Privacy Notice

TapFirst is operated by Regina Shaw (the "Seller", "we", "us"), who is the data controller for the personal data described in this notice. That means we decide how and why your data is processed and are responsible for it.

• Account data — name, email address, login credentials, and the profile details you choose during onboarding (focus areas, limiting beliefs, experience level).
• Session content — what you speak or type into guided sessions, transcripts, reflections, bookmarks, and lesson progress.
• Support messages — anything you send us when you ask for help.
• Usage and device data — app interactions, approximate device and browser information, and IP address, used for security and product improvement.

Payment details (card numbers, billing address) are collected and processed directly by Paddle, our Merchant of Record — we never see or store your full card details.

• Providing the service — creating your account, generating personalized guided sessions, tracking progress (legal basis: performance of our contract with you).
• Security and fraud prevention — protecting accounts and the service (legal basis: legitimate interests).
• Product improvement — understanding how features are used to make TapFirst better (legal basis: legitimate interests).
• Customer support — responding to your requests (legal basis: contract performance / legitimate interests).
• Marketing — only with your consent where required, and you can opt out anytime.

• Service providers — hosting, database, AI processing, and analytics providers that process data on our behalf under contract.
• Paddle (Merchant of Record) — for the sale of subscriptions, payment processing, tax compliance, invoicing, and subscription management.
• Professional advisers — legal and accounting, where necessary.
• Authorities — where required by law.

We do not sell your personal data.

TapFirst invites you to speak openly about emotions, health, relationships, and work. Treat what you share as sensitive: we store it only to provide your sessions and history back to you, we don't use it for advertising, and you can delete your history from your account.

We keep your data for as long as your account is active and as needed to provide the service. When data is no longer needed — for example after account deletion — it is deleted or anonymised within a reasonable period, except where we must keep records by law.

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, to object to processing, and to withdraw consent at any time. To exercise any of these rights, contact us through the support contact shown at checkout or on your Paddle receipt. If you are in the UK or EEA, you also have the right to complain to your data-protection supervisory authority; we respond to requests within one month.

Some of our service providers process data outside the UK/EEA. Where they do, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.

We use appropriate technical and organisational measures — including encryption in transit, access controls, and row-level data isolation — to protect your personal data.

TapFirst uses essential cookies and local storage to keep you signed in and remember your preferences (such as voice and mode settings). We do not use advertising cookies. You can clear cookies and site data in your browser settings at any time; essential sign-in storage is required for the app to function.

We may update this notice from time to time; the "last updated" date above shows the current version. Questions or requests about your data: use the support contact shown at checkout or on your Paddle receipt.