TapState Cloud Privacy Policy

At TapState ("we," "us," or "our"), we take the privacy of our customers ("you," "Customer," or "User") seriously. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the TapState Cloud service ("Service").

1. Scope and Applicable Law

This Privacy Policy applies to the TapState Cloud service. Our data practices are based on the Personal Data (Privacy) Ordinance of the Hong Kong Special Administrative Region ("PDPO"). We also commit to handling personal information in compliance with the EU General Data Protection Regulation ("GDPR") for data subjects in the European Union.

2. Information We Collect

2.1 Account Information

When you register for the Service, we collect:

• Email address
• Full name
• Organization name
• Country/region
• Password, stored only as a one-way hash (not collected if you sign in with Google or GitHub)

2.2 Payment Information

Payment processing is handled exclusively by Stripe, our third-party payment processor. We do not have access to your credit card number or full payment details. We receive only:

• Payment status (successful, failed, expired)
• Billing address (provided to Stripe)
• Card brand and the last four digits of your card, for identification and verification

2.3 Operational and Usage Data

When you use the Service, we collect:

• Pipeline configuration and execution status
• Logs and diagnostic information (retained for up to 14 days via rolling window)
• Instance lifecycle events (creation, modification, release, failure)
• Request metadata (timestamp, region, user ID)

2.4 Telemetry Data

We may collect anonymized telemetry data to improve the Service. No personally identifiable information is included in telemetry.

2.5 Feedback and Support Communications

When you contact us for support or provide feedback, we collect:

• The content of your communications
• Your email address
• Any information you voluntarily provide in your messages

2.6 Sign-In Through Google or GitHub

If you choose to sign in with Google or GitHub, we receive from that provider your email address, name and the provider's account identifier, and use them to create and authenticate your account. The provider's own handling of your data is governed by its privacy policy.

2.7 Optional AI Assistant

If you configure an AI provider in the Service, prompts and the pipeline definitions, schemas or sample data included in assistant requests are sent to the provider and endpoint you configured, using your credentials. That provider is selected by you and governed by your agreement with it; it is not a TapState Subprocessor.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, maintain, and improve the Service
• To process subscription payments through Stripe
• To communicate with you about your account, subscription, or support requests
• To send you service announcements, security alerts, and other operational notifications
• To detect, prevent, and respond to fraud, abuse, and security incidents
• To analyze usage patterns and improve our products and services (using aggregated, anonymized data)
• To comply with legal obligations

3.1 Legal Bases

Where the law requires a legal basis for processing (for example under the EU or UK GDPR), we rely on the following:

4. How We Store Your Information

4.1 Storage Location

TapState provides the Service to customers globally. Storage and processing locations depend on the relevant Service deployment, the service providers used, and your configured source and destination systems.

TapState uses MongoDB Atlas for its database hosting and AWS for cloud infrastructure. The locations used for these services depend on the relevant deployment. A Cluster's deployment region does not by itself determine where all account, billing, support or other related data is processed. A customer-owned Atlas cluster is separately configured and managed by the customer.

We do not promise storage or processing exclusively within any single geographical region. Any specific data residency commitment must be expressly agreed in writing. International transfers are addressed in Section 12.

4.2 Retention Periods

• Customer-owned Atlas data: Releasing a TapState Cluster does not itself delete business data stored in your own MongoDB Atlas cluster. You remain responsible for managing and backing up that data and for the associated Atlas charges.
• TapState-managed Cluster data: Cluster configuration, runtime state, stored connection credentials and replication checkpoints are cleaned up as part of resource release. There is no guaranteed 14-day retrieval or recovery period after release. Arrange any necessary exports and backups before the Service ends; this provision does not promise an export or restore capability.
• Account, billing and support records: These records are retained separately for the purposes described in this Policy and as required by applicable law; Cluster release does not automatically delete all such records.
• Backup copies, if any: Residual copies are removed according to the applicable backup lifecycle, subject to legal retention requirements. They are not a customer recovery service, and we do not promise that every backup copy will be deleted within 14 days.

These provisions do not limit applicable data protection rights. The operational-log rolling window above is not a guarantee that a released Cluster or its data can be recovered.

5. Third-Party Processors

We work with the following third-party service providers that process data on our behalf. Providers that process Customer pipeline data as TapState's Subprocessors are listed in the Data Processing Addendum.

All processors are bound by contract to protect data in accordance with applicable data protection laws.

6. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption of data at rest (AES-256)
• Encryption in transit (TLS 1.2 or higher) for traffic between TapState-managed components and for access to the Console and Cluster APIs
• Connections to Customer-configured source and destination systems are encrypted when the Customer enables TLS in the connector settings and the system supports it
• Regular security audits and penetration testing
• Access controls and authentication for all internal systems
• Logging and monitoring for security events

No method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights

7.1 Under Hong Kong PDPO

You have the right to:

• Access personal information we hold about you
• Correct inaccurate or incomplete personal information
• Request deletion of personal information (subject to legal retention requirements)

7.2 Under EU GDPR

If you are in the European Union, you also have the right to:

• Object to certain processing of your personal data
• Restrict processing of your personal data
• Receive your personal data in a structured, commonly used format (data portability)
• Withdraw consent at any time (where processing is based on consent)

7.3 Exercising Your Rights

To exercise any of these rights, please contact us at privacy@tapstate.com. We will respond to your request within 30 days.

7.4 Complaints

You may lodge a complaint with the Privacy Commissioner for Personal Data, Hong Kong, or with the data protection authority where you live or work.

7.5 Other Jurisdictions

If you are in the United Kingdom, you have the rights described in Section 7.2 under the UK GDPR. If you are in a US state with a consumer privacy law, you may have rights to know, access, correct and delete your personal information; you can exercise them as described in Section 7.3. We do not sell personal information or share it for cross-context behavioural advertising.

8. Data Subject Request Handling

We provide a manual process for handling data subject requests. There is currently no automated API for data deletion. We are committed to responding to all legitimate requests in a timely manner.

9. Cookies and Tracking

9.1 Cookies Used

• Authentication session cookies (HttpOnly, Secure) that keep you signed in.
• The Tawk.to support chat widget, shown in TapState web consoles, sets functional cookies and local storage to maintain your chat session. Its use is governed by Tawk.to's privacy policy.

We do NOT use advertising cookies, cross-site analytics cookies or third-party tracking pixels.

9.2 Log Data

Like most web services, we collect standard log data including IP address, browser type, and access timestamps. This data is used for security monitoring and troubleshooting.

10. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will delete that information promptly.

11. Privacy Commitments

We are committed to:

• Never embedding advertising in the Service
• Collecting only the minimum amount of data necessary to provide the Service
• Being transparent about what data we collect and how we use it
• Providing clear mechanisms for you to exercise your privacy rights

12. International Data Transfers

Your information may be stored or processed in countries or regions other than your own, depending on the Service deployment, the providers used, and your source and destination configurations. The applicable data protection laws may differ between those locations.

We will comply with applicable data protection requirements for international transfers we carry out or arrange, including using a lawful transfer mechanism and any required supplementary measures where required. Customer-configured transfers do not remove our own obligations under applicable law.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice within the Service before they take effect. The updated Policy takes effect on the date stated in it.

14. Contact Information

For questions about this Privacy Policy or to exercise your data protection rights, please contact:

TAPDATA HONG KONG LIMITED
#557, 5/F, Building 19W, 19 Science Park West Avenue
Hong Kong SAR
Business Registration No. 73028663-000-05-21-A

Email: support@tapstate.com