This Privacy Policy explains what we collect about you when you use TapTime, how we use it, who we share it with, and what choices you have. If something here is unclear, email us at privacy@taptime.ai.
1. What we collect
When you create an account, we collect:
- Identity: email address, password (stored hashed), first name, last name. Optionally a display name, a localized (e.g. Arabic) name, a phone number, and date of birth. Date of birth is only used to enforce the minimum age of 13 and the 18+ requirement for AI summaries.
- Preferences: language (en / ar), timezone, whether AI summaries are enabled, notification preferences.
- Profile (experts only): professional background, expertise categories, hourly rate, availability windows, avatar image, expert verification documents.
- Account security: IP address and user-agent for login attempts, email verification state, password reset activity. We use these only for fraud prevention and account recovery.
- Sign-in provider identifiers: if you choose to sign in with Google, Microsoft, or LinkedIn, we receive your provider-side user ID and profile basics (name, email, avatar). We do not store passwords from these providers.
When you use the platform, we collect:
- Booking data: which expert, which service, when, duration, price, and any notes you entered at booking time.
- Session content: locally recorded audio, the resulting transcript, and the AI-generated summary. This is covered in detail in Section 5.
- Messages: messages you send to experts or to TapTime support.
- Payment data: your payment is processed by Stripe. Stripe holds full card details; we retain only the last four digits, brand, expiry, and Stripe's internal identifiers needed to charge, refund, and reconcile.
- Engagement data: session history, reviews you write, favorites you save, feedback you submit.
We do not currently run any analytics or marketing cookies. See our Cookie Policy.
2. How we use it
- To create and secure your account.
- To run sessions you have booked, including video, payment, reminders, and the AI summary described in Section 5.
- To send transactional emails (verification, password reset, booking confirmations, session summaries).
- To prevent abuse and investigate reports of policy violations.
- To comply with our legal and tax obligations.
- To improve the product, in aggregated or anonymized form.
We do not sell your personal information to anyone, and we do not use your session content to train AI models.
3. Who we share it with
We share data only with the sub-processors below, and only to the extent each one needs to do its job.
- Oracle Cloud Infrastructure (OCI) - hosts our application, our database, and our temporary audio chunk storage. Primary region: UAE (Dubai).
- Stripe, Inc. - processes payments, refunds, and expert payouts. Based in the United States.
- OpenAI, L.L.C. - runs the Whisper transcription and GPT-4o summary steps for AI session summaries (Section 5). Under OpenAI's standard API terms, inputs sent via the API are not used to train their models. Based in the United States.
- Twilio SendGrid - delivers every transactional email we send: account verification, password reset, booking confirmations, and session summaries. Based in the United States.
- Google, Microsoft, LinkedIn - only if you choose to sign in with one of these providers. They receive only what is required for the OAuth handshake; we receive back the basic profile fields listed in Section 1.
Each sub-processor operates under its own terms and privacy policy. We do not share session content with any other third party.
We may also disclose information if we are legally required to (for example, a valid court order) or to protect TapTime, our users, or the public from fraud, safety risks, or legal liability.
4. Where your data is stored
Your account, booking, and messaging data lives in our primary database in the UAE (Dubai), hosted on Oracle Cloud Infrastructure. Some sub-processors are based outside the UAE:
- Stripe: United States.
- OpenAI: United States.
- Twilio SendGrid: United States.
- Google / Microsoft / LinkedIn (OAuth): United States / global.
By using TapTime, you understand that the data described in Section 1 may be transferred to and processed in these countries. We rely on the sub-processors' own contractual safeguards (including Standard Contractual Clauses where applicable) to protect cross-border transfers.
5. AI session summaries
5.1 What happens
Your device records the audio of the call locally. After the session ends, chunks of that audio are uploaded to OCI, transcribed by OpenAI Whisper, summarized by OpenAI GPT-4o, and the resulting summary is sent by SendGrid to you and your expert. The feature is governed by Section 6 of our Terms of Service.
5.2 Retention and deletion
- Audio chunks are deleted from OCI immediately after transcription.
- Full transcript and AI-generated summary are retained only long enough to email the summary, then automatically purged from our database within 24 hours.
- High-level record (session title, topic tags, action items list) is kept in your session history so you can refer back. You can delete this at any time.
- Voice audio is never sent to OpenAI for voice-print, biometric, or training purposes. Whisper is used only for speech-to-text.
5.3 Opting out
You can disable AI summaries at any time under Account Settings -> Preferences -> AI Summary. When disabled, we will not transcribe your audio, generate a summary, or email one. Changes apply to future sessions only.
5.4 Users under 18
AI summaries are not available for users under 18. If our records indicate you are under 18, your audio will not be transcribed and no summary will be generated, regardless of the opt-in setting.
6. How long we keep your data
- Account data (identity, preferences, profile) is kept for as long as your account is active. If you delete your account, it is permanently removed within 30 days, except where we must retain parts for legal reasons (for example, tax records retained for 5 years).
- Booking, payment, and payout records are kept for 5 years after the booking date to comply with UAE tax and financial-record requirements, then deleted.
- Messages are kept for 2 years or until you delete your account, whichever is sooner.
- Transcripts and AI summaries: as described in Section 5.2.
- Audit and security logs (IP addresses, login timestamps) are kept for 12 months.
7. Security
We use industry-standard measures to protect your data: TLS encryption in transit, encryption at rest for our database and OCI object storage, hashed passwords, scoped internal access, and audit logging for privileged actions. No system is perfectly secure, but if we become aware of a breach that affects your personal data we will notify you without undue delay.
8. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you,
- correct inaccurate data,
- delete your account and associated data (subject to the retention exceptions in Section 6),
- export your data in a portable format,
- object to or restrict certain processing,
- withdraw consent for optional processing such as AI summaries (see Section 5.3).
Most of these can be done directly in your account settings. For anything else, email privacy@taptime.ai and we will respond within 30 days.
9. Children
TapTime is not intended for children under 13. We do not knowingly collect personal data from anyone under 13. If you believe a child has provided us personal data, contact privacy@taptime.ai and we will delete it.
10. Changes to this policy
If we materially change how we handle your personal data, we will update this page, change the "Last updated" date, and notify you by email. Small clarifications may be made without notice.
11. Contact
For privacy questions or to exercise a right above, contact privacy@taptime.ai. For anything else, contact support@taptime.ai.