Privacy Policy

1. Scope of this Policy

This Privacy Policy applies to personal information handled by Tapplify Technologies Inc. ("Tapplify," "we," "us" or "our") through our websites, customer dashboard, property pages and guidebooks, QR and NFC experiences, AI Concierge, customer support and related products and services (collectively, the "Services").

It applies to website visitors, customers such as hosts and property managers, authorized team members, and guests who interact with a Tapplify-powered property experience.

A property operator may have its own privacy practices in addition to this Policy. Where a property operator decides what guest information to collect or how to use it for its own purposes, that operator is responsible for those decisions and its own legal obligations.

2. Who uses Tapplify

Customers and property operators

Tapplify customers include property owners, hosts, vacation-rental operators, hospitality businesses, property managers and their authorized team members.

Guests and end users

Guests may access a Tapplify property experience by scanning a QR code, tapping an NFC touchpoint or following a direct link. Guests generally do not need to create a Tapplify account to view property information.

Website visitors and prospects

People may browse our website, use the website AI product concierge, request information or contact us before becoming customers.

3. Information we collect

The information we collect depends on how you interact with Tapplify.

Account and customer information

• Name, email address, phone number, organization or property name and other contact details.
• Account credentials, account preferences and authorized team information.
• Subscription, billing and transaction information. Payment card details may be handled directly by a payment processor rather than stored by Tapplify.
• Customer support requests, feedback and other communications with us.

Property content

• Property names, descriptions, photographs, branding, amenities, house rules, Wi-Fi details, instructions, recommendations, links and other content uploaded or configured by a customer.
• Knowledge-base information used to configure an AI Concierge for a property.

Guest interaction and technical information

• Device, browser, operating system, IP address, approximate network or region information, timestamps and technical logs.
• QR scans, NFC interactions, sessions, page or content views and other usage events within a Tapplify property experience.
• Questions, prompts and related conversation information submitted to an AI Concierge.
• Conversation and session identifiers used to maintain continuity and operate the experience.

Website and inquiry information

If you contact us, request a demo or submit a form, we may collect the information you choose to provide, such as your name, email, phone number, company, property type, number of properties, inquiry topic and message.

Please avoid submitting highly sensitive personal information through property content, forms or AI conversations unless it is necessary and you are authorized to provide it.

4. How we collect information

We may collect personal information:

• directly from you, when you create an account, configure a property, contact us, submit a form, place an order or use an AI conversation;
• automatically through the Services, when a browser or device communicates with our website, property experience or infrastructure and creates technical logs, session identifiers or usage events;
• from a Tapplify customer or property operator, when that customer configures authorized users, property content or information needed to provide a guest experience; and
• from service providers, when necessary for payments, security, delivery, customer support or other functions described in this Policy.

When we collect information for or on behalf of a property operator, we identify that relationship where required by law.

5. How we use personal information

We may use personal information to:

• provide, operate and maintain the Services;
• create and manage accounts and property experiences;
• deliver property content to guests;
• process AI Concierge questions and maintain conversation context;
• provide analytics and operational insights to customers;
• process subscriptions, orders and payments;
• respond to support requests, inquiries and service communications;
• secure the Services, prevent abuse, investigate incidents and troubleshoot errors;
• understand product performance and improve functionality and user experience;
• comply with legal, regulatory, tax, accounting and contractual obligations; and
• send marketing communications where permitted by law and where any required consent has been obtained.

We limit collection, use and disclosure to purposes that are reasonable, necessary and appropriate in the circumstances.

6. Consent and choices

Where consent is required, we seek consent in a manner appropriate to the sensitivity of the information and the context. Consent must be meaningful and may be withdrawn where the law permits, subject to legal or contractual limitations.

We do not require personal information that is not reasonably necessary to provide a requested product or service, except where collection is permitted or required by law.

If we wish to use personal information for a materially new purpose that is not compatible with the original purpose, we will obtain new consent where required.

7. AI Concierge and conversational data

Tapplify provides AI-powered conversational experiences for property guests and website visitors. When you submit a question or prompt, the content of that interaction and related context may be processed to generate a response, maintain conversation continuity, secure and troubleshoot the service, and support product quality and improvement.

Property-specific AI responses may use information supplied by the relevant property operator. Depending on the features enabled for a property, the property operator may be able to view AI questions, conversation-related insights or notifications about questions the AI could not answer.

8. Property operators and customer responsibility

Customers determine much of the property-specific content presented through Tapplify, including house information, rules, Wi-Fi information, amenity instructions, recommendations and AI knowledge-base content. Customers are responsible for keeping that information accurate, lawful and up to date.

Where Tapplify processes guest information on behalf of a property operator to provide the Services, Tapplify uses that information as necessary to perform the service and in accordance with applicable agreements, this Policy and law. The property operator may have separate obligations to provide its own privacy notice or obtain consent for its independent uses of guest information.

9. Service providers and disclosure

We may disclose personal information to trusted service providers that help us operate Tapplify, including providers of cloud hosting and security, email delivery, payment processing, analytics, customer support, application infrastructure and AI-related processing. These providers are permitted to process information only for the services they provide to us and subject to appropriate contractual or legal protections.

Tapplify currently uses Cloudflare infrastructure for certain hosting, delivery and security functions and may use Resend for transactional email delivery. Other providers may be added or changed as the Services evolve.

We may also disclose information when reasonably necessary to comply with law, protect rights or safety, investigate fraud or security incidents, complete a corporate transaction subject to applicable safeguards, or act with your consent or at your direction.

Tapplify does not sell personal information.

10. Processing and transfers outside Quebec or Canada

Tapplify and our service providers may process or store information in Quebec, elsewhere in Canada, the United States or other jurisdictions where we or our providers operate. Personal information may therefore be communicated outside Quebec and may be subject to the laws of those jurisdictions.

Where Quebec law requires a privacy impact assessment before personal information is communicated or entrusted to a service provider outside Quebec, Tapplify will complete the required assessment and use appropriate written contractual safeguards before the transfer.

Where other applicable law requires additional safeguards for cross-border processing, we take the steps required by that law.

11. Retention and destruction

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain legitimate business and security records, resolve disputes, enforce agreements and meet legal or accounting requirements.

Retention periods vary by the type of information and the context in which it was collected. Tapplify maintains or will maintain retention and destruction guidelines appropriate to the information it holds. Where required by law, we will provide information about the applicable retention period on request.

We delete, anonymize or securely dispose of personal information when it is no longer required, subject to lawful exceptions, recordkeeping obligations and backup cycles.

12. Security and confidentiality incidents

We use reasonable administrative, technical and organizational safeguards appropriate to the nature and sensitivity of the information we handle. These measures may include access controls, authentication, encrypted communications, provider security controls, logging and internal procedures designed to reduce unauthorized access, loss, misuse or disclosure.

No method of transmission or storage is completely secure. If a confidentiality or privacy breach occurs, Tapplify will assess the incident and provide notices to affected individuals and regulators where required by applicable law. Tapplify is also required to maintain records of confidentiality incidents where Quebec law applies.

13. Cookies, browser storage, identification and automated processing

Tapplify may use cookies and similar browser technologies where necessary to operate the website and Services. We may also use local or session storage to remember interface settings such as language preferences and to maintain AI conversation continuity on a device.

The current public website does not intentionally activate precise device geolocation or advertising-profiling functions by default. If Tapplify introduces a technology with functions that identify, locate or profile an individual and applicable law requires prior notice or activation controls, we will provide those notices and controls before the function is activated.

The AI Concierge generates informational responses, but Tapplify does not currently use personal information through the public website to make decisions about individuals based exclusively on automated processing that produce legal or similarly significant effects. If this changes, we will provide the information and review rights required by law.

If we introduce non-essential analytics, advertising or profiling technologies that require notice or consent, we will provide appropriate controls and update this Policy.

14. Your privacy rights

Depending on where you live and which law applies, you may have rights to:

• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion, cessation of dissemination or de-indexing in circumstances provided by law;
• withdraw consent where processing is based on consent, subject to legal or contractual limits;
• request information about how your personal information has been used or disclosed;
• receive certain computerized personal information in a structured, commonly used technological format where a portability right applies; and
• challenge or complain about our privacy practices.

We may need to verify your identity before completing a request. Some information may be exempt from access, deletion or other requests where permitted or required by law.

On request and where required by Quebec law, we can also provide information about the personal information collected from you, categories of people within Tapplify who may access it, the applicable retention period and the contact information of our Privacy Officer.

You may also complain to the Commission d’accès à l’information du Québec, the Office of the Privacy Commissioner of Canada, or another competent privacy regulator, depending on which law applies.

15. Children and minors

Tapplify is designed primarily for property operators and for guests accessing information about a stay. We do not design the Services to solicit personal information from children.

Where Quebec law applies, personal information concerning a child under 14 may not be collected directly from that child without the consent of a parent or person having parental authority, unless the collection is clearly for the child’s benefit as permitted by law. Parents and guardians should supervise minors using a property experience and should avoid allowing children to submit personal information through forms or AI conversations.

16. Changes to this Policy

We may update this Privacy Policy as Tapplify evolves, our practices change or legal requirements are updated. We will publish the revised Policy with a new effective date and provide additional notice of material changes where required by law.

17. Contact and Privacy Officer