Privacy Policy

Last updated September 30, 2026

1. Who we are and what TapCoin Pay is

TapCoin Pay ("TapCoin Pay", "we", "us") is operated by Atlas Pro Consulting LLC, based in Tampa Bay, Florida, United States. TapCoin Pay is payment orchestration and monitoring software: it generates checkout pages, payment links, invoices and QR codes, watches public blockchains for the matching payment, and tells you when it has confirmed.

TapCoin Pay is non-custodial. Your customers pay your wallet directly on-chain. We never hold, route, convert or transmit funds, and we never have access to a private key. TapCoin Pay is not a bank, exchange, wallet, payment processor or money transmitter. This policy describes the personal information we handle to provide that software.

2. What we collect

Account information

• Email address and name when you sign up, sign in, or ask for a password reset.
• Business details you give us: business name, website, country, timezone, brand colour and logo.
• Billing details for paid plans. Card numbers go directly to Stripe; we store only the Stripe customer and subscription identifiers, plan, and invoice history.
• Security data: session tokens, two-factor authentication secrets (encrypted), sign-in timestamps and the IP address and browser of each sign-in, used to protect your account.

Wallet addresses

You give us the public receiving addresses you want to be paid at, and optionally prove you control them with a signed message or a test payment. Public addresses are not secrets and are visible on the blockchain by design. We never receive, request or store a private key, seed phrase or recovery phrase, and we will never ask you for one.

Checkout and payment metadata

For each checkout, link, invoice or point-of-sale sale we store what is needed to create it and confirm it: the amount and currency, the asset (for example XRP, BTC, ETH or USDC), the destination address and tag, the line items or description you entered, the status, and the on-chain transaction id once the payment is seen. If you or your customer enter an email address for a receipt, or a name and shipping details for a product order, we store those so the receipt and order can be delivered.

Blockchain transactions are public. Anyone can see the sending address, receiving address, amount and time of a payment on the ledger itself. TapCoin Pay does not put anything on-chain that is not already required by the payment (a destination tag or a memo that identifies the checkout).

TapCoin Assets

If you use TapCoin Assets, we store the document you upload, its cryptographic hash, the token metadata, the issuer wallet address and the record of units sold and delivered. The hash, the token and its metadata are written to the XRP Ledger and are public and permanent. The document itself stays in our storage and is shown only to the people you share it with.

AgentPay

For machine payments we log the agent identifier, the endpoint called, the price, the payment transaction id and the result, so that sellers can see what was bought and agents can see what they spent.

Analytics and technical data

On our marketing site and dashboard we collect coarse usage data: pages viewed, buttons clicked, and product funnel events such as "signed up", "wallet added" or "checkout created" with only a coarse parameter (asset code or plan name). We never send emails, wallet addresses, payment amounts, document contents or free text to any analytics provider. Our servers also keep short-lived request logs (IP address, user agent, path, status) for security and debugging.

3. How we use it

• To run the service: create checkouts, watch the chain, confirm payments, send receipts and webhooks, and show you your history.
• To bill paid plans and the monthly fee invoice through Stripe.
• To keep accounts secure: sessions, two-factor authentication, sign-in alerts, abuse and fraud prevention.
• To support you when you write to us.
• To understand how the product is used and improve it, using aggregated and coarse analytics.
• To meet legal obligations, respond to lawful requests and enforce our Terms.

We do not use your data to build advertising profiles, and we do not train machine learning models on your account data, documents or customer information.

4. Who we share it with

We do not sell personal information, and we do not share it with third parties for their own marketing. We share data only with the service providers (subprocessors) that run the product, each bound by their own terms and privacy commitments:

We may also disclose information when the law requires it, to protect the rights and safety of TapCoin Pay, our users or the public, or as part of a merger, acquisition or sale of the business, in which case this policy continues to apply to the transferred data.

Your customers' payments are between them and you. What a customer's wallet provider, exchange or blockchain does with their data is governed by that provider's policy, not ours.

5. Cookies and analytics

We use a small number of first-party cookies and browser storage entries:

• A session cookie that keeps you signed in to the dashboard. Strictly necessary; it expires when the session does.
• A Turnstile token from Cloudflare that tells our sign-up and sign-in forms you are not a bot.
• Local preferences such as the last dashboard tab you opened.

Analytics cookies from Google Analytics and Meta are set only when analytics is enabled for the site and only if your browser has not asked us not to. We honour the Global Privacy Control signal and the Do Not Track header: if either is on, no analytics or advertising script loads at all. You can also opt out on any device by opening your browser console on this site and running tapcoinAnalyticsOptOut(), or by blocking the providers with your browser's settings or an extension. Opting out does not affect the product in any way.

Google Analytics runs with IP anonymisation and with advertising features, Google Signals and ad personalisation switched off. Cloudflare Web Analytics, when enabled, uses no cookies and no fingerprinting.

6. Retention

• Account data is kept while your account exists. When you delete your account we delete or anonymise it within 30 days, except where we must keep records for legal, tax or accounting reasons.
• Payment and invoice records are kept for seven years to meet accounting and tax obligations, then deleted.
• Checkout metadata for expired, unpaid checkouts is deleted after 90 days.
• Server request logs are kept for up to 30 days.
• Analytics data is retained by the provider under its own retention setting; we set Google Analytics to the shortest available period (currently 2 months).
• Blockchain records, including TapCoin Assets tokens and hashes, are public and permanent by the nature of the ledger and cannot be deleted by us or anyone else.

7. Your rights

Wherever you live, you can ask us to:

• Access the personal information we hold about you and receive a copy in a portable format.
• Correct anything that is wrong. Most account details can be edited from Settings.
• Delete your account and data, subject to the retention rules above.
• Object to or restrict processing, including analytics, at any time.
• Withdraw consent where processing is based on it, without affecting what was done before.

Residents of the European Economic Area, the United Kingdom and Switzerland have these rights under the GDPR and UK GDPR, and may complain to their local supervisory authority. Residents of California and other US states with privacy laws have equivalent rights, including the right not to be discriminated against for exercising them; we do not sell or share personal information as those laws define it. To exercise any right, email privacy@tapcoinpay.com from the address on your account. We respond within 30 days.

If you are a customer of a TapCoin Pay merchant and want to exercise rights over data that merchant collected through a checkout, contact the merchant first; we will help them respond.

8. Security

All traffic is encrypted in transit with TLS. Data is encrypted at rest by our hosting provider. Passwords are hashed with a modern, salted algorithm and two-factor secrets are encrypted. API keys are shown once and stored hashed. Webhooks are signed so you can verify they came from us. Access to production systems is limited to the people who operate the service and protected with multi-factor authentication. No system is perfectly secure; if we learn of a breach affecting your data we will tell you without undue delay and in any case within the time the law requires.

Because TapCoin Pay never holds funds or keys, a compromise of our systems cannot move your money. It could expose the metadata described in this policy, which is why we keep that to the minimum.

9. Children

TapCoin Pay is for businesses and adults. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, email us and we will remove it.

10. International transfers

We are based in the United States and our providers operate globally. Where data leaves the EEA, UK or Switzerland it is protected by standard contractual clauses or an equivalent lawful mechanism offered by the provider.

11. Changes to this policy

When we change this policy we update the date at the top. For changes that matter, we email account holders or show a notice in the dashboard before they take effect. Continued use after the effective date means you accept the updated policy.

12. Contact

Privacy questions and requests: privacy@tapcoinpay.com
Legal notices: legal@tapcoinpay.com
Atlas Pro Consulting LLC, Tampa Bay, Florida, United States.

This policy is governed by the laws of the State of Florida, United States, without regard to its conflict of law rules, except where the law of your place of residence gives you rights that cannot be waived.