Tappa Keyboards Technology
Privacy Policy

Introduction

Tappa Keyboard Technology Inc. ("Tappa", "We", "us", or "our") is a privacy-first mobile device technology development company that specializes in offering end users ("Users" or "You") the best-in-class experience in a mobile keyboard application. We believe in creating immersive mobile-first environments where people can connect with the brands they love. This is facilitated through a combination of technology solutions that have user privacy at its core without compromising the user experience. Tappa cares about the security and privacy of the personal data that is entrusted to us. We believe the user should not have to compromise privacy for functionality.

It is Tappa's policy to respect your privacy while you use our platforms (the “Tappa Keyboards"). Any information that we do receive is by fair and lawful means.

Tappa Keyboards recognizes that Users are mindful of their privacy. Tappa Keyboards provides this Privacy Policy to help you make an informed decision about whether to use or continue to use the Tappa Keyboards. If you do not agree to our practices, please do not use Tappa Keyboards and any other Keyboard applications we provide. Your continued use of the Tappa Keyboards will be regarded as acceptance of our privacy and personal information practices.

We offer Tappa Keyboards for both iOS and Android platforms and we refer to all these products, including future updates and upgrades as "Services" in this policy.

GDPR Legal Basis Summary. For users in the EU/EEA, Tappa processes personal data on the following legal bases under Article 6 GDPR: (a) Contract performance (Art. 6(1)(b)): processing necessary to provide the Tappa Keyboard Service and operate the Cashback Program, including account management, cashback tracking and payment. (b) Legitimate interests (Art. 6(1)(f)): processing necessary for Tappa's legitimate business interests, including device identifier collection for technical optimisation and attribution, usage analytics, fraud detection and security, and direct marketing to existing users (subject to your right to object at any time). (c) Consent (Art. 6(1)(a)): processing based on your freely given, specific, informed, and unambiguous consent, including: location data collection, non-essential cookies and tracking technologies, typed content processing for AI features, and sharing of data with independent third-party keyboard apps. You may withdraw consent at any time through your in-app privacy settings; withdrawal does not affect the lawfulness of processing carried out before withdrawal. (d) Legal obligation (Art. 6(1)(c)): processing necessary to comply with applicable law, including tax reporting and data breach notification obligations.

A Special Notice About Children

Users Under 16 Years of Age are not eligible to use the Services unsupervised, and we ask that children do not submit any personal information to us. If you are under the age of 16, you may only use the Services in conjunction with, and under the supervision of your parents or guardians. Participation in the Tappa Cashback Program requires that you be at least 18 years of age. In the EU/EEA, in accordance with Article 8 GDPR, where processing is based on consent and a user is under the age of 16 (or a lower age as permitted by the Member State of the user's habitual residence, which may be as low as 13), consent is only valid if given or authorised by the holder of parental responsibility. We take reasonable steps to verify that consent has been provided or authorised by the holder of parental responsibility where a user appears to be under 16.

Users Under 13 Years of Age: Children under the age of 13 are not eligible to use the Services. Only parents or legal guardians can submit personal information to us about a child. Tappa's Services comply with the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501-6506) and the FTC's COPPA Rule. Tappa does not knowingly collect, use, or disclose personal information from children under 13 without verifiable parental consent. If a parent or guardian believes their child has submitted personal information to us without their consent, please contact us immediately at privacy@keyboardtechnology.com. We will promptly delete any such information from our records.

By visiting our Site and/or using our Services, or by including children under the age of 13 years old in our provided services, you are agreeing to the terms of this Privacy Policy and the accompanying Terms of Use.

If we learn we have collected Personal Information from a User under the age of 13 without parental consent, we will delete that information as quickly as possible.

If you choose to use any of our AI-powered features, you must be over the age of 18. For more information, check our Terms of Service.

Owner & Data Controller

Tappa Keyboards, a business brand of Tappa Keyboard Technology Inc. 1216 Broadway, Office #202 New York, NY 10001. In regard to the processing of your data, Tappa Keyboard Technology Inc. acts as the controller.

How to Contact Us

For customer support, please email support@keyboardtechnology.com.

For all data privacy matters, please contact our Data Protection Officer (DPO) at dpo@keyboardtechnology.com.

Our EU representative under the GDPR is Tappa Keyboard TechnologyOps (Ireland) Limited. In regard to the processing of your data, Tappa Keyboard Technology Inc. acts as the controller.

To contact us by mail: 1216 Broadway, Office #202 New York, NY 10001

How We Collect Your Information

We may collect browsing data automatically when you use our services.

Which Information We Collect About You

We may collect the following information from you:

a) Device Information: Advertising identifiers for Android mobile devices, IP Address. When using our applications your device may also request access to the following features, but the data will never leave your device. This means the data below is never collected or stored on any servers.

b) Contact List: For contact suggestions related to call management while using the keyboard.

c) App Usage Data: Usage Data such as browser type, session duration, operating system, system language, device model, device motion parameters, first launch, app opens and updates, download, and installation confirmation.

d) Browser Data: If you choose to use our "Web View" in-app browser we may process data related to your IP Address and the cookies which are stored on your preferred browser.

e) Typed Content: If you choose to use our AI-powered features such as our Tappa Text Utilities (translation, spellchecking, etc.) we will process the data you type and send it to OpenAI in order to provide an answer to your request.

e-i) Keystroke Data — Wiretap Act and CIPA Consent. The keystroke metadata collected as described in item (e) above is processed pursuant to your express, informed, and freely given consent as required by the federal Electronic Communications Privacy Act (18 U.S.C. §§ 2510–2523), the California Invasion of Privacy Act (Cal. Penal Code §§ 630–638), and all equivalent state electronic surveillance statutes.  By activating the Tappa Keyboard you provide the affirmative, prior consent required by these statutes.  Consent may be withdrawn at any time by disabling or uninstalling the application.  Tappa collects only keystroke metadata (timing, cadence, correction patterns) for the limited purposes of powering AI features and service improvement; the substantive content of your typed text is not transmitted to Tappa servers except as strictly required by AI-powered features you elect to enable.

e-ii) Illinois Biometric Information Privacy Act (BIPA). If you are an Illinois resident, to the extent that keystroke dynamics or typing patterns collected through the Tappa Keyboard constitute 'biometric identifiers' or 'biometric information' under the Illinois Biometric Information Privacy Act (740 ILCS 14/), Tappa will: (i) obtain your written consent before collecting such data; (ii) not sell, lease, trade, or otherwise profit from your biometric data; (iii) store, transmit, and protect biometric data using the reasonable standard of care applicable within the industry and at least as protective as Tappa's treatment of other confidential data; and (iv) retain biometric data only as long as the initial purpose for collection remains relevant and in no case longer than three years after your last interaction with our Services, unless a longer period is required by law.  Direct questions about biometric data handling to dpo@keyboardtechnology.com.

f) Shopping and Transaction Data: When you interact with cashback offers through the Tappa Keyboard, we collect offer interaction data (offers viewed and clicked), purchase confirmation information received from merchants and affiliate networks (including transaction amount, product category, and cashback earned), and your Cashback Program account balance and payment history. (contract performance / legitimate interest)

g) Location Data: With your consent, we may collect approximate (city/region-level) location data derived from your IP address or device settings, used to display relevant geo-targeted cashback offers. We do not collect precise GPS location. You may withdraw consent at any time through your device settings. (consent)

h) Tax Identification Information: If you earn $600 or more in cashback or incentive payments not attributable to qualifying purchases in a single calendar year, we may collect your legal name, mailing address, and taxpayer identification number (TIN / SSN / EIN) as required for IRS Form 1099-MISC reporting under 26 U.S.C. § 6041.  This information is used solely for tax compliance purposes and is not used for marketing or shared with third parties except as required by law.

i) Analytics and Product Usage Telemetry: To operate, maintain, and improve the Tappa Keyboard, we collect pseudonymous telemetry through our product analytics infrastructure (currently Datadog). This includes: (1) pseudonymous installation and device identifiers (an app‑generated user identifier, app and operating‑system version, UI appearance, A/B test variant, default keyboard, the list of installed keyboards and your default browser captured at first launch, and the total number of keyboards installed); (2) keyboard session context (session counter, locale and keyboard language, theme, enabled/disabled feature flags, keyboard size, screen orientation, and the package name of the third‑party application in which you are typing, such as a messaging or email app); (3) input‑field type metadata (e.g. text, password, email, URL, supported media MIME types) — the typed content itself is not collected through this channel; (4) mobile carrier name and network connectivity type (e.g. Wi‑Fi, 4G, 5G); (5) aggregate per‑session typing‑activity counters (character, word, swiped‑word, suggestion, autocorrect, prediction, backspace, emoji, sticker, GIF, wallpaper, send, search and clear‑text counts, and session duration), as well as speech‑to‑text recording duration and character count; (6) UI navigation and interaction events (screen views, button taps, orientation changes, language changes, and switches between the Tappa Keyboard and other keyboards); (7) AI‑feature usage telemetry for FixWithAI and TappaText (session identifiers, character counts, OpenAI token usage counters, and error/rate‑limit events); (8) embedded browser (“Web View”) usage events, including search queries entered, search‑results URLs and URLs of pages you view in the in‑app browser; and (9) in‑app advertising/promotional placement events (ad network identifier, placement type and interaction events). This telemetry is processed on the basis of our legitimate interest in operating, securing and improving the Service; in the EU/EEA and the UK, non‑essential analytics are activated only after you have opted in through our in‑app consent interface in line with ePrivacy requirements. (legitimate interest / consent in the EU/EEA & UK)

i‑i) Optional encrypted‑text payload: Where you have enabled the optional “advanced product improvement” feature and provided your explicit, separate consent, our analytics may additionally include an encrypted or otherwise opaque representation of typed text. This payload is used solely to improve our language models, suggestions and autocorrect, is not used to identify you, and is not used for advertising. You may withdraw this consent at any time through your in‑app privacy settings; withdrawal does not affect the lawfulness of processing carried out before withdrawal. (consent)

How We Use Your Data

a) Device Identifiers: Tappa Keyboards collect this information to optimize our current Services and to help with troubleshooting. (legitimate interest) Device identifiers can also be used for media attribution. (legitimate interest)

b) Usage Data: Tappa Keyboards collect this information to power our Services and to inform our business operations. (legitimate interest)

c) Contact List: This feature is performed within the device itself and Tappa or our staff do not have access to this information. (consent)

d) Suggestions: We may suggest certain links that you may choose to access (consent through course of action). Clicking on the links is your own choice and you will be taken to sites not controlled by Us.

e) Push Notifications: We may send you push notifications related to upgrades to the Tappa Keyboards, to communicate with you or to notify you about service-related issues (legitimate interest). Push notifications can be turned off at any time from your phone's menu.

f) Browser data: When using our "Web View" functionality we will be collecting information about your IP address and search terms used. We will be processing the data in order to provide you with the "Web View" functionality and allow you to use Yahoo! Search Engine (consent through course of action).

g) Typed content: In order to provide you with the "Tappa Text" functionality we need to direct your typed content to OpenAI and to return the generated content to the user (consent through course of action).

h) Typed content: We may use your typing data to improve our apps, create personalized marketing experiences, and share this information with independent third parties (consent or opt-out for EU users only).

i) Cashback Program: We use Shopping and Transaction Data to operate the Tappa Cashback Program, including displaying relevant offers, tracking qualifying purchases, calculating and paying Cashback, and communicating with you about your Cashback balance and payments. (contract performance)

j) Personalized Offers: We may use device identifiers, usage data, shopping data, and approximate location to personalize cashback offers displayed in the Tappa Keyboard based on your interests, shopping behavior, and location. (legitimate interest, or consent for EU/EEA users)

k) Tax Compliance: We use Tax Identification Information and cashback payment records to fulfil federal and state tax reporting obligations, including preparation and filing of IRS Form 1099-MISC or other applicable information returns for users who receive reportable payments.  We may also perform backup withholding as required by 26 U.S.C. § 3406 if you fail to provide a valid taxpayer identification number.

l) Analytics and Service Improvement: We use the analytics and product‑telemetry data described in section (i) above to operate, secure, maintain, troubleshoot and improve the Tappa Keyboard and its features, to measure feature adoption and user experience, to detect and prevent fraud, abuse and misuse, to attribute installs and marketing activity, and — where you have consented to it — to improve our language models, suggestions and autocorrect. We do not use this analytics data to make decisions producing legal or similarly significant effects about you. (legitimate interest; consent for the optional encrypted‑text payload and for non‑essential analytics in the EU/EEA & UK)

Tappa does not use algorithms or profiling to make any decision that would significantly affect you.

Whenever we are relying on consent to process your data you can modify your decision anytime by accessing the [...] section in our keyboard.

How We Disclose Personal Data

We may disclose personal data to third parties in the following circumstances:

a) Our entities within the Tappa group of companies.

b) Tappa Keyboards Affiliated Entities: To provide our Services and for our marketing attribution purposes. Media attribution is the practice of establishing which media channels are the most efficient with regard to advertising engagement.

c) Service Providers: We share Personal Data with some of our service providers such as Google Firebase and OpenAI subject to contract terms that limit their use of Personal Data. We also use Datadog as our product‑analytics log ingestion and storage provider, under a data processing agreement that restricts use of the data to the purposes set out in this policy.

d) Corporate Transactions: In the event that we enter into, or intend to enter into, a transaction that alters the structure of our business, such as reorganization, merger, sale, joint venture, assignment, transfer, change of control, or other disposition of all or any portion of our business, assets, or stock, we may share Personal Data with third parties in connection with such transaction.

e) Compliance & Harm Prevention: We share Personal Data as we believe necessary: (i) to comply with applicable laws such as GDPR, CCPA, and others; (ii) to enforce our contractual rights; (iii) to protect the Services, rights, privacy, safety, and property of Tappa Keyboards, you, or others; and (iv) to respond to a request from courts, law enforcement agencies, regulatory agencies, and other public and government authorities.

f) Independent third parties: Based on your consent (if you are in the EU or UK) we may disclose your data to independent third parties: 2024 Keyboard, 3D Keyboard, AI GPT Keyboard, and other keyboard applications within the Tappa ecosystem. We recommend that you read their Privacy Notice before giving your consent.

g) Affiliate Networks and Brand Partners: In connection with the Tappa Cashback Program, we share limited data (such as click identifiers, device identifiers, and purchase confirmation data) with our affiliate network partners and brand partners to track and attribute qualifying purchases. These partners act as independent data controllers for the data they receive and process in connection with their own platforms, networks, and attribution services. Tappa is not responsible for the data practices of these independent controllers and recommends that you review their respective privacy notices before completing any cashback-eligible purchase

Transfer of Your Information

We from Tappa will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy and no transfer of your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of your data and other personal information.

In accordance with the GDPR, when we transfer your personal data out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring that we use specific controls approved by the European Commission which give personal data the same protection it has in Europe. Specifically, for transfers to the United States and other third countries, we rely on: (a) the Standard Contractual Clauses (SCCs) approved by the European Commission under Implementing Decision (EU) 2021/914 of 4 June 2021 — Module 2 (controller to processor) and/or Module 1 (controller to controller) as applicable; and/or (b) the EU-U.S. Data Privacy Framework (DPF), to the extent Tappa is certified or our processors are certified thereunder. Where we rely on SCCs, we also carry out a Transfer Impact Assessment (TIA) to assess whether the laws of the destination country provide an essentially equivalent level of protection. Copies of our applicable SCCs are available on request at dpo@keyboardtechnology.com. Note: The EU-U.S. Data Privacy Framework is subject to periodic adequacy review. Should it be invalidated, we will rely on SCCs as our primary transfer mechanism.

How We Protect Your Information

To ensure that your personal information is secure, we communicate our privacy and security guidelines to all Tappa employees and business partners and strictly follow precautionary measures regarding privacy within the company.

We strive to protect your personal information through physical, technical, and organizational measures aimed at reducing the risks of loss, misuse, unauthorized access, disclosure, and improper alteration of this data. In the event of a data breach affecting your personal information, Tappa will notify affected residents as required by applicable U.S. state breach notification laws. All 50 states, the District of Columbia, Puerto Rico, and Guam have enacted breach notification statutes. Notification timelines vary by state (e.g., 30 days in Florida, 'expedient time' in California with a 72-hour maximum for CCPA-covered breaches affecting 500+ California residents, 30 days in Texas). Notifications will be provided by email to your registered address, and for large-scale breaches affecting 500+ residents of a state, we will also notify the applicable state attorney general, as required.

How Long We Retain Your Information

We have determined retention periods based on the purpose of the processing and the rules set forth within the GDPR as well as the legal and business requirements. For example, the GDPR requires us to remove data when it has served its purpose and is no longer of use. We review the personal data we collect regularly to ensure that the personal data we have is up-to-date and is not retained longer than needed or required by the regulation.

If you wish to have more detailed information about our retention times, please contact us at dpo@keyboardtechnology.com. As a guide, the following indicative retention periods apply: Account and registration data — retained for the duration of your account plus 30 days following closure; Device identifiers and usage data — 12 months on a rolling basis; Shopping and transaction data — 3 years from the date of transaction (required for tax and dispute resolution purposes); Location data — 30 days; Typed content processed for AI features — not retained beyond the immediate processing session; Payment and tax records — 7 years from the date of payment, in compliance with tax retention obligations. These periods are subject to extension where required by applicable law or where data is necessary for the establishment, exercise, or defence of legal claims.

Opt Out of Sale of Personal Information or Sharing or Processing of Personal Information for Targeted Advertising

(U.S. State Privacy Rights — Opt-Out and Consumer Rights).

If you live in California, Colorado, Connecticut, Utah, or Virginia, you have the right to opt-out of certain processing of your personal information, including selling of your data and targeted advertising, as per the applicable law.

Nevada Residents

If you are a Nevada consumer using our Keyboards, you have the option to opt out of the sale of your "covered information" as per Nevada law. We don't engage in such practices, but if you have any queries regarding this, please feel free to email us at dpo@keyboardtechnology.com.

California Privacy Rights

TThis section applies only to California residents. The California Consumer Privacy Act (CCPA) is a data protection law that ensures you have certain rights regarding the Personal Information we collect or maintain about you. As amended by the California Privacy Rights Act (CPRA, effective January 1, 2023), the CCPA was significantly expanded. References to "CCPA" in this section include all CPRA amendments unless otherwise specified. Tappa Keyboard Technology Inc. is a "business" within the meaning of the CCPA/CPRA. In the preceding 12 months, we have collected personal information in the categories described in the 'Which Information We Collect About You' section above.

Right of Access: you have the right to request that we disclose what Personal Information we have collected, used, and disclosed about you in the past 12 months.

Right of Deletion: you have the right to request that we delete Personal Information collected or maintained by us, subject to certain exceptions.

Right to Non-Discrimination: You have the right to not be discriminated against by us because you exercised any of your rights under the CCPA.

Right to Correct (CPRA). You have the right to request that we correct inaccurate personal information that we maintain about you. Upon receiving a verifiable consumer request, we will use commercially reasonable efforts to correct the inaccurate information, taking into account the nature of the information and the purposes of processing.

Right to Limit Use and Disclosure of Sensitive Personal Information (CPRA). California residents have the right to direct Tappa to limit the use and disclosure of their Sensitive Personal Information ("SPI") to uses necessary to perform the services or provide the goods reasonably expected by an average consumer. Under CPRA, SPI includes: social security numbers, driver's license/state ID/passport numbers, financial account credentials, precise geolocation data, racial or ethnic origin, religious or philosophical beliefs, union membership, contents of personal mail/email/text messages (unless Tappa is the intended recipient), genetic data, biometric information processed for the purpose of uniquely identifying a consumer, and health information. Of the data we collect, location data (if precise) and contents of messages processed via Tappa Text may qualify as SPI. We use SPI only to the extent necessary to provide the Services. To exercise your right to limit SPI, email privacy@keyboardtechnology.com.

Right to Opt Out of Automated Decision-Making Technology (CPRA Regulations). California residents have the right to opt out of Tappa's use of automated decision-making technology, including profiling, to evaluate, characterize, or influence decisions about you in contexts that produce legal or similarly significant effects. Tappa does not currently use automated decision-making to produce legal or similarly significant effects about individual users. If this changes, we will update this policy and provide a clear opt-out mechanism before any such processing begins.

Right to Opt Out of Sale and Sharing (CCPA/CPRA). Tappa does not sell your personal information for monetary consideration. However, under CPRA, sharing personal information with third parties for cross-context behavioral advertising constitutes 'sharing' subject to opt-out rights, even without monetary exchange. To the extent our affiliate network partners or advertising partners receive personal information in a manner that constitutes 'sharing' under CPRA, you have the right to opt out. To opt out, click 'Do Not Sell or Share My Personal Information' in the app privacy settings or email privacy@keyboardtechnology.com. Tappa also honors the Global Privacy Control (GPC) signal. If your browser or device transmits a GPC signal, we will treat it as a valid opt-out request from sale/sharing for that browser or device, in accordance with California regulations.

Authorized Agent Requests. You may designate an authorized agent to submit CCPA/CPRA requests on your behalf. To use an authorized agent, you must provide the agent with written permission to act on your behalf, and we may require you to verify your own identity directly with us. We may deny a request from an agent who does not provide proof of authorization. Submit authorized agent requests to privacy@keyboardtechnology.com with the subject line 'Authorized Agent Request — CCPA'.

Response Timelines (California). We will acknowledge receipt of your request within 10 business days. We will respond to a verifiable consumer request within 45 days of receipt. If we require more time (up to an additional 45 days), we will inform you of the reason and the extension period in writing before the end of the initial 45-day period. We do not charge a fee for processing your request unless it is excessive, repetitive, or manifestly unfounded, in which case we will explain the basis for the fee before processing.

Shine the Light (California Civil Code § 1798.83). California residents who have provided personal information to Tappa may request and obtain from us, once per calendar year, information about the categories of personal information (if any) we disclosed to third parties for their own direct marketing purposes during the immediately preceding calendar year, and the names and addresses of those third parties. To submit a Shine the Light request, email privacy@keyboardtechnology.com with the subject line 'Shine the Light Request'.

Additional U.S. State Privacy Rights

The following rights apply to residents of U.S. states with comprehensive privacy laws, in addition to (or overlapping with) the California rights described above. Where a right listed below overlaps with a California right, California residents may rely on either or both frameworks. Rights are subject to applicable exceptions and limitations under each state's law.

Right to Know / Access. Residents of Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Delaware, New Hampshire, Nebraska, New Jersey, Minnesota, Maryland, Tennessee, Iowa, and Indiana have the right to confirm whether Tappa processes personal data concerning them and to access that personal data. We will respond within 45 days (with a possible 45-day extension for complex requests), or within the timeframe specified by applicable state law.

Right to Delete. Residents of the states listed above have the right to delete personal data provided to or obtained by Tappa, subject to exceptions including: data necessary to complete a transaction, detect fraud, comply with legal obligations, exercise free speech rights, or carry out a contract. Where state law provides narrower exceptions than California, the more protective standard will apply to residents of that state.

Right to Data Portability. Residents of Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Delaware, New Hampshire, Nebraska, New Jersey, Minnesota, Maryland, and Tennessee have the right to obtain a copy of their personal data in a portable and, to the extent technically feasible, readily usable format that allows the resident to transmit the data to another controller. Portability requests can be submitted to privacy@keyboardtechnology.com.

Right to Correct. Residents of Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Delaware, New Hampshire, Nebraska, New Jersey, Minnesota, Maryland, Tennessee, and Indiana have the right to correct inaccurate personal data maintained by Tappa, taking into account the nature of the data and the purposes of processing.

Right to Opt Out of Targeted Advertising, Sale, and Profiling. Residents of all states listed in this section have the right to opt out of: (a) the processing of personal data for purposes of targeted advertising; (b) the sale of personal data; and (c) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the resident (applicable in CO, CT, VA, TX, OR, MT, DE, NH, NE, NJ, MN, MD, TN, IN). To opt out of any or all of the above, visit your in-app privacy settings or email privacy@keyboardtechnology.com with the subject line 'State Privacy Opt-Out'. Tappa will process opt-out requests within 15 business days (or the period required by applicable state law). We honor the Global Privacy Control (GPC) browser signal as a valid opt-out request for targeted advertising and sale across all states that require it.

Sensitive Data. Several state laws (CO, CT, VA, TX, OR, MT, DE, NH, NE, NJ, MN, MD, TN, IN) define categories of 'sensitive data' for which processing requires consent or other heightened protections. Sensitive data categories across these laws typically include: precise geolocation data; racial or ethnic origin; religious beliefs; mental or physical health diagnoses; sexual orientation or gender identity; citizenship or immigration status; genetic or biometric data; and personal data of known minors. Of the data collected by Tappa, approximate location data (if used in a way that reveals location within a radius of 1,750 feet or less) and biometric data (if ever processed) would be treated as sensitive. We obtain consent before processing sensitive data where required by state law and do not process sensitive data for targeted advertising.

Right to Appeal. Residents of Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Delaware, New Hampshire, Nebraska, New Jersey, Minnesota, Maryland, Tennessee, and Indiana have the right to appeal a refusal to take action on a privacy rights request. If we decline to act on your request, we will inform you of our reasons within the timeframe required by applicable state law. To appeal a refusal, email privacy@keyboardtechnology.com with the subject line 'Privacy Rights Appeal — [Your State]' within 30 days of receiving our decision. We will respond to your appeal within 60 days (or the period required by your state's law). If your appeal is denied, we will provide information about how to contact your state's attorney general or relevant enforcement authority to submit a complaint.

Data Protection Assessments. Under the laws of Colorado, Connecticut, Virginia, Texas, Oregon, Delaware, New Hampshire, New Jersey, Minnesota, and Maryland, Tappa is required to conduct and document data protection assessments for processing activities that present a heightened risk of harm to consumers — including targeted advertising, sale of personal data, processing of sensitive data, and certain profiling activities. Tappa maintains such assessments internally and will make them available to applicable regulators upon lawful request.

Exercising Your State Privacy Rights. To submit any privacy rights request — regardless of your state of residence — email privacy@keyboardtechnology.com with your full name, state of residence, and a description of the right you wish to exercise. We will verify your identity using reasonable security measures before processing your request. We will not discriminate against you for exercising your privacy rights. We aim to respond within 45 days for all states, with extensions as permitted by applicable law. For Iowa residents: Iowa law does not currently provide rights to correct, opt out of profiling, or appeal — but we extend those rights to Iowa residents voluntarily.

Your Rights Under the GDPR

Under the law, you are granted six fundamental rights when data about you is being processed. We will ensure to reach out without undue delay (no more than 30 days) when you submit a request related to exercising your data subject rights.

As a data subject, you have the right to: (a) request confirmation of whether Tappa Keyboards process Personal Data relating to you; (b) request that Tappa Keyboards rectifies or updates your Personal Data; (c) request that Tappa Keyboards erase your Personal Data in certain circumstances; (d) request that Tappa Keyboards restrict the use of your Personal Data; (e) request that we export your Personal Data to another company, where technically feasible; and (f) where processing is based on consent, withdraw that consent at any time. Additionally: (f) under Article 21 GDPR, you have the right to object at any time, on grounds relating to your particular situation, to processing of your Personal Data based on our legitimate interests (Art. 6(1)(f) GDPR). Where you object, we shall no longer process your Personal Data unless we can demonstrate compelling legitimate grounds which override your interests, rights, and freedoms, or for the establishment, exercise, or defence of legal claims. Where your Personal Data is processed for direct marketing purposes, you have the right to object at any time; and (g) under Article 22 GDPR, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. As noted above, Tappa does not currently make solely automated decisions with significant effects, but if this changes you will be notified and given the right to obtain human intervention, express your point of view, and contest the decision.

To exercise your data protection rights please contact our DPO at dpo@keyboardtechnology.com.

Right to Lodge a Complaint (Art. 77 GDPR). Without prejudice to any other administrative or judicial remedy, if you are in the EU/EEA you have the right to lodge a complaint with a supervisory authority — in particular, the supervisory authority of the EU Member State of your habitual residence, place of work, or place of the alleged infringement — if you consider that the processing of your Personal Data infringes the GDPR. Our lead supervisory authority is the Irish Data Protection Commission (DPC), given that our EU representative, Tappa Ops (Ireland) Limited, is established in Ireland. Contact details for EU supervisory authorities are available at https://edpb.europa.eu/about-edpb/board/members_en.

Tappa Intent Marketing

Under certain circumstances, such as when you visit our partners' websites, you may witness advertisements coming from us or from our demand partners.

TappaText

This functionality allows users to use Tappa Keyboards to generate content by facilitating the use of OpenAI's ChatGPT. You have control over the text you type when using the Tappa Text function. The text you type will be shared with OpenAI and processed according to OpenAI's Terms of Use and Privacy Policy.

Tappa Web View

This functionality allows users to use the embedded web browser and search engine directly from Tappa Keyboards. Make sure that you carefully read Yahoo's Terms of Service and Privacy Policy.

Tappa Cashback

The Tappa Cashback feature allows eligible registered Users to earn cash back on qualifying purchases made through affiliate links and brand partnership offers surfaced within the Tappa Keyboard interface. To use the Tappa Cashback feature, you must have an active Tappa account, be at least 18 years of age, and provide a valid payment method.

When you click on a cashback offer in the Tappa Keyboard, you will be directed to the applicable merchant or brand partner's website or application. Tappa receives a commission from the merchant or affiliate network when you complete a qualifying purchase, and shares a portion of that commission with you as Cashback. Cashback rates, eligibility criteria, and excluded product categories are determined by each merchant or brand partner and are subject to change. You are encouraged to review the offer terms displayed in the Tappa Keyboard before completing a purchase.

For full details on how Cashback is earned, confirmed, paid, and how it may be forfeited, please refer to the Tappa Cashback Program section in our Terms of Service, available at www.tappa.com/terms-of-service.

EU Digital Services Act — Recommender System Transparency. For users in the European Union or European Economic Area, the presentation of cashback offers through the Tappa Keyboard may be subject to Regulation (EU) 2022/2065 on a Single Market for Digital Services ('Digital Services Act' / 'DSA').  To the extent Tappa uses algorithmic systems to select, rank, or recommend cashback offers, the principal parameters used by those systems are: (a) merchant category relevance to prior browsing or shopping activity; (b) geographic availability of the offer; (c) cashback rate relative to transaction value; (d) brand partner campaign priority; and (e) your prior cashback redemption history.  You have the right under the DSA to request that offers be presented without personalized recommendation criteria.  To exercise this right, contact support@keyboardtechnology.com or adjust your personalization preferences in the keyboard app settings.

Cookie and Tracking Technology Consent (ePrivacy)

Tappa and its partners use cookies and similar tracking technologies (pixels, SDKs, device fingerprinting) in connection with the Tappa Keyboard app and the Tappa website (www.tappa.com). In the EU/EEA, our use of non-essential cookies and tracking technologies is subject to the ePrivacy Directive (2002/58/EC) and applicable national implementing law, as well as the GDPR consent requirements. Specifically: (a) Essential cookies/SDKs — strictly necessary for the operation of the keyboard and the website. These do not require consent. (b) Analytics and performance — used to understand how the keyboard and website are used. In the EU/EEA, these require your consent and are activated only after you have opted in via our in-app consent interface. (c) Affiliate and attribution tracking — cookies and pixels used to attribute cashback-eligible purchases to the Tappa Keyboard. In the EU/EEA, these require your consent. You can withdraw consent for non-essential cookies at any time through your in-app privacy settings or, for the website, through your browser settings. On iOS, we comply with Apple's App Tracking Transparency (ATT) framework and will request your permission before accessing your device's advertising identifier (IDFA) for cross-app tracking. Please review our Cookie Policy for more details.

Modifications to This Privacy Policy

Tappa reserves the right to change this Privacy Policy at any time by posting revisions on this web page. Such changes will be effective upon posting and the current version published on our website shall apply.

Please revisit this page to stay aware of any changes. If the Privacy Policy is part of an agreement with you, we will notify you by e-mail or other appropriate means in case of an amendment.are of any changes. If the Privacy Policy is part of an agreement with you, we will notify you by e-mail or other appropriate means in case of an amendment.