Privacy Policy
Zuletzt aktualisiert: 18 August 2026
This policy explains what data we process when you use TapBoost, why we process it, how long we keep it, who we share it with, and what rights you have. It includes a dedicated section on data obtained through Google APIs.
1. Data controller
The data controller is PCPHONE CALA D'OR, tax ID X6057848Q, registered at Avenida Tagomago 51, 07660 Cala d'Or, Illes Balears, Spain.
- Privacy contact: soporte@tapboost.es
- General contact: soporte@tapboost.es
- Phone: +34 694 456 789
TapBoost is a trading name owned by the entity above. We have not appointed a Data Protection Officer, as the conditions of Article 37 GDPR do not apply; enquiries are handled at the privacy address above.
2. Data we process
2.1. Data you give us directly
| Category | Specific data | Source |
|---|---|---|
| Account | Name, email address, hashed password, preferred language | Sign-up form |
| Business | Company name, tax ID, billing address, industry | Onboarding or billing form |
| Team | Name and email of the people you invite, their role and permissions | Admin panel |
| Communications | Content of messages you send us via form, email or support | Voluntary contact |
2.2. Data obtained through Google APIs
When you connect a Google Business Profile, and only with your express authorisation through Google's own consent flow, TapBoost accesses the following data:
| Data | What it is used for |
|---|---|
| Identifier, name and address of the business profiles you connect | Showing you your locations and letting you choose which ones to manage |
| Review text, star rating and date | Displaying the review and generating the suggested reply |
| Public display name of the review author, as provided by Google | Displaying the complete review and personalising the reply |
| Existing replies to those reviews | Preventing duplicates and letting you edit previous replies |
| Your Google account identifier and associated email address | Linking the connection to your TapBoost account and refreshing authorisation |
2.3. Data generated by using the service
- Generated reply drafts, edits made and the final decision taken.
- Approval log: which person approved which reply, and when.
- Technical logs: IP address, browser type, access date and time, system errors.
- Billing and payment data, handled by our payment provider (we do not store full card numbers).
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Delivering the contracted service: displaying reviews, generating drafts and publishing the replies you approve | Performance of a contract — Art. 6(1)(b) |
| Managing your account, your team and billing | Performance of a contract — Art. 6(1)(b) |
| Handling your support enquiries | Contract or legitimate interest — Art. 6(1)(b) / 6(1)(f) |
| Keeping the service secure and preventing abuse or fraud | Legitimate interest — Art. 6(1)(f) |
| Meeting accounting, tax and legal obligations | Legal obligation — Art. 6(1)(c) |
| Sending you commercial communications about TapBoost | Consent — Art. 6(1)(a), withdrawable at any time |
4. Artificial intelligence: what we do and what we do not
To prepare a suggested reply, the text of the review is transmitted to our language model provider at the time of the request, for the sole purpose of generating that specific reply.
Express commitments
- We do not use Google user data to develop, improve or train generalized, foundational or frontier AI/ML models.
- We do not transfer Google user data for the purpose of training non-personalized models.
- We do not store Google user data alongside such models.
- We do not co-mingle your data with data from other users or organizations.
- We do not build databases or permanent copies of data obtained from Google beyond what is strictly necessary to deliver the service.
- We do not sell Google user data, and we do not share it with third parties for advertising, targeting or measurement purposes.
Our model provider operates under a commercial plan in which prompts and responses are not retained to train or improve its models. The provider's identity and the international transfer safeguards are listed in the sub-processor table in Section 6.
5. Human access to your data
No member of our team reads the content of your Google data, except in the following cases:
- Where we have obtained and documented your explicit consent, for example to resolve a specific issue you have reported to us.
- Where it is necessary for security purposes, or to investigate abuse, an incident or a vulnerability.
- Where there is a legal obligation or a request from a competent authority.
- Where the data has been aggregated and anonymised so that it can no longer identify any person or business.
6. Recipients and sub-processors
We do not disclose your data to third parties except where legally required. We do rely on the following providers, acting as processors or sub-processors under Article 28 GDPR contracts:
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| IONOS SE | Application and database hosting | Germany | Within the European Union |
| Language model provider | Generating suggested replies | Pending | Pending. The feature is not active and no data is transmitted. The provider will be published here before it is enabled. |
| Transactional email provider | Notices and notifications | Pending | Not yet contracted. |
| Payment provider | Payment processing and invoicing | Pending | Not yet contracted. No charges are made. |
| Google Ireland Limited | Google Business Profile APIs | Ireland / USA | EU-US Data Privacy Framework / SCCs |
We keep this table current: whenever we add a provider that processes personal data, it is published here before it begins processing.
7. Retention periods
| Data | Retention |
|---|---|
| Synchronised Google reviews and replies | For as long as the connection to the business profile remains active |
| Account and team data | For as long as the account remains active |
| After account closure or access revocation | Deleted within a maximum of 30 days |
| Approval log | 12 months, as evidence of human supervision |
| Technical and security logs | 12 months |
| Accounting and tax records | 6 years (Art. 30 Spanish Commercial Code) or the applicable statutory period |
8. Your rights
You may exercise your rights of access, rectification, erasure, restriction of processing, objection and portability, and withdraw your consent at any time, by writing to soporte@tapboost.es. We respond within one month, extendable by two further months in particularly complex cases, which we will notify you of in advance.
You can request complete deletion of your data free of charge through the public procedure described on our Data Deletion page.
If you believe the processing does not comply with data protection law, you have the right to lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es).
9. How to revoke access to your business profile
- From TapBoost: Settings → Connections → Disconnect business profile.
- From your Google account: myaccount.google.com/permissions → TapBoost → Revoke access.
In both cases revocation is immediate, requires no justification, and stops all synchronisation at that moment.
10. Security
- Encryption in transit using TLS 1.2 or above.
- Database encryption at rest.
- Access to production systems is restricted, named and logged.
- Passwords are stored using key derivation functions, never in plain text.
- Google access tokens are stored encrypted and refreshed through the standard OAuth 2.0 mechanism.
11. Children
TapBoost is a service aimed at businesses and professionals. It is not intended for anyone under 18 and we do not knowingly collect data from minors.
12. Changes to this policy
If we change this policy we will notify you by email or through an in-app notice before the changes take effect. The last updated date appears at the top of this document.