CrabTap Privacy Policy

Last updated: August 16, 2026

This Privacy Policy explains how CrabTap ("CrabTap," "we," "us") handles personal data when you use our platform - whether you're a customer collecting stamps and points, or a business owner running a loyalty program through CrabTap.

1. Who Is Responsible for Your Data

CrabTap works differently from most apps, so it's worth explaining clearly:

• If you are a customer, the business (venue) whose loyalty program you join is the data controller for your data at that venue - they decide what rewards to offer and how their program works. CrabTap acts as a data processor, providing the technical platform that stores and manages this data on the venue's behalf.
• If you are a business owner, you are the data controller for your customers' data at your venue. CrabTap processes that data on your behalf, under the terms of our Merchant Agreement and Data Processing Agreement.
• For account-level information you provide directly to CrabTap (like your login email), CrabTap is the controller.

2. What Data We Collect

If you are a customer:

• Name and email address
• Your permanent member number and QR code
• Stamps, points, and reward redemptions at each venue you join
• Language preference
• Country (detected automatically from your connection, not stored as precise location)

If you are a business owner:

• Name and email address
• Business/venue name and settings
• Logo and branding assets you upload
• Subscription and billing status (via Stripe - we do not store your card details)
• Your customers' data as described above, which you control

3. Why We Process This Data

• To operate your loyalty card(s) - tracking stamps, points, and rewards
• To send you transactional emails (account confirmation, password resets, receipts)
• To send you promotions from venues you've joined, unless you've muted that venue
• To send push notifications, only if you've explicitly enabled them on your device
• To provide customer support when you contact us

4. Legal Basis for Processing

• Performance of a contract: providing the core loyalty card service you signed up for
• Legitimate interest: keeping the platform secure, preventing fraud, improving the service
• Consent: marketing push notifications and, where applicable, promotional emails

5. How Long We Keep Your Data

We keep your data for as long as your account is active. If you request account deletion, we:

• Schedule the deletion with a 30-day grace period, during which you can change your mind and restore your account
• After 30 days, permanently and irreversibly delete your personal data

6. Who We Share Data With

We use a small number of trusted service providers ("subprocessors") to operate CrabTap. We do not sell your data to anyone.

7. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Request a copy of your data (data portability)
• Object to processing based on legitimate interest
• Withdraw consent for marketing at any time
• Lodge a complaint with your local data protection authority

To exercise any of these rights, contact us at support@crabtap.com.

8. Cookies

CrabTap does not use cookies. We use limited, functional browser storage (localStorage) only to remember your language preference and basic app state - this is not tracking, and no data is shared with third parties for advertising or analytics purposes.

9. Children

CrabTap accounts may only be created by individuals aged 16 or older, in line with applicable data protection law. If you believe a child under 16 has created an account without appropriate consent, please contact us.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above, and for material changes, we will notify registered users by email.

11. Contact

Questions about this policy or your data can be sent to support@crabtap.com.