Effective from 14 October 2026.
1. Who we are
Tapvixo — this website and the app at pos.tapvixo.com — is provided by Tapvixo, a sole proprietorship registered as an MSME (Udyam), 7th Floor, 707, Naroda Business Point, Haridarshan Cross Road, Naroda Gam, Ahmedabad, Gujarat 382330 (“Tapvixo”, “we”). For the personal data this notice describes, we are the data fiduciary under India’s Digital Personal Data Protection Act, 2023.
Write to us at hello@tapvixo.com. Our Grievance Officer is Aniket Sen, at hello@tapvixo.com.
2. Two kinds of data
- About you, as someone who uses Tapvixo — an owner, co-owner or staff member of a business, someone who signs up or is invited, or a visitor to tapvixo.com. We decide how this is used, and this notice covers it.
- About a business’s own customers and staff, which the business records in Tapvixo: customer names, phone numbers, email and postal addresses, GSTINs, bills, and wallet and credit (khata) balances. The business decides what it records and why; we store and process it only to run Tapvixo for that business. If you are a customer of a shop that uses Tapvixo, ask the shop about your data — we help the shop answer you.
3. What we collect, and why
When you sign up or accept an invite
- Your WhatsApp number — to prove it is yours with a code or a link, and to sign you in.
- Your name, your business’s name and the state it is in — to set up your account. The state also decides the GST on our invoices to you.
- When you accepted these terms and this notice, and your answer about WhatsApp messages from Tapvixo.
- The internet (IP) address a signup started from — to spot many signups from one place, which we review by hand.
The six-digit codes we send are stored only in a scrambled (hashed) form, and stop working after 10 minutes.
To run your account
- Your password and till PIN, stored only as a one-way hash that cannot be turned back into them.
- Your role, the outlets you work at, and when you last signed in.
- Each device you are signed in on: its name, browser, IP address and when it was last used — so you can see where you are signed in and sign a device out.
- Sign-in attempts — to stop password guessing. A number typed at sign-in is kept only in a scrambled form.
- A record of what was done in the business, by whom, when and from which IP address — so owners can see who did what.
For billing
- The business’s name, GSTIN, address and state; your plan; payment requests and the UPI transaction reference (UTR) you give us; the payments we record; and our invoices and credit notes to you.
- We never see your UPI PIN or bank login: you pay from your own UPI app.
WhatsApp messages
- Codes and invite links, which you need to sign up, to be invited, or to reset a password by code.
- Renewal reminders and payment links — only if the business’s primary owner said yes to them.
- The alerts a business turns on (voids, large discounts, day summaries) — only to the numbers the business enters for them.
- For each message we keep which message it was, when, and what happened to it. The record of codes and invites keeps the number only in a scrambled form; a business’s alert records keep the number its alerts go to.
On tapvixo.com
- If you ask us to call you back: your name, phone number, your email if you give it, your message, the plan you asked about, the campaign tags or website that brought you, your IP address and your browser.
- Google Tag Manager runs three tools on every page of tapvixo.com, and each sets cookies:
- Google Analytics counts visits and taps on our WhatsApp and call buttons, plan cards and callback requests.
- The Meta Pixel tells Meta (Facebook) that you visited, so we can measure and show our ads. If you are signed in to Facebook or Instagram in the same browser, Meta may link the visit to that account.
- Microsoft Clarity records how our pages are used — clicks, scrolls and mouse movement — so we can see where the site is hard to use.
- The app at pos.tapvixo.com runs no advertising or analytics trackers.
When something goes wrong
- The server and the app send an error report to our error-monitoring provider — what failed, where, which browser or device, and how long pages took to load. We set it not to send passwords, codes, tokens, cookies, request bodies or what you typed into forms.
- Our servers log each request — its time, the page, the browser and the IP address. The keys in payment, bill and invite links are removed before anything is written.
Checking a new password
- When you set a password, we check it against Have I Been Pwned’s list of leaked passwords. Only the first five characters of a hash of the password leave our server: never the password, and nothing that says who you are.
4. What we do not do
- We do not sell personal data, and there is no advertising in the app.
- We do not write first on WhatsApp to a number that does not expect us: an invite goes only after the person inviting confirms the invited person expects it.
- We do not use a business’s customer records for our own purposes.
5. Who else handles it
- Amazon Web Services, Mumbai region, India — our servers, database, backups and logs.
- Meta — delivers our WhatsApp messages (the WhatsApp Business Platform; WhatsApp’s own terms and privacy policy apply to WhatsApp), and runs the Meta Pixel on tapvixo.com, which measures our ads.
- Sentry (Functional Software, Inc.) — error reports, stored in the European Union.
- Google — Tag Manager and Google Analytics, on tapvixo.com only.
- Microsoft — Clarity, on tapvixo.com only.
- Have I Been Pwned — the password check above.
- Hostinger — our email provider, for the emails you send us.
- Authorities — when the law requires it, for example tax authorities for our GST records.
Some of these may handle data outside India, where the law allows it.
6. How long we keep it
- A signup that was not finished: deleted a day after it began. A finished one: one year.
- An invite: its link stops working once used or expired, and the record is deleted a year after its last event.
- The record of each WhatsApp message we sent: one year.
- Sign-in attempts: 90 days. A device that was signed out: deleted 30 days later.
- Files you export: 7 days on our server.
- Server logs: 30 days. Error reports: 30 days.
- Backups: taken daily and kept up to 14 days.
- Your account, your business’s records and its customers’ records: for as long as the business uses Tapvixo. A late payment alone never deletes data; a business unpaid for 12 months may be closed after its primary owner is told, and is then treated as a closed account. When a business closes its account, we keep its data for 30 days so it can download it, then delete it; the copies in our backups are gone within 14 days after that. Our invoices and payment records are kept as long as Indian tax law requires.
- A request to call you back: as long as we need it to follow up. Ask us and we delete it.
7. Your choices and your rights
Under the Digital Personal Data Protection Act, 2023, you can ask us to:
- give you a summary of the personal data we hold about you and how we use it;
- correct, complete or update it;
- erase it — unless the law makes us keep it, such as tax records, or your account cannot run without it;
- let someone you nominate act for you if you die or cannot act;
- resolve a complaint.
You can withdraw your consent at any time:
- Renewal reminders and payment links on WhatsApp: the primary owner turns them off in Settings → Billing.
- Alerts: Settings → Alerts.
- Codes and invite links are how you sign in, so they stop only when the account closes.
Withdrawing does not undo what was done before. Write to hello@tapvixo.com or to our Grievance Officer; we reply within 14 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
8. How we protect it
- Everything travels over HTTPS, and the database is encrypted where it is stored.
- Passwords, PINs and codes are kept only as hashes. The keys in links are never written to our logs.
- The database itself keeps each business’s records apart from every other business’s.
- Daily backups, kept 7 days.
If a breach affects your personal data, we tell you and the Data Protection Board as the law requires.
9. Children
Tapvixo is for businesses. It is not meant for anyone under 18, and we do not knowingly collect their data.
10. Changes to this notice
We post every change here with a new date. If a change affects how we use your data, we tell primary owners before it applies.