Privacy policy

Who we are

Oh Tap! Platforms is a business name of The Better Company Inc., based in Vaughan, Ontario, Canada. In this policy, "we" and "us" mean The Better Company Inc.

Our privacy officer is responsible for how we handle personal information and can be reached at support@ohtap.io. Privacy questions and requests go there.

What this policy covers

This policy covers our website ohtap.io, the tap pages and event galleries on links.ohtap.io, and the services we provide to businesses, event hosts and their guests.

It also covers Oh Tap! Vault at vault.ohtap.io, our free photo and video storage for event pros, and the albums pros share from it. See Oh Tap! Vault below.

A tap page belongs to the business that uses it, and an event gallery to its host. They decide what goes on the page and who is invited. Links on a tap page, such as a Google review page or a booking site, lead to other companies, and their own privacy policies apply there.

What we collect

We only collect what we need to provide the service:

• When you contact us or fill in a form on ohtap.io: your name, email, phone number if you give it, your business or event details and your message. To fight spam we also keep your country, your browser type and a one-way scrambled (hashed) version of your IP address, and we note the page or ad link that brought you to the site, or the referral code of the event pro who sent you.
• When you build a page preview on ohtap.io: the business name you type, which we look up on Google to show your logo and colours.
• When you buy from us: your contact details, business name, delivery address and order, or the pickup area you choose. Card payments go through Stripe, and we never see your full card number.
• When you visit a tap page or an event page: device and usage information, such as your browser, approximate location, the pages you open and the buttons you tap, collected by the analytics tools and our own visit log listed under Cookies and analytics.
• When you browse ohtap.io: a few events, such as which side you choose, opening a live demo, sending a form or clicking to check out, recorded in our own visit log (see Cookies and analytics).
• When you share at an event: the photos and videos you upload, the name you type (if any), your reactions and, for the video guestbook, your video message and an email address or phone number so each guest leaves one message.
• Created by our photo pipeline: a caption and category for each photo, and face templates used for face matching (see Guest photos and face matching).
• From event hosts: contact details, event details and any reference photos of people the host wants featured, such as the couple at a wedding.
• From businesses: the content of their tap page, including any staff contact cards they ask us to publish, and the public details of their Google listing, refreshed about every two weeks.
• When you apply for or use Oh Tap! Vault: your email address and how you sign in (Google or an emailed link; with Google we also receive the name on your Google account), your business and display name, your role, service area and number of events a year, your website or Instagram, any partner or referral code, and the IP address you applied from. We also keep your albums and the photos and videos you upload, their captions and quality scores if AI sorting is on, how much storage and AI sorting you use, the features you ask for, the Oh Tap! offers you click in Vault, and when you last used Vault.

How we use it

• To build, run and update tap pages and event galleries, including the live photo wall, prints and photo books.
• To sort event photos, write captions and power face matching.
• To review Vault applications, run Vault accounts and, where AI sorting is on, caption and sort Vault photos.
• To answer your questions, take orders and send emails about your order or event.
• To keep our services secure and stop spam and abuse.
• To understand how tap pages are used, so we can improve them and report results to the business.
• To meet our legal obligations.

We do not sell or rent personal information, and we do not use guest photos for advertising. If we ever want to use personal information for a new purpose, we will ask first.

Guest photos and face matching

Photos and videos shared at an event go into that event's private gallery. The host controls who gets the link, can add a password, can hide any photo while the event is live, and can download everything. Guests can see the photos in the gallery, and photos can appear on the venue screen during the event and in printed photo books.

Each photo is sent to OpenAI to write a caption and choose a category, and still frames from videos are used the same way. Each photo is also sent to AWS Rekognition, which finds the faces in it and creates face templates: numbers that describe a face, not a picture of it. We use them to group the photos each person appears in, so a guest can tap their own face and see every photo they are in, and to spot the people a host chose to feature.

Face templates are biometric information, which is sensitive. They are kept in a separate collection for each event, are never used to recognise anyone across events or outside Oh Tap!, and are deleted when the photo or the event is deleted. We have opted out of AWS storing or using our content to improve its AI services, including the face matching it runs for us. OpenAI does not use data sent through its API to train its models by default.

Hosts choose Oh Tap! for their event and should let guests know that photos are shared to a gallery and the venue screen, and that faces are matched. Guests choose what to upload.

You can ask the host, or email us at support@ohtap.io, to remove a photo or video of you, or to delete your face data from an event. Parents and guardians can ask the same for photos of their children.

Oh Tap! Vault

Vault is free storage for event pros such as photographers, planners and venues. You sign in with Google or with a link we email you, and you apply before you can upload.

To decide on an application we check whether your website loads, whether your email address belongs to a past Oh Tap! event host, and whether your email domain or IP address was recently suspended from Vault, and we give the application a fit score with its reasons. Depending on the score, the application is approved straight away, held for our team to review, or put on the waitlist. When our team decides, we email you.

Vault albums are private until you share them. A share link is unlisted, tells search engines not to index the album, and can be turned off or replaced with a new link at any time.

When AI sorting is turned on for your account, a resized copy of each photo is sent to OpenAI for a caption and a quality score, which put your best shots first. Videos are not sent. OpenAI does not use data sent through its API to train its models by default. Vault never detects, matches or groups faces: our database refuses face grouping on Vault albums.

You decide what to upload and who gets a share link. If your albums hold photos of your clients or their guests, you are responsible for having their permission to store and share them.

Who we share it with

We share personal information only with the service providers below, who process it for us under their own security and privacy commitments, and when the law requires it. A business sees how its tap page is used. An event host sees the photos, videos, names, reactions and guestbook messages guests share at their event. Anyone with the share link to a Vault album can see that album.

Cookies and analytics

• ohtap.io does not use advertising cookies. Cloudflare Web Analytics counts visits without cookies. The site keeps a few small notes in your own browser (local and session storage): whether you chose business or events, the link that brought you here, and which demo pages you opened, so a form you send can tell us. Cloudflare, which hosts the site, may set a cookie that protects it from attacks.
• Tap pages and event galleries on links.ohtap.io use Google Analytics and Microsoft Clarity, which set cookies to count visits and show how pages are used, and Cloudflare Web Analytics. Pages that show a map load Google Maps, and tap pages load fonts from Google Fonts. Event pages keep your name, your guestbook contact and a few settings in your own browser, so you do not have to type them again.
• Our own visit log: ohtap.io records the few events listed under What we collect, and tap pages and event pages record page views and the buttons you tap, with how you arrived (an NFC tap, a QR code or a link), so we can see, and show each business, how its page is used. With each event we store the page, the event, the site that sent you, the device type (phone, tablet or computer), your approximate location when our hosting provides it, and a visitor ID: your IP address and browser scrambled with a key that changes every day, separately for each business or event, so we can count visitors without knowing who they are or following them from one page to another. We do not store your IP address or set a cookie, and we keep these records for 25 months.
• vault.ohtap.io keeps your sign-in session in your own browser and uses no advertising or analytics cookies. Cloudflare Turnstile checks the sign-in and application forms for bots.
• You can block or delete cookies in your browser settings, and you can opt out of Google Analytics with Google's browser add-on. Microsoft explains how Clarity handles data in its privacy statement.

Where your information is stored

Oh Tap! is based in Canada, but most of our service providers store and process information in the United States, and some in other countries. While it is there, it is subject to the laws of that country, and courts, law enforcement and national security authorities there may be able to access it. The table above shows where each provider works.

How long we keep it

• Messages and form submissions: as long as we need them to answer you and to keep business records.
• Event galleries: for the time your package keeps the gallery online (3, 12 or 24 months). Before a gallery's online period ends, we email the host a reminder to download it. 30 days after the period ends, we delete the gallery: its photos, videos, guestbook messages and face data. A host can ask us to delete an event's photos, videos and face data at any time before that.
• Face templates: until the photo or the event they belong to is deleted, and at the latest when the gallery is deleted.
• Vault: your albums, photos and videos stay until you delete them, and deleting an album or a file removes it from our storage. Your account and application details stay while your account exists. You can close your account in Vault at any time, or email us.
• Closing your Vault account: you lose access right away, and your albums and account details are deleted after 30 days.
• Closed Vault accounts: we keep a short customer record (your email address, and when and why the account was closed) for our business records, and a log of what we deleted that does not hold your full email address. Ask us at support@ohtap.io and we will delete the customer record.
• Analytics data: for the period set in each analytics tool. Our own visit log: 25 months.
• Monthly tap reports: if a business asks us to email it a monthly report on its tap page, we keep a record of each report we send and the addresses it went to.
• Backups: deleted information can remain in our backup copies after it is removed from the live service. Database backups are kept for up to 90 days and then deleted. When you ask us to delete your photos or videos, we delete them from our backups too.

Your choices and rights

You can ask to see the personal information we hold about you, to correct it, or to delete it, and you can withdraw your consent at any time (we will tell you what that changes). Email support@ohtap.io. We may need to confirm who you are first, and we will reply within 30 days, as PIPEDA requires.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

If you live in Quebec, or outside Canada, for example in the European Union or the United Kingdom, local law may give you more rights. Email us and we will help you use them.

How we protect it

Information travels over encrypted connections (HTTPS). Our database and storage encrypt data at rest, only Oh Tap! staff who need access have it, and every change to the database goes through our own API and services. The trust and security page has more detail.

If a breach of our security creates a real risk of significant harm to you, we will tell you and report it to the Privacy Commissioner of Canada, as the law requires.

Children

Oh Tap! is not aimed at children, and we do not knowingly collect personal information from children. Event guests may share photos that include children. A parent or guardian can ask the host or us to remove them.

Changes to this policy

When we change this policy, we update this page and the date at the top. If a change is significant, we will say so on this page before it takes effect.

Questions? Email support@ohtap.io.