cookies & Tracking
- Your Privacy Rights (PIPEDA)
- International Data Transfers
- Children’s Privacy
- Changes to This Policy
- Contact & Complaints
01. Who We Are
BrandTap Canada is a technology company incorporated in Ontario, Canada, operating the BrandTap platform — a SaaS service and NFC device solution that enables businesses to collect customer reviews and manage their online reputation.
Ontario, Canada
Email: [email protected]
Website: brandtap.ca
References to “BrandTap Canada,” “we,” “us,” or “our” in this policy refer to BrandTap Canada as the organization responsible for the collection and use of personal information described herein.
02. Scope & Applicable Law
2.1 Applicable Privacy Law
BrandTap Canada is subject to Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and complies with PIPEDA’s 10 fair information principles. We also comply with applicable provincial privacy laws where required.
Canada’s federal privacy law is currently under reform. Bill C-27 (Consumer Privacy Protection Act) has been introduced but is not yet in force as of the effective date of this policy. We will update this policy as the legislative landscape evolves.
2.2 Who This Policy Applies To
This policy applies to:
- Customers — businesses and individuals who subscribe to BrandTap Canada services;
- Website visitors — anyone who visits brandtap.ca;
- End users — customers of our Customers who interact with a BrandTap-powered landing page via NFC tap, QR code, or direct URL;
- Sales rep and affiliate applicants — anyone who submits the application form on the Sales Team page.
2.3 What This Policy Does Not Cover
This policy does not govern the privacy practices of third-party platforms (such as Google, Facebook, or Yelp) that you or your customers may be directed to through BrandTap Services. Those platforms have their own privacy policies, which we encourage you to review.
03. Information We Collect
3.1 Account & Registration Information
When you create a BrandTap Canada account, we collect:
- Business name and contact name;
- Email address;
- Password (stored as a one-way cryptographic hash — never in plain text);
- Business details entered into your landing page (tagline, logo URL, social links, etc.).
3.2 Billing & Subscription Information
We collect information necessary to manage your subscription, including your subscription plan, billing cycle, and subscription status. We do not collect, store, or process your credit card number or any full payment instrument data — see Section 6 (Payment Processing).
3.3 Communication Data
When you contact us by email or through our website, we collect the contents of your message, your email address, and any other information you choose to provide.
3.4 Usage & Technical Data
When you use the BrandTap admin dashboard or visit brandtap.ca, we may automatically collect:
- IP address (used for security and fraud prevention; not retained in raw form — see Section 7);
- Browser type, operating system, and device type;
- Pages visited and features used within the dashboard;
- Referring URL and exit page;
- Date and time of access.
3.5 Landing Page Visitor Data (End-User Analytics)
When an end user (your customer) visits your BrandTap-powered landing page, we collect limited technical data for analytics purposes. See Section 7 for full details.
3.6 Sales Rep & Affiliate Applicant Data
When you submit an application through the Sales Team page, we collect:
- Full name and email address;
- Phone number;
- City and province / state;
- Current occupation;
- Sales experience level;
- Whether you are applying as a field sales rep, online affiliate, or both;
- Free-form responses you provide about your interest;
- How you heard about BrandTap.
This information is used to evaluate your application, contact you about onboarding, and (if approved) manage the rep or affiliate relationship. See Section 8 for retention details.
04. Information We Do NOT Collect
- Full credit card numbers, CVV codes, bank account numbers, or any payment instrument data;
- Government-issued identification numbers (SIN, passport, driver’s licence);
- Raw, unmasked IP addresses of end users in persistent storage — IP addresses are hashed using SHA-256 with a unique salt before storage and the raw IP is never written to disk;
- The personal identity of end users who tap or scan your NFC device — we have no way to identify who your customers are;
- Health information, financial account information, or other sensitive personal information as defined by PIPEDA;
- The content of reviews posted by your customers on third-party platforms — we only route traffic; we do not scrape or collect review content.
05. How We Use Your Information
BrandTap Canada uses the personal information we collect for the following purposes:
| Purpose | Information Used | Legal Basis (PIPEDA) |
|---|---|---|
| Create and manage your account | Name, email, business details | Contractual necessity / consent |
| Deliver and operate the Services | Account data, subscription data, usage data | Contractual necessity |
| Process subscription payments | Email, subscription plan (payment handled by Stripe) | Contractual necessity |
| Provide analytics dashboard to Customers | Aggregated landing page interaction data | Contractual necessity / legitimate interest |
| Send transactional emails (receipts, alerts) | Email address | Contractual necessity |
| Send product updates and announcements | Email address | Consent (opt-out available) |
| Sales rep / affiliate recruitment communications | Application data, email address | Consent |
| Customer support and communications | Email, message content | Legitimate interest / consent |
| Security, fraud prevention, and abuse detection | Usage data, hashed IP data | Legitimate interest |
| Improve and develop the Services | Aggregated, de-identified usage data | Legitimate interest |
| Comply with legal obligations | As required by law | Legal obligation |
We will not use your personal information for purposes materially different from those listed above without obtaining your consent or as otherwise permitted by applicable law.
06. Payment Processing (Stripe)
When you provide payment information through the Services, that information is transmitted directly and securely to Stripe. BrandTap Canada:
- Does not receive, store, or have access to your full card number, CVV, or bank account details;
- Receives only a tokenized reference (Stripe customer ID and last-four digits of card) for subscription management purposes;
- Does not host any cardholder data environments (CHDEs) or process any financial transactions directly.
Stripe’s privacy practices are governed by Stripe’s own Privacy Policy, available at stripe.com/privacy. By using the Services, you acknowledge that payment information is subject to Stripe’s privacy policy.
07. Analytics & End-User Data
7.1 What We Collect From Landing Page Visitors
When an end user (your customer) interacts with a BrandTap landing page, we collect the following data for analytics purposes:
- Hashed IP address — the visitor’s IP address is immediately hashed using SHA-256 with a unique salt. The raw IP address is never written to storage;
- Device type (mobile, desktop, tablet) — derived from user-agent string;
- Country — derived from IP geolocation (country level only; no street, city, or postal code);
- Referring URL or UTM parameters (if present in the URL);
- Event type (page view, button click, review link tap, social link tap);
- Timestamp of the interaction.
We do not collect names, email addresses, phone numbers, or any directly identifying information from landing page end users.
7.2 Purpose of End-User Analytics
This data is used solely to generate the analytics reports displayed in your BrandTap dashboard, allowing you to understand how customers interact with your landing page.
7.3 Ownership of Analytics Data
As set out in the Terms of Service, all Analytics Data is owned by BrandTap Canada. Customers are granted access to view and export their Analytics Data (subject to their subscription plan) but do not own the underlying data. See Section 13 for how this interacts with your PIPEDA rights.
7.4 Data Minimization
BrandTap Canada is committed to collecting only the minimum data necessary to deliver analytics functionality. We do not use landing page visitor data for advertising, profiling, or any purpose other than providing the Services to the applicable Customer.
08. Data Retention
| Data Type | Retention Period | Notes |
|---|---|---|
| Account information (name, email, business data) | Duration of account + 90 days after deletion | Retained briefly post-deletion for legal and dispute purposes |
| Raw landing page event data | Approximately 30 days | Nightly automated pruning of events older than 30 days |
| Aggregated analytics data | Indefinitely (BrandTap Canada’s discretion) | De-identified summaries; may be retained and used for internal purposes |
| Payment / billing records | 7 years | Required for tax and accounting compliance under Canadian law |
| Sales rep / affiliate applicant data | Application closure + 12 months | Retained for re-application screening and audit; deleted on request |
| Support communications | 3 years after last contact | Retained for dispute resolution and service improvement |
| Legal hold data | As required by law | Retained as required by applicable legal proceedings or obligations |
8.1 Right to Change Retention Periods
BrandTap Canada reserves the right to change data retention periods at any time, subject to applicable legal minimum retention requirements. Reductions in retention periods will be applied going forward and will not retroactively recover already-deleted data.
8.2 No Guarantee of Data Restoration
BrandTap Canada does not guarantee that Analytics Data will be restored following any service outage, system failure, data corruption event, migration, or data reset. We recommend that Customers export their Analytics Data regularly using the export feature available on eligible subscription plans.
8.3 Account Deletion
When you close your account, we will delete or anonymize your personal information within a reasonable time, subject to any legal retention obligations and the residual retention period described above.
09. Data Security
BrandTap Canada takes reasonable and appropriate technical and organizational measures to protect personal information from unauthorized access, disclosure, alteration, and destruction. These measures include:
- Encrypted data transmission over HTTPS / TLS;
- Hashing of IP addresses before storage (SHA-256 + unique salt);
- One-way cryptographic hashing of passwords;
- Access controls limiting employee access to personal data on a need-to-know basis;
- Use of PCI DSS-compliant third-party payment processing (Stripe);
- Cloudflare bot-protection (Turnstile) on public forms to prevent abuse;
- Regular review of security practices and infrastructure.
9.1 Breach Notification
In the event of a privacy breach that poses a real risk of significant harm to individuals, BrandTap Canada will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by PIPEDA’s mandatory breach reporting provisions.
10. Sharing & Disclosure of Information
BrandTap Canada does not sell your personal information. We do not share your personal information with third parties except in the following circumstances:
10.1 Service Providers
We may share information with trusted third-party service providers who assist us in operating the Services (e.g., hosting providers, email delivery services, payment processors). These providers are contractually required to use your information only for the purposes we specify and to maintain appropriate security standards. The list of such providers is in Section 11.
10.2 Legal Requirements
We may disclose personal information if required to do so by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to: (a) comply with a legal obligation; (b) protect and defend the rights or property of BrandTap Canada; (c) prevent or investigate possible wrongdoing; or (d) protect the personal safety of users or the public.
10.3 Business Transfers
In connection with a merger, acquisition, sale of assets, or other business transaction, personal information may be transferred as part of the transaction. We will provide notice before personal information is transferred and becomes subject to a different privacy policy.
10.4 With Your Consent
We may share your information for any other purpose with your express prior consent.
10.5 Aggregated Data
We may share aggregated, de-identified data that does not identify any individual for business, research, or marketing purposes without restriction.
11. Third-Party Services
The Services integrate with or rely on the following third-party providers. By using BrandTap, you acknowledge that data flows through these providers under their own privacy policies:
11.1 Stripe (Payments)
Stripe, Inc. processes all subscription and one-time payments. We send Stripe your email and a customer reference; Stripe processes the card data directly. Stripe may process data in the United States. See stripe.com/privacy.
11.2 Mailchimp (Email)
Mailchimp (Intuit Inc.) handles transactional and marketing email delivery, audience management, and lifecycle messaging. We send Mailchimp your email address, business name, plan tier, and tags reflecting your account state (e.g., active, paused, cancelled) and, for sales rep / affiliate applicants, the sales_rep_prospect tag plus field-rep or affiliate sub-tags. Mailchimp processes data in the United States. See mailchimp.com/legal/privacy.
11.3 Cloudflare (Security & CDN)
Cloudflare, Inc. provides bot protection (Cloudflare Turnstile) on contact and sales-rep forms, content delivery network services, and edge security. Cloudflare may process the visitor’s IP address and a Turnstile token at the edge. Cloudflare operates a global edge network. See cloudflare.com/privacypolicy.
11.4 Forminator (Form Processing)
Forminator (WPMU DEV) is the WordPress form plugin we use for the contact form on the home page and the sales-rep / affiliate application form on the Sales Team page. Form submissions are stored on our WordPress hosting and forwarded by email to [email protected]. See wpmudev.com/legal/privacy-policy.
11.5 Anthropic (AI Reply Assistant)
Anthropic PBC provides the Claude API that powers BrandTap Genie. When you generate a reply with Genie, we send Anthropic the customer review text you pasted and your business context (business name, category) only. We do not knowingly send Anthropic any personal information about your end customers. Anthropic processes data in the United States. See anthropic.com/legal/privacy.
11.6 Hosting & Infrastructure
BrandTap Canada operates on managed WordPress hosting with infrastructure in Canada and / or the United States. Our hosting provider is contractually committed to industry-standard security practices.
11.7 Routing Destinations (Not Data Recipients)
Google Business Profile, Yelp, TripAdvisor, Facebook, and Apple Maps are routing destinations for your customers when they tap a CTA. We do not transfer customer data to these platforms beyond what is in the destination URL itself. Your customers’ interactions with those platforms are governed by each platform’s own privacy policy.
12. Cookies & Tracking Technologies
12.1 What We Use Cookies For
BrandTap Canada uses cookies and similar technologies on brandtap.ca and in the admin dashboard for the following purposes:
- Strictly necessary cookies — required to operate the Services (e.g., session authentication, security tokens). These cannot be disabled.
- Functional cookies — remember your preferences and settings within the dashboard.
- Analytics cookies — help us understand how the website and dashboard are used so we can improve them. We use aggregated, de-identified data only.
- Cloudflare Turnstile cookies — set on the contact form and sales-rep application form to prevent bot abuse. The Turnstile cookie is a strictly necessary cookie when you submit a form.
12.2 What We Do Not Use Cookies For
We do not use cookies for advertising, behavioural tracking across third-party websites, or the creation of advertising profiles.
12.3 Landing Pages
BrandTap-powered landing pages (your customer-facing tap pages) are designed to be minimal and fast. We do not set third-party advertising cookies on landing pages. We may set a minimal first-party session or analytics identifier for event tracking purposes.
12.4 Managing Cookies
You can control or delete cookies through your browser settings. Disabling strictly necessary cookies may prevent the Services from functioning correctly. For more information about managing cookies, visit allaboutcookies.org.
13. Your Privacy Rights (PIPEDA)
Under PIPEDA, you have the following rights with respect to your personal information held by BrandTap Canada:
13.1 Right of Access
You have the right to request access to the personal information we hold about you, including information about how it has been used and to whom it has been disclosed. We will respond to access requests within 30 days.
13.2 Right to Correction
If personal information we hold about you is inaccurate, incomplete, or out of date, you have the right to request that we correct it. You may update much of your account information directly through the dashboard.
13.3 Right to Withdraw Consent
Where we rely on your consent to process personal information, you may withdraw that consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may affect our ability to provide the Services to you.
13.4 Right to File a Complaint
If you are not satisfied with our response to a privacy concern, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada:
30 Victoria Street, Gatineau, Quebec K1A 1H3
Toll-free: 1-800-282-1376
www.priv.gc.ca
13.5 How to Exercise Your Rights
To exercise any of the above rights, please contact us at [email protected] with the subject line “Privacy Request” and describe your request. We may need to verify your identity before processing your request.
13.6 Personal Information vs. Aggregate Analytics Data
To clarify the relationship between this policy and BrandTap Canada’s data ownership claim:
- Personal information about you as an identified individual (your account details, billing email, support communications, sales rep / affiliate application data) is subject to your full PIPEDA rights described in 13.1–13.5 above.
- Aggregate, de-identified, or business-level analytics data (tap counts, page views, geographic distributions, device splits, return-visitor rates) is owned by BrandTap Canada and is not personal information of any individual user. PIPEDA access rights do not apply to this category of data.
- End users of Customer landing pages who wish to exercise privacy rights regarding their interactions with a Customer’s landing page should contact the Customer (the business whose page they visited), as that business is the data controller for their relationship with their customers.
This distinction is intentional and ensures the privacy policy is consistent with the Terms of Service. Where there is any conflict between this policy and PIPEDA-protected rights, PIPEDA-protected rights prevail.
14. International Data Transfers
BrandTap Canada is based in Ontario, Canada. To provide the Services, your information may be processed by our service providers in countries outside Canada, including the United States. These countries may have privacy laws that differ from those in Canada.
Specifically:
- Stripe processes payment data in the United States.
- Mailchimp processes email and audience data in the United States.
- Cloudflare operates a global edge network; data may be processed at any Cloudflare edge location worldwide.
- Anthropic processes Claude API requests in the United States.
- Hosting infrastructure may be located in Canada and / or the United States.
Where we transfer personal information outside Canada, we take steps to ensure it receives comparable protection, including by entering into data processing agreements with our service providers. By using the Services, you acknowledge that your information may be transferred to and processed in countries outside Canada.
15. Children’s Privacy
The Services are intended for use by businesses and are not directed at individuals under the age of majority in their jurisdiction. BrandTap Canada does not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us at [email protected] and we will promptly delete such information.
16. Changes to This Policy
BrandTap Canada reserves the right to update or amend this Privacy Policy at any time. When we make material changes, we will:
- Update the “Effective Date” at the top of this page;
- Provide notice to your registered email address for material changes affecting your rights.
Your continued use of the Services after the updated policy takes effect constitutes your acceptance of the revised policy. We encourage you to review this policy periodically.
The current version of this Privacy Policy is always available at brandtap.ca/privacy-policy.
17. Contact & Complaints
If you have any questions, concerns, or complaints about this Privacy Policy or BrandTap Canada’s privacy practices, please contact us:
Subject line: “Privacy Request” or “Privacy Complaint”
Website: brandtap.ca
Ontario, Canada
We will acknowledge receipt of your inquiry within 5 business days and respond fully within 30 days. If additional time is required, we will notify you of the delay and reason.
If you are not satisfied with our response, you may escalate your complaint to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
This Privacy Policy was last updated on April 25, 2026. This Privacy Policy is intended as a general legal framework compliant with PIPEDA. BrandTap Canada recommends consulting qualified legal counsel to ensure this policy is appropriate for your specific circumstances.