Privacy Policy

TapGoCR is a trade name operated by Jin Lin, an individual in Costa Rica (it is not a company). This person is the data controller for the personal data TapGoCR receives directly: contact forms, account registrations, emails sent to us, dashboard accounts and usage statistics. TapGoCR operates digitally and does not publish an address; the ways to reach us are in the Contact section.

When a business customer publishes information about other people (its customers, employees or suppliers) on its page, that business is responsible for having a legal basis to do so, and TapGoCR acts as a technology provider for that content.

We handle personal data based on the principles of Costa Rica’s Law No. 8968 on the Protection of Persons regarding the Processing of their Personal Data and its Regulation. Data is stored in TapGoCR’s own databases: inquiries, customer accounts, businesses and usage statistics.

Contact forms and commercial requests

Name, email, phone (optional), business name (optional), type of business or goal (optional) and the message you write. If you ask for a quote, also what you indicate about the service of interest.

Registration and dashboard account

• First and last name, email and phone.
• Password (stored encrypted as a hash; never in readable text).
• Business details: trade name, industry, address, province, canton, postal code, the business ID number if you provide it, notes and optional links (WhatsApp, Instagram, Facebook, Google reviews, menu).
• Plan chosen.

Business content

What the customer decides to publish: text, logos and images, menus and prices, opening hours, location, links and business contact details.

Emails sent to us

Messages sent to our business mailboxes (sender, subject and an excerpt of the text) are logged as internal tasks so we can handle them.

Visits to business pages (NFC plates and QR)

When someone opens a business page we store technical and statistical data: date and time, whether it was a scan or a button click, the plate, device type, browser, referring page and an approximate country. We do not store the full IP address: only a truncated derived code, with an internal key, used to discard repeated reloads and not to identify a person. If the business offers that option, a visitor can leave a rating and a short comment.

Use of the commercial site

We anonymously count how many times the main buttons on the site are pressed and how many people reach the registration page, without storing IP or browser for those events.

We do not collect sensitive personal data or card numbers: payments are currently arranged by SINPE Móvil, bank transfer or cash.

In forms, the fields marked as mandatory are needed to reply to you or create your account: for an inquiry, your name and email; for registration, first and last name, email, phone, password, business name and address, and province. Everything else is optional.

If you do not provide the mandatory data we cannot handle your inquiry or create your account. If you do not provide the optional data, the service works the same, with less personalization.

• Answer inquiries, prepare quotes and handle requests.
• Create and manage accounts and provide the contracted service.
• Display business pages and give businesses their statistics.
• Invoice, collect payment and keep a record of the commercial relationship.
• Provide technical support and contact you about your account or service.
• Protect the platform: detect spam, abuse and unauthorized access.
• Improve the service and comply with legal obligations.
• Send you commercial communications, only if you authorize it (see the next section).

We do not sell personal data nor use it for purposes other than those described without your authorization or a legal obligation.

We ask for three different things, each separately:

• Terms and conditions: when registering you must accept them by ticking a mandatory checkbox.
• Privacy notice: on the contact and registration forms we show it next to the submit button and keep a record of the date and version shown.
• Commercial communications: optional, unchecked by default and not required to use the service. You can withdraw this consent at any time by writing to us.

To make TapGoCR known, we may identify businesses in Costa Rica that could benefit from the service, using public business information only (their website, public business profiles on social networks or search engines, directories and business contact details the business itself publishes). We do not use purchased lists or collect unnecessary personal data.

• The first contact is decided and sent by a team member; no automated system contacts a business on its own.
• If a business asks not to be contacted, we record it and do not write to it again.

The site only uses what it needs to work:

• Session: our own cookie that keeps you signed in to the dashboard (expires after 30 minutes of inactivity).
• Preferences: light or dark theme (a cookie and the browser’s local storage) and a setup indicator in the customer dashboard.
• Form security: the site may use Cloudflare Turnstile to verify that whoever submits a form is not a bot; that service may use its own technologies for that purpose.

Our pages include no third-party analytics or advertising tools, and no advertising cookies. You can delete or block cookies in your browser; some features, such as signing in, would stop working.

We use providers to run the service. Not all of them receive all the data: each receives only what it needs for its function, and is also governed by its own privacy terms.

• RackNation (hosting, Costa Rica): hosts the site, the database and the mail server for the @tapgocr.com mailboxes; it therefore stores what you send through the site or by email.
• Cloudflare: DNS, delivery network and protection for the site; site traffic passes through its network (including technical visit data) and, on forms, it checks that the sender is not a bot.
• Discord: the team’s internal channel for operational alerts; a new-inquiry alert may include name, business, email and an excerpt of the message.
• Telegram: the team’s internal channel for reports and alerts from the automated assistants; it may mention business names or summaries of inquiries.
• Notion: internal documentation and management, which may include tracking of some commercial inquiries.
• External artificial intelligence assistants: we use assistants based on language models from external providers for internal tasks: classifying inquiries, drafting replies and analyzing public business information. They receive the text needed for that task (for example, the content of an inquiry); we do not give them customers’ passwords or keys. They run with minimum permissions, do not contact anyone without human approval and do not make decisions with legal effects on people.
• Meta and TikTok: only when an account is connected (see the integrations section).

Some of these providers process data outside Costa Rica. We may also disclose data to authorities when a law or valid order requires it. We do not sell personal data.

Current situation: TapGoCR is not connected to Meta or TikTok through an API. The Instagram or TikTok buttons on a page are links to public profiles, and by pressing them you go to those services, under their own policies.

Integration in preparation: TapGoCR is preparing to connect, with the account holder’s express authorization, professional Instagram and TikTok accounts (TapGoCR’s own and, only with their authorization, a customer’s) in order to:

• Read data from the connected account: identifier, username, public profile and its own posts.
• See metrics for those accounts and posts (reach, interactions, followers) to show them in the dashboard.
• Prepare content and, only after a specific human approval, send it for publication.

Our commitments for those integrations:

• We will request only the permissions needed for those functions and will not read private messages.
• We will use the data obtained only to provide those functions to whoever connected the account.
• We will not sell that data, share it with data brokers or use it for third-party advertising.
• We will never publish or send anything on an account without a specific human approval.

Use of Instagram and TikTok is also governed by their own terms and privacy policies.

When an Instagram or TikTok account is connected, the originating platform gives TapGoCR an access token instead of your password: we never receive or store your Instagram or TikTok password. Our policy for those tokens and for any API credential is:

• They are stored only on the server, never in the browser or in the site’s public code, and are not shown on screens, logs or messages.
• Only authorized backend processes use them, with minimum permissions.
• They are kept while the authorization is active, renewed before expiry, and revoked and deleted when the account is disconnected or on any suspicion of compromise.

You can withdraw TapGoCR’s access at any time, in any of these ways:

• Instagram / Facebook: in your account settings, in the connected apps and websites section (or business integrations), remove the TapGoCR app.
• TikTok: in your account settings, under connected app permissions, remove TapGoCR’s access.
• Directly with us: ask us to disconnect through the contact channels.

When you disconnect, we stop querying the account, revoke and delete the stored token and delete the data obtained from that platform, except for the minimum records we must keep by legal obligation or to audit the actions performed.

To request deletion of your personal data, including data obtained from Instagram or TikTok, write to us with the subject «Data deletion» and state the email or username associated. We will confirm your identity, delete the data we are not required to keep by law and let you know when it is done.

For requesting deletion of your data you can reach TapGoCR through any of these channels:

• Email: [email protected].
• WhatsApp: +506 8630 2700.
• The contact form on our website (the website itself is in Spanish).

We do not have fixed support hours: we reply as soon as we can.

We apply reasonable technical and organizational measures, including:

• Encrypted connections (HTTPS) and passwords stored as hashes.
• Server-side access control by role and by business: each customer only sees their own data.
• Attempt limits, anti-bot verification and spam filtering on forms.
• Logging of sensitive operations and least-privilege access keys for the automated systems.
• Backups kept for a limited period.

No system connected to the Internet is completely secure and we cannot guarantee absolute security. Please protect your credentials too.

• Prospects that do not become customers: 12 months from the last contact.
• Active customers: while the commercial relationship exists.
• Former customers: for the time needed to meet legal, accounting and commercial obligations.
• Invoices and receipts: for the applicable legal periods.
• OAuth tokens: while the authorization is active; deleted or revoked when appropriate.
• Internal tasks generated from emails: automatically deleted some time after completion (currently 90 days).
• Backups: rotated and deleted periodically.

After those periods we delete or anonymize the data when there is no obligation to keep it.

Under Law No. 8968 and its Regulation, you may request access to your personal data, its rectification or update, its deletion where applicable, and withdraw the consent you gave us, as well as object to its use for commercial purposes.

For exercising your rights you can reach TapGoCR through any of these channels:

• Email: [email protected].
• WhatsApp: +506 8630 2700.
• The contact form on our website (the website itself is in Spanish).

We do not have fixed support hours: we reply as soon as we can.

We will ask for the data needed to verify your identity. We handle every request free of charge and within a maximum of 5 business days, counted from the day after we receive it (Law No. 8968, article 7; Regulation, articles 18 to 20). We give you an acknowledgement of receipt with the date received. If the information in your request is insufficient, we ask for more once within those days; the period is suspended meanwhile and you have five business days to reply (if you do not, the request is considered not filed).

If you withdraw your consent, we act within five business days and notify those to whom we transferred your data (Regulation, article 8); if you ask for confirmation that processing has stopped, we answer within three business days (article 9). If you believe your rights were not honored, you may also go to the Costa Rican data protection authority, the Agencia de Protección de Datos de los Habitantes (Prodhab).

TapGoCR is aimed at businesses and adults. We do not knowingly collect data from minors; if you believe we did, let us know so we can delete it.

We may update this policy when the service, the integrations or legal requirements change. We will publish the current version with its update date; important changes, especially when a Meta or TikTok integration is activated, will be reflected here before it goes into use. The Terms and Conditions also apply.

Controller: Jin Lin, an individual who operates TapGoCR in Costa Rica.

For privacy questions you can reach TapGoCR through any of these channels:

• Email: [email protected].
• WhatsApp: +506 8630 2700.
• The contact form on our website (the website itself is in Spanish).

We do not have fixed support hours: we reply as soon as we can.