Legal
Privacy Policy
Effective
1. Who we are
TapBaton is operated by Maksym Mruh, an individual based in Ukraine (“TapBaton”, “we”, “us”). For the processing described in section 3 that we decide on, we are the controller. Privacy contact: kruzhambus@gmail.com.
This policy covers our website, the TapBaton dashboard, support communications, billing and the routing and measurement we perform through our customers’ Smart Links.
2. Our role and our customers’ role
We decide how and why personal data is used to run TapBaton accounts, communicate with users, take payment, protect the service and understand use of our own website and dashboard. For those activities we are the controller.
Our customers choose their campaigns, link destinations, routing rules and conversion integrations. When we process a visitor’s data only on a customer’s instructions, the customer is the controller and we act as its processor. If you followed a customer’s link, that customer’s privacy notice explains its purposes, its destination sites and the advertising platforms it uses; contact the customer first about that processing, and we will help where we can.
3. What we process
| Context | Information and where it comes from |
|---|---|
| Account | Name, email address, password (stored only as a one-way hash), email-verification status, chosen language, organizations, projects, memberships and permissions, an optional second factor, and the version and time of the Terms you accepted. If you sign in with Google, we receive your Google account identifier, name, email address and profile image, and keep the tokens Google issues for that sign-in. |
| Sessions and security | Session records with the IP address and browser information of the device that signed in, request metadata, and the records we need to investigate errors, misuse and security incidents. |
| Billing | Paddle, our Merchant of Record, collects your payment details, billing address and tax details directly — we never see your card. We receive and keep your Paddle customer, subscription and transaction identifiers, the products you bought, amounts, status and refund information. |
| Support | The messages and attachments you send us and our replies. |
| Website and dashboard | The page requested, referrer, IP address and browser information sent with each request. Where analytics is enabled, page views, feature events and error reports, associated in the dashboard with your internal account identifier — never your email address. |
| Smart Link visits | Visit time, a click identifier, the requested and destination URLs, referrer, campaign and advertising-click parameters, browser and device information, approximate location derived from the IP address, routing decisions and hand-off events. They come from the visitor’s request and the customer’s settings. |
| Conversions and integrations | Click and conversion identifiers, event type and time, status, value and currency, and campaign parameters sent by customers, their partners or configured endpoints. Incoming conversion requests are stored as received, including the sender’s IP address and browser information and the full query string and body. The sender is usually a server, not the visitor. We also keep a record of each event we deliver to a configured integration, including what was sent and the response. |
How Smart Link visits are counted. The visitor’s IP address is used in memory to choose a route, filter unwanted traffic and estimate repeat visits; it is not stored in the click record. Repeat visits are estimated with a keyed digest of the IP address and browser information that is scoped to one project, one link and that link’s uniqueness period (1 hour to 360 days, set by the customer; 24 hours by default). The digest is pseudonymous personal data, not anonymous data: within one period it connects a visitor’s clicks on that link, and other fields, such as advertising identifiers, can still connect records. Smart Links set no cookies and store nothing in the visitor’s browser.
Our service is meant for business users. Do not send passwords, payment-card details, government identifiers, sensitive personal data or unnecessary personal details in public links or campaign parameters, and do not direct campaigns at children. Contact us if you believe a child’s data reached us.
4. Why we use it and our legal basis
Where the GDPR or UK GDPR applies to processing we control:
| Purpose | Legal basis |
|---|---|
| Create and run your account, provide the service you signed up for, answer support requests | Performance of our contract with you, or steps you ask for before entering it. For people using a business customer’s workspace, our legitimate interest in running that business relationship. |
| Take payment, handle refunds and keep billing records | Performance of our contract, and the legal obligations that apply to billing records. |
| Record which version of the Terms you accepted | Our legitimate interest in being able to show what was agreed and when. |
| Keep accounts and the service secure, find faults, prevent fraud and abuse | Our legitimate interest in a reliable, safe service for you and other users. |
| Understand how our website and dashboard are used and fix errors | Our legitimate interest in improving the product. The analytics is cookieless and honours your browser’s Do Not Track setting. |
| Comply with the law and establish, exercise or defend legal claims | Legal obligation, or our legitimate interest in protecting legal rights. |
Smart Link routing, measurement and deliveries to advertising platforms happen on our customers’ instructions and under their legal bases.
You need to give us your account details to have an account. Routing rules choose a destination using campaign settings and signals such as location, browser and device; this does not produce decisions with legal or similarly significant effects on anyone.
5. Cookies and similar technologies
The dashboard uses only the cookies it needs to work:
| Name | Purpose | Lifetime |
|---|---|---|
tapbaton.session_token |
Keeps you signed in | 30 days from your last use, or until you close the browser if you did not choose to stay signed in |
tapbaton.dont_remember |
Remembers that you chose not to stay signed in | Until you close the browser |
tapbaton.state |
Protects a Google sign-in against forgery | 5 minutes |
tb_locale |
Remembers the language you chose | 1 year |
tb_last_sign_in |
Remembers which sign-in method you used last on this browser, to point it out on the sign-in page | 1 year |
The dashboard also keeps unsent form drafts (for 24 hours) and layout preferences, such as column and sidebar choices, in your browser’s local storage. On secure sites these cookie names carry a __Secure- prefix. The checkout page loads Paddle’s checkout, which sets Paddle’s own cookies under Paddle’s privacy policy. Our marketing website sets no cookies, and our help site stores only its display theme and sidebar state in your browser. Our analytics provider (Swetrix) does not use cookies or browser storage.
6. Who receives information
We share personal data only as needed for the purposes above:
- Paddle (Paddle.com Market Limited and its affiliates), our reseller and Merchant of Record, which processes payments, taxes, invoices, refunds and its customer portal as a controller under its own privacy policy.
- Hosting and infrastructure: DigitalOcean, which hosts our servers and databases in Frankfurt, Germany, and stores their backups; Cloudflare, for DNS, certificates for customer domains, storage of routing configuration and, where enabled, running Smart Links at its edge network.
- Email: an email delivery provider that sends verification and password-reset messages, and Google, which hosts our support mailbox.
- Google, if you choose to sign in with Google.
- Swetrix, our cookieless website and dashboard analytics provider, where analytics is enabled.
- Integrations our customers configure, such as Meta, Google Ads, TikTok, Snapchat, Reddit, Pinterest, Microsoft Advertising, LinkedIn, Bigo, a customer’s own endpoints and alert channels such as Slack, Discord or Telegram. They receive the click identifiers, conversion details, page addresses and browser information the customer’s configuration sends, and use them under their own policies.
- Domain-safety services (Spamhaus, abuse.ch URLhaus and Google Web Risk), which receive domain names and hostnames to check them for abuse.
- Professional advisers and authorities, where needed to comply with the law, enforce our Terms or protect rights and safety.
We do not sell personal data, and we do not use it for our own cross-context behavioural advertising. People in a customer’s workspace see the data their permissions allow.
7. International processing
TapBaton is operated from Ukraine, which does not currently have an adequacy decision from the European Commission, and our servers are in Germany. Some providers above process data in other countries, including the United States. Where personal data from the EEA or UK goes to a country without an adequacy decision, we rely on the safeguards the provider offers in its data processing terms, such as the European Commission’s standard contractual clauses. Contact us for more information about these safeguards.
8. How long we keep it
| Information | Retention |
|---|---|
| Account and Terms acceptance records | For as long as the account exists; deleted within 30 days of a verified deletion request, except what we must keep for legal claims or billing |
| Sessions | Valid for 30 days after last use; ended sessions are deleted with the account |
| Billing records | For as long as the account exists and afterwards for as long as tax and accounting law requires. Paddle keeps its own records under its policy |
| Support messages | Up to 3 years after the conversation ends |
| Smart Link click records | About 13 months (the IP address is never stored) |
| Reporting copies of clicks and conversions, incoming conversion requests and integration delivery records | For as long as the project exists |
| Backups | Deleted data can remain in backups until those backups are deleted |
Deleting a project removes its settings but does not yet erase every visit and conversion record or backup. Ask us if you want them deleted.
9. Your rights
Depending on where you are, you can ask us to give you access to your personal data, correct it, delete it, restrict its use, give you a portable copy, and you can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time. Email kruzhambus@gmail.com, saying which account or link the request concerns. We may ask for proportionate information to confirm it is you. We reply within one month, and explain if we need longer or cannot fulfil a request.
If the request concerns data we process for a customer, we will pass it to that customer and help them answer it.
You can complain to a data protection authority — in the EEA, the authority where you live, work or think an infringement happened; in the UK, the ICO; in Ukraine, the Ukrainian Parliament Commissioner for Human Rights. We would appreciate the chance to address your concern first.
Some US state laws give residents rights to access, correct, delete or obtain a copy of their personal data and to opt out of sale, sharing or targeted advertising, sometimes through an authorised agent and with a right to appeal. Use the same email address for these requests; to appeal a decision, reply to our answer and say you are appealing.
10. Security
We protect personal data with measures such as encrypted connections, hashed passwords, encrypted storage of integration secrets, access limited to what each person needs, and optional two-factor authentication. No online service can guarantee absolute security. Report a suspected security issue to kruzhambus@gmail.com without including secrets or unnecessary personal data. If a breach affects your personal data, we will notify you and the authorities as the law requires.
11. Changes to this policy
We will date each version of this policy and tell you about material changes before they take effect, by email or in the dashboard.