Tapvero dashboard
Privacy for your Tapvero dashboard
This notice covers product activation and link management at go.tapvero.io. The Shopify shop has separate purchase and privacy information.
Who operates the service
TAPVERO PEDERSEN, organisation number 938195234, is responsible for this service and uses the Tapvero brand. Contact Dennis@tapvero.io about privacy or your account.
Your account and products
We use your email address and account identifier to sign you in and connect you to your products. The service stores product and order references, Google review destinations, ownership and activation records. Changes and security-relevant actions are recorded to protect access and resolve support requests. Information comes from you, the product setup process and, if you choose Google sign-in, Google through Supabase Auth.
Why we use this information
For an individual who contracts with us, account access and product management use information necessary to provide that service (GDPR Article 6(1)(b)). Where you act for a business, we rely on our legitimate interests in providing its authorised staff with access and preserving correct product ownership (Article 6(1)(f)). Proportionate abuse prevention and dispute handling also rely on our legitimate interests in protecting customers and the service.
Providing an email address and the relevant product information is necessary to manage a product online. Authentication information is not permission to send advertising. The dashboard does not use your account to create advertising profiles or make decisions with legal or similarly significant effects. You may object to processing based on legitimate interests.
Signing in
Supabase Auth handles one-time email codes; Brevo delivers authentication email. Login messages are operational messages, not consent to marketing.
Brevo is configured to retain transactional logs for one month and not store new email previews. Recorded consent is required for recipient-linked open and click tracking. Delivery and security metadata, possibly anonymous engagement events and previously stored material may remain.
If Google sign-in is enabled and you choose it, Google supplies your identity, email and basic profile through Supabase Auth. Tapvero uses the confirmed email and account identifier to authenticate you. The app does not request access to Gmail, Drive, Google reviews or your Google Business Profile. Google sign-in alone does not claim a product.
The application creates a separate dashboard session and does not store Google access or refresh tokens in its application database. This does not describe the internal retention of Google or Supabase, which holds the authentication account and provider identity.
Sessions and security
Necessary session cookies keep you signed in. A dashboard session lasts up to 12 hours; logout revokes it. The Google sign-in handshake expires after 10 minutes and its browser cookie is cleared when the callback runs. Expiry is not a promise of immediate deletion from every system.
The app uses hashed email, account or request-IP values for rate limiting. A hash does not guarantee anonymity. Hosting and bot-protection providers process technical request information separately. Cloudflare Turnstile helps prevent automated abuse.
Product scans
The redirect service records a product's total scan count and latest scan time. A scan is not a verified review or sale. Following a product link takes you to the chosen destination, whose own privacy practices apply. Do not include another person's private information in a public destination URL.
Providers and locations
Supabase provides authentication and database services, with this project's primary region in Ireland. Netlify hosts this dashboard version, with its server functions in Ohio, USA. The previous Vercel host in the USA is paused and no longer serves this dashboard. Its retained deployments, logs and environment configuration have not been erased. Brevo delivers sign-in emails. Google handles Google sign-in if enabled. Cloudflare Turnstile processes browser and security signals for bot protection and separately to improve its detection; see Cloudflare's Turnstile notice.
A selected region does not confine every provider's logs, support or processing to that region. Supabase's published data-processing addendum includes Standard Contractual Clauses for applicable transfers. Netlify's addendum provides an EU-US Data Privacy Framework route and Standard Contractual Clauses fallback. Brevo's addendum and Cloudflare's addendum also set out international-transfer safeguards. Contact us for information or a copy of relevant safeguards. These published mechanisms do not establish that all processing stays in the EEA; practical transfer safeguards and handling of retained previous-host material remain under review.
How long information is kept
Account and ownership information supports access while you manage a product. On an account-closure request, the continuing need for it must be assessed together with product access, any unresolved ownership dispute and applicable legal requirements. Security and support records must not be kept merely because they are old records: continued retention needs a specific unresolved support, security, dispute or legal purpose. There is no automatic account-deletion button.
A session stops authorising access when it expires or is revoked. Database session records more than 30 days past expiry are removed when a new dashboard session is created, not by a daily deletion job. Rate-limit records older than 24 hours are pruned when the relevant rate-limit function runs. These are event-triggered cleanups, not guarantees that every copy is erased at those times. Provider logs and backups have separate retention; expiry of a sign-in code does not erase an email delivery record.
Your rights and account closure
Contact Dennis@tapvero.io to request access, correction, deletion, restriction, applicable portability or to object to legitimate-interest processing. Requests are handled manually. We may need proportionate confirmation that you control the existing account before disclosing information or changing product access. We must respond without undue delay, normally within one month; any permitted extension must be explained within that first month.
Account deletion and product ownership are separate. A closure request needs an appropriate decision on each linked product; it is not permission to transfer it to someone else or erase records required for an unresolved claim. Removing Tapvero's connection in your Google Account does not itself delete your Tapvero product records. Tell us if you also want your Tapvero account closed.
You may complain to the relevant supervisory authority, including Norway's Datatilsynet.