01Who we are
Taplink is a service from Laini Labs. We make NFC cards, keychains and stickers with a QR code that open a link of their owner's choosing when tapped or scanned. Laini Labs is the data controller for the personal data described here.
Questions about this policy or your data go to info@lainilabs.com.
02What we collect
| Data | From whom | Why |
|---|---|---|
| Name, email address, phone number | Card owners who create an account | To sign you in, link your cards to you, and contact you about your account |
| What your card opens: a username, phone number, web address or contact card | Card owners | To send people who tap your card to the place you chose |
| Tap records: which card, NFC or QR, time, approximate country and city, device type (for example "iOS") | Anyone who taps or scans a card | To show owners how their card is used and to keep the service working |
| Messages you send us | Anyone who contacts us | To answer you |
A card's chip and QR code hold only a short web address. They hold no personal data.
03Why we're allowed to use it
Data protection law, including Kenya's Data Protection Act, 2019, lets us use personal data only for a lawful reason. Ours are:
- To provide the service you signed up for (contract): your account details and what your cards open. Without them we can't run your cards.
- Our legitimate interests: tap records, to show owners how their cards are used, and server logs, to keep the service secure and fix problems. We keep these to the minimum, which is why taps store no IP address.
- Your consent: product news and marketing emails, which we send only if you agree to them. You can withdraw consent at any time.
- Legal obligations: records the law requires us to keep, or to share with authorities when lawfully required.
04When you tap a card
You don't need an account to tap a card. When you do, we look up where the card points and send you there. We record that the tap happened, but we do not store your IP address or your browser's full identifying string, we set no cookies, and we do not try to identify you.
The approximate location comes from our hosting provider's network and is never more precise than a city. Once you leave for the destination (for example Instagram or WhatsApp), that site's own privacy policy applies.
06Who processes data for us
We use a small number of providers, each bound to protect the data they handle:
- Cloudflare runs the service and serves every tap.
- Neon hosts our database.
- Clerk handles sign-in, including sign-in with Google, and stores your name, email address and phone number.
These providers may process data outside Kenya, including in the United States and the European Union. Where they do, we rely on their contractual safeguards to protect it. We share data with authorities only when the law requires us to.
07Google user data
You can create a Taplink account by signing in with Google. This is the only way Taplink uses Google: we request only Google's basic sign-in permissions (your name, email address and profile picture) and no other Google service.
- What we access: your name, email address and profile picture from your Google account. We never access your contacts, Gmail, Drive, calendar or any other Google data.
- How we use it: only to create your Taplink account, sign you in, show your name in your account, and contact you about your account and cards.
- Sharing: we do not sell, rent or share Google user data with anyone. It is processed only by our sign-in provider (Clerk) and stored in our database (Neon), so that we can run the service. We never use it for advertising.
- Protection: Google user data is encrypted in transit (HTTPS) and at rest, and only staff who need it to support you can see it.
- Retention and deletion: we keep it for as long as you have an account. Email info@lainilabs.com to delete your account and we will delete your Google user data within 30 days. You can also remove Taplink's access at any time from your Google Account settings.
Taplink's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
08How long we keep it
- Account data: for as long as you have an account.
- Card destinations: for as long as the card is active. Destinations belong to your account, so they are deleted with it.
- Tap records: for as long as the card's account exists, then deleted with it.
- Server logs: kept for a short time to fix problems, then deleted automatically.
09Your rights
You can ask us to show you the personal data we hold about you, correct it, delete it, or stop using it, and you can object to how we use it. You can change your name, email address and phone number yourself from "Manage account" when signed in. For anything else, email info@lainilabs.com and we will reply within 30 days.
If you are unhappy with how we handle your data, you can complain to the Office of the Data Protection Commissioner in Kenya, or to the data protection authority where you live.
10Security
All traffic is encrypted in transit (HTTPS), data is encrypted at rest by our providers, and only staff who need it can reach customer data. No system is perfectly secure; if a breach affects your data, we will tell you and the regulator as the law requires.
11Children
Accounts are for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us their data, contact us and we will delete it.
12Changes to this policy
If we change this policy, we will update the date at the top of this page. If a change materially affects how we use your data, we will tell account holders by email before it takes effect.