Privacy Policy
Last updated 6 September 2026. Counsel signed 6 September 2026. Download signed pack (PDF)
1. Who we are
The controller of account, billing, chip and support data is WiseTap Ltd (company number 15646517), whose registered office is at 163 Woodland Gardens, Isleworth, United Kingdom, TW7 6LX. Contact the privacy inbox at privacy@wisetap.co.uk.
We are a UK data controller. Our application to the Information Commissioner's Office for the data protection fee that applies to a commercial organisation has been submitted; we are waiting for the ICO to issue the registration number. It will be published in this paragraph as soon as it appears on the register. You can complain to the ICO at ico.org.uk or 0303 123 1113 whether or not a number is shown yet.
When a visitor leaves their details on your page, you are the controller of that lead. We process it on your instructions under the Data Processing Addendum.
Hardware checkout on wisetap.co.uk is run on Shopify. Shopify’s shop notice covers that checkout. This page is the notice for WiseTap accounts, public pages, chips and the app hosts (app, tap and id).
2. Who this covers
- People who create a WiseTap account or buy hardware from the WiseTap shop.
- Visitors who open a public page, tap a chip, scan a QR code or use a short link.
- People whose details are submitted on a page (leads). Their rights are against the page owner; we help the owner respond.
3. What we collect
Account holders
Email, name, username, sign-in provider (Google, GitHub or magic link), profile photo from that provider if you use one, plan, Stripe customer and subscription ids when billing is live, marketing-consent flag and timestamp, pages you publish (name, bio, contact details, links, images, forms), chip codes and activation records, short links, AI-assistant knowledge you upload, and emails you send us.
Visitors
If you accept insights: a first-party visitor id, a per-page session id, the event type (view, tap, click, save, lead), optional chip or block id, referrer host, country from the Vercel edge, and a coarse device class from the user-agent (mobile / tablet / desktop). If you reject or ignore the banner we do not write those ids and we do not send /api/track from your browser.
A form or exchange sheet may collect name, email, phone, company, message, custom answers and a marketing consent tick. That record is stored for the page owner.
The optional AI chat on a page stores the messages in that tab session (a random wt_ai_session token, not your name). The owner can read those turns to fill gaps in their knowledge base.
Short-link clicks store country, device class and referring host. They do not store a visitor id.
Hardware orders
Cards, plates, stands and keychains are sold on the Shopify store at wisetap.co.uk. Shopify is a separate controller for checkout, payment and shipping data on that store. We receive what we need to reserve and activate a chip (typically an order email, order reference and the chip code).
4. Lawful bases (UK GDPR)
| Purpose | Basis |
|---|---|
| Create and run your account, pages, chips, forms, short links and lead inbox | Contract (Art 6(1)(b)) |
| Take payment and keep invoices when paid plans are live | Contract; legal obligation for tax records (Art 6(1)(c)) |
| Security, abuse prevention, rate limits, debugging | Legitimate interests (Art 6(1)(f)) — keeping the service safe |
| Email you about the product when you have ticked marketing consent | Consent (Art 6(1)(a) and PECR) |
| First-party insights cookies and localStorage | Consent (PECR). Without it we do not store a visitor id. |
| Process leads for a page owner | We are the processor. The owner must have their own basis (usually consent or legitimate interests). |
| Social monitor of Facebook and Instagram comments on Pages you connect (coming soon; today only used on WiseTap's own Pages) | We are the processor for comments on Pages you connect. Legitimate interests for WiseTap's own Pages. |
You can object to legitimate-interests processing or withdraw consent at any time. Withdrawing consent does not affect processing already completed.
5. Marketing (PECR)
We only send WiseTap news, offers or “plans are open” mail if you ticked the marketing box (register, settings, or the billing waitlist). You can turn it off in Settings or use the unsubscribe link in the email. A transactional message — magic link, chip code, lead alert, account deleted — is not marketing.
Follow-up mail a page owner sends to a lead is the owner's marketing. Soft opt-in does not apply: no sale took place on the form. The owner needs the consent tick, and every marketing email must identify them and include unsubscribe.
6. Cookies and similar storage
Session cookies for sign-in, CSRF, page gates, the consent choice and a pending chip code are strictly necessary. Optional first-party visitor and session ids are used only for Insights. We do not run Google Analytics, a Meta pixel, or advertising cookies on the app hosts. Full list: Cookie Policy. The Shopify shop has its own cookies.
7. Processors
We use these organisations to run the service. Each is bound to process only on our instructions (or yours, for lead data).
| Processor | What they do | Where |
|---|---|---|
| Vercel Inc. | Hosting, CDN, serverless functions, cron, optional AI Gateway | EU / US |
| Neon, Inc. | Postgres for accounts, pages, leads, events and short links | UK / EU (project region) |
| Amazon Web Services EMEA SARL | S3 for images and files you upload. Bucket region eu-west-2 (London) | UK |
| Resend, Inc. | Transactional email (magic links, lead alerts, chip codes, owner follow-ups) | US / EU |
| Google Ireland Limited | Google sign-in. Safe Browsing checks on short-link targets when that key is set | EEA / US |
| GitHub, Inc. | GitHub sign-in | US |
| Stripe Payments Europe, Ltd | Subscriptions and card payments when Checkout is open | EEA / US |
| Upstash, Inc. | Distributed rate limits in production | UK (London) |
| Functional Software, Inc. (Sentry) | Error monitoring, when a DSN is configured | US / EU |
| Model providers behind Vercel AI Gateway (including OpenAI, Inc. and Google) | Visitor chat, knowledge split and comment sentiment — only when AI is enabled on a page | US / EU |
| Meta Platforms Ireland Limited | Social monitor: Graph API for Facebook and Instagram comments on Pages a customer connects. Also used on WiseTap’s own Pages until the customer tool ships | EEA / US |
Shopify International Ltd runs the hardware shop. It is a controller of shop-checkout data, not our sub-processor for the app. If you later connect a webhook, Zapier or a CRM, that destination is your processor, not ours.
If we add or replace a processor we will update this list and the DPA. You may object within 14 days as the DPA says.
8. International transfers
Some processors are in the United States. When a transfer is not covered by a UK adequacy regulation we use the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses plus the UK Addendum. Where a processor is certified under the UK Extension to the EU-US Data Privacy Framework we may rely on that.
Uploaded images stay in AWS eu-west-2 (London) unless you yourself publish a URL hosted elsewhere.
9. Retention
| Data | Kept for |
|---|---|
| Account, pages, blocks, chips you claimed, short links, AI knowledge | Until you delete the account or the item |
| Contacts / leads | Until the owner deletes the contact or the account |
| Insights events | The window on the owner's plan (28 / 90 / 365 days, or for as long as Premium lasts), then dropped from the readable store |
| Short-link click rows | With the link; deleted when the link or account goes |
| Assistant chat turns | Until the owner deletes the assistant or the account |
| Email logs (address, subject, status) | Up to 12 months |
| Billing and invoices | 6 years from the end of the tax year, where the law requires |
| Support mail | Up to 24 months after the thread closes |
| Consent cookie / localStorage | 365 days, then the banner asks again |
Delete your account from Settings. That removes pages, blocks, contacts, events, short links and assistant data. Chips return to unclaimed so a later owner can activate them. We may keep a thin billing or abuse record where the law or a legitimate security interest requires it.
10. What we do not do
- We do not sell personal data.
- We do not use leads for WiseTap's own marketing.
- We do not run third-party advertising pixels on public pages.
- We do not use visitor chat to train a public model. Prompts go to the configured provider to answer that request.
11. Automated processing and AI
Insights are counts, not scores that decide a legal or similarly significant effect. The optional page assistant answers from the owner's knowledge. We redact obvious secrets (keys, bank details, NI numbers) before text reaches a model. Comment sentiment on connected social posts is a triage flag, not a decision about you. There is no solely automated decision that produces legal effects.
12. Security
TLS in transit, hashed page and block passwords, httpOnly session and gate cookies, origin checks and rate limits on public writes, and access limited to people who need it. No method is perfect; email privacy@wisetap.co.uk if you think something is wrong.
13. Your rights
Under UK GDPR you can ask for access, rectification, erasure, restriction, portability and to object to processing based on legitimate interests. You can withdraw consent. Email privacy@wisetap.co.uk from the address on the account (or describe the lead if you are a visitor). We will respond within one month, or explain why we need more time.
Signed-in owners can download a copy of their account from Settings → Download my data (JSON or CSV: pages, blocks, contacts and answers, events, chips, short links, assistant sections). Email privacy@wisetap.co.uk if you cannot sign in or want us to send the file. Page owners on Pro can also export contacts as CSV from the inbox; Premium can export insights. Those plan exports are not a substitute for the right to portability.
You can complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113. We would rather fix it first.
14. Children
The service is not aimed at under-13s. Accounts and paid contracts are for people 18 or over. Age gates on public pages are honour-system warnings, not age verification.
15. Changes
Material changes will be posted here with a new “last updated” date and, if you have an account, emailed or shown in the product. The current version is the one on this URL.
16. Contact
privacy@wisetap.co.uk · hello@wisetap.co.uk · info@wisetap.co.uk (shop)
0330 043 8860
WiseTap Ltd (company number 15646517), whose registered office is at 163 Woodland Gardens, Isleworth, United Kingdom, TW7 6LX · Companies House