Privacy Policy

TAPRSVP INC. is an Ontario corporation that operates TapRSVP, a web-based service designed to help hosts collect RSVPs, manage guest responses, and communicate with attendees around an event.

This Privacy Policy explains how TapRSVP handles personal information when hosts create and manage events, guests respond, or someone contacts us.

Information we collect

The information we collect depends on how TapRSVP is used. We collect information directly through account, event, RSVP, purchase, and support flows, and we may receive guest information from a host when the host records an RSVP or contact number that the guest provided to the host.

Hosts

We may collect:

• account and sign-in information;
• full name, contact email, phone number, and language preference;
• a 14+ host-eligibility attestation and the time it was recorded; TapRSVP does not require a date of birth solely for this check;
• event information such as title, date, time, RSVP deadline, note, and location;
• purchase and transaction information;
• support requests and messages.

Guests

Guests can RSVP without creating an account. We may collect:

• name;
• RSVP response;
• whether the response is for a child;
• optional message;
• phone number when required by the RSVP flow;
• SMS consent or opt-out choices;
• limited technical information needed to provide, secure, and troubleshoot the RSVP service.

A host may also record an RSVP that a guest communicated directly to the host. Where the host provides the guest's contact number for that purpose, the host must confirm that the guest authorized the host to provide that number to TapRSVP for the event.

A stored guest phone number, including a number provided by a host, does not by itself mean the guest has agreed to receive SMS. Event SMS requires the guest's own applicable SMS permission.

Payments

Payments are processed by Stripe. TapRSVP does not store complete payment-card numbers or CVCs in its own application database.

At paid checkout, Stripe may collect the payer's name and billing or postal address on its hosted payment page. TapRSVP does not copy the billing or postal address into the host profile or its own application database.

TapRSVP may keep transaction details such as order number, amount, currency, purchased items, payment status, receipt information, payer-name snapshot, and refund records for payment reconciliation, receipts, refunds, accounting and tax records, fraud or dispute handling, and other legal recordkeeping requirements.

Support

If you contact us, we may collect your email, message, topic, and any order or event information you provide. For technical issues, we may also collect limited browser or page information needed to investigate the problem.

Please do not send passwords, complete payment-card details, or unnecessary sensitive information through support or free-text fields.

Launch notification

If you ask to be notified when TapRSVP launches, we collect the email address you submit, along with the submission time, language preference, and source page. We use this information only to send the requested one-time launch email and to operate and protect the signup process.

How we use information

We do not sell personal information or use it for third-party advertising.

We use personal information to:

• provide and operate TapRSVP;
• authenticate hosts and maintain accounts;
• determine whether a person meets TapRSVP's minimum host age requirement;
• create and manage events and RSVPs;
• provide purchased features;
• send transactional email, permitted event SMS, and a requested one-time launch notification;
• process payments, receipts, refunds, accounting and tax records, and related transaction or consumer-contract records;
• respond to support and privacy requests;
• prevent fraud, spam, abuse, and duplicate activity;
• secure and troubleshoot the service;
• comply with legal obligations and enforce our service rules.

Information shared through TapRSVP

Hosts can receive information submitted by their guests, including RSVP responses and other guest information available through the event.

Where the product permits it, a host may also receive a guest phone number while that number is still retained for the event. A purchased RSVP Summary may include the retained phone information available at the time the report is accessed.

Hosts may choose whether to share their own phone number with guests who RSVP as attending.

SMS

Guest phone storage and SMS permission are separate.

TapRSVP sends event SMS only where the guest has provided the applicable event-specific permission and remains eligible to receive the message. Hosts cannot grant SMS consent on a guest's behalf.

A guest may decline or withdraw event SMS without changing their RSVP response.

To stop all TapRSVP texts for any event, reply STOP. A supported START or UNSTOP action may clear a provider-level block, but it does not by itself create event-specific SMS consent.

TapRSVP may record limited delivery metadata showing that a phone has already received the initial STOP instruction for the current SMS provider/sender scope, so the instruction does not need to be repeated on every later TapRSVP message. This operational marker is separate from SMS consent and provider-level STOP state.

Cookies and browser storage

TapRSVP uses limited cookies and browser storage needed to provide the service, including:

• an RSVP continuity cookie used to recognize an RSVP made from the same browser;
• a language preference;
• temporary session state used for product flow and notices.

TapRSVP does not currently use advertising cookies or third-party advertising identifiers.

Service providers

We use service providers to operate TapRSVP, including services for:

• authentication, database, and hosting;
• payment processing;
• SMS delivery;
• transactional email;
• web and API infrastructure.

Current providers include Supabase, Stripe, Twilio, Resend, Vercel, Railway, and Google. Google is also used to store the pre-launch notification list and, where enabled, to support Google sign-in.

These providers may process information on our behalf and may process or store information outside your province or outside Canada, depending on the service and configuration.

We may also disclose information where required or permitted by law, including for valid legal process, fraud or security investigations, or protection of rights and safety.

Retention

We keep personal information only as long as needed for the purpose for which it was collected, subject to legal, accounting, security, consent, dispute, and legal-hold requirements.

In general:

• the pre-launch notification list is kept until the one-time launch email has been sent and the list is no longer needed for delivery troubleshooting, after which TapRSVP deletes the active list;
• host account information is kept while the account exists;
• once an event is archived, recoverable guest phone information enters the redaction process and is irreversibly redacted in accordance with TapRSVP's retention schedule;
• detailed event and guest information is ordinarily scheduled for deletion about 60 days after the event is archived;
• certain information may be retained longer where required for legal, regulatory, security, dispute-resolution, or other documented retention purposes;
• transaction and refund records may be kept for six years from the end of the related tax year;
• support cases may be kept for three years after closure or final resolution;
• limited consent, opt-out, fraud-prevention, audit, or legal-hold records may be kept longer where needed for those specific purposes.

Some service providers may retain limited operational, payment, delivery, security, or backup records under their own retention requirements.

Account deletion

Eligible hosts can initiate account deletion directly from their TapRSVP profile.

Account deletion removes or irreversibly minimizes TapRSVP-controlled account, event, guest, and related personal information, subject to records that must be kept for a separate legitimate purpose.

For example, TapRSVP may retain limited transaction, refund, support, consent/opt-out, fraud-prevention, or legal-hold records where required or permitted.

Account deletion does not itself create a refund.

If the same external sign-in identity is used again later, deleted TapRSVP account and event data is not restored.

Your privacy rights

Depending on the law that applies to your request, you may have rights to:

• request access to personal information we hold about you;
• ask us to correct inaccurate information;
• withdraw consent where applicable;
• request deletion or destruction where applicable;
• request portability of eligible information where the law provides that right;
• where applicable, ask us to stop disseminating or de-index personal information;
• make a privacy complaint or challenge our practices.

We may need to verify your identity before responding, and some requests are subject to legal exceptions or retention requirements.

To make a privacy request, contact [email protected] and indicate that the request is for the Privacy Officer.

You may also have the right to contact the privacy regulator with jurisdiction over your matter.

Security

TapRSVP uses administrative and technical safeguards appropriate to the sensitivity of the information we handle, including access controls and encryption for recoverable phone numbers.

No online service can guarantee absolute security. Where required by law, we will provide notice of a qualifying privacy or security incident.

Changes to this policy

We may update this Privacy Policy as TapRSVP, our service providers, or legal requirements change.

The current version will show its effective or last-updated date.

Contact