Privacy policy

Who we are

TownTap runs a digital loyalty wallet for businesses in South African towns. You tap your phone on a tag at a business's counter to collect stamps, and every card you hold sits in one wallet.

We are the responsible party for your personal information under the Protection of Personal Information Act (POPIA). Our information officer is Chad Wright, reachable at chad@thewrightdesigns.co.za.

What we collect

When you create a wallet: your first and last name, your phone number and/or email address, and a password (stored by our authentication provider, never readable by us).

When you use the wallet: which businesses you tap at and when, the stamps, rewards and perks staff confirm for you, and your marketing choices with the date you made or withdrew each one.

Before you sign up, a tap stores only a random code in a cookie and the business you tapped. It holds no personal information and is deleted after 48 hours if you don't sign up.

Why we use it

To run your wallet: record stamps, show your progress, let staff confirm rewards at the counter, and stop the same tap being counted twice.

To keep the service secure: protecting sign-in and signup forms from abuse, and detecting copied or tampered tap links.

To send you messages you have agreed to, and nothing else.

What businesses see

A business you collect stamps at sees your name, your stamp count and your reward history with them, so their staff can recognise you and resolve questions at the counter.

Businesses never see your phone number or email address, and cannot export them.

Marketing messages

Each business asks separately whether you want its specials and event news. The box is never ticked for you, and collecting stamps never depends on it.

Offers from other TownTap businesses are a separate choice again.

You can switch any of these off at any time, on the business's page or on your profile. We record when you agreed and when you withdrew.

Who processes it for us

Your data is stored with Google Firebase in Johannesburg, South Africa. Google reCAPTCHA checks sign-in and signup forms for automated abuse. Account emails are sent through our email provider.

We do not sell your personal information, and we do not share it with anyone for their own marketing.

Cookies

We use a few essential cookies: one to keep you signed in, one to hold stamps from a tap before you sign up, one to confirm a recent tap when you redeem a reward, and one to remember which town you chose. We do not use advertising or tracking cookies.

How long we keep it

Your account information is kept while you have a wallet. Unconfirmed signups and stamps from taps without an account are deleted after 48 hours.

If you delete your account, we delete your personal information. Each business keeps an anonymised record of the stamps and rewards it gave, because that is its transaction record.

Your rights

You can ask to see the personal information we hold about you, correct it, delete it, or object to how we use it. On your profile you can change your name, contact details, password and marketing choices, download a copy of your data, and delete your account. For anything else, email chad@thewrightdesigns.co.za.

If you are unhappy with how we handle your information, you can complain to the Information Regulator (South Africa) at inforegulator.org.za.

Changes

If we change this policy in a way that affects you, we will tell you in the app before the change takes effect.