Privacy Policy
Tapitab Inc. — Mytab Application and Website
Effective Date: August 5, 2026 Last Updated: August 5, 2026

1. Introduction
Tapitab Inc. ("Tapitab," "we," "us," or "our") operates the Mytab mobile application and the website located at tapitab.com (together, the "Services"). This Privacy Policy explains what personal information we collect, how we use and share it, and the choices available to you.
By using the Services, you agree to the practices described in this Policy. If you do not agree, please do not use the Services.

Contact: Tapitab Inc. 447 Broadway, Floor 2 New York, NY 10013 privacy@tapitab.com

2. Age Requirement
The Services are intended solely for individuals aged 21 and older. Mytab connects users with venues that serve alcohol and enables you to open running tabs at those venues, and we do not knowingly permit account registration or use by anyone under 21.
Age eligibility for the Services is a Tapitab platform requirement. It does not replace a venue's independent legal obligation to verify age and identity before serving alcohol.
We do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it promptly. Parents or guardians who believe a child has provided us information may contact privacy@tapitab.com.

3. Information We Collect
3.1 Information You Provide
Account information. Name, email address, mobile phone number, date of birth, and a password or authentication credential. We collect date of birth to verify that you meet the minimum age requirement described in Section 2.
Payment information. To use Mytab, you must save at least one valid payment card in the app. Card details are collected and stored by our third-party payment processor in tokenized form. Tapitab does not store your full card number, expiration date, or security code on our systems. We retain a payment token, the card brand, and the last four digits for display purposes.
Venue account information. If you register a venue, we collect business name, address, contact details, authorized user information, and information required for payment processing and merchant underwriting, which may include business tax identifiers and beneficial ownership details required under applicable financial regulations.
Communications. Information you provide when you contact us, submit a form, join a waitlist, or respond to a survey.
3.2 Information Collected Automatically
Location information. With your permission, we collect precise geolocation from your device. Location is central to the Services — it is how we match you to nearby venues, surface real-time availability, and route venue broadcasts to you. You may disable location access in your device settings, but core matching features will not function.
Transaction and tab information. Tabs you open, items ordered, amounts, timestamps, gratuities, venue identity, tab duration, closure method, and dispute or cancellation records.
Preference and matching information. Search inputs, natural-language requests, venue types selected, bids submitted, matches accepted or cancelled, and interactions with recommendations. This information trains and personalizes our matching engine.
Device and usage information. Device model, operating system, unique device identifiers, mobile network, IP address, app version, crash logs, session duration, and feature usage.
Camera. With your permission, we access your camera to scan venue QR codes. We do not retain camera images.
Cookies and similar technologies. Our website uses cookies and comparable technologies for functionality, performance measurement, and analytics. You may manage cookies through your browser settings.
3.3 Information From Third Parties
We may receive information from payment processors (transaction authorization results, dispute notifications), venues (items ordered on your tab, service records), identity or age verification providers, analytics providers, and Apple or Google in connection with wallet transactions and app distribution.
3.4 Biometric Authentication
If you authenticate using Face ID, Touch ID, or an equivalent device feature, that authentication occurs entirely on your device. Tapitab does not receive, collect, or store biometric identifiers or biometric information.

4. How We Use Your Information
We use personal information to:

• Create and administer your account and verify eligibility and age

• Match you to venues based on your stated preferences and real-time conditions

• Enable venue availability broadcasting and the bidding and pre-authorization features

• Open, maintain, and close tabs, including authorizing and capturing payment

• Process bill splitting among group participants

• Charge applicable fees, including cancellation fees, disclosed to you at the time you incur them

• Detect, investigate, and prevent fraud, walk-aways, chargeback abuse, and unauthorized account access

• Respond to and defend payment disputes, which may require providing transaction records to card networks and issuing banks

• Provide venue-facing analytics and guest insights, as described in Section 5.2

• Improve, develop, and train our matching, recommendation, and analytics systems

• Send transactional messages about your tabs, matches, and account

• Send marketing communications where permitted, subject to your opt-out rights

• Comply with legal obligations, including financial recordkeeping, anti-money-laundering, and tax requirements

• Enforce our Terms of Service and protect the rights and safety of users, venues, and Tapitab

Automated processing. Our matching engine uses automated processing to generate venue recommendations and guest insights. These processes do not produce legal or similarly significant effects, and human review is available on request for material decisions affecting your account.

5. How We Share Your Information
We do not sell your personal information for money. Certain sharing described below may qualify as a "sale" or "share" under some state privacy laws; see Section 8 for your opt-out rights.
5.1 With Venues You Transact With
When you open a tab, request access, or submit a bid, we share your first name, profile identifier, party size, arrival window, and tab contents with that venue so it can serve you and settle payment.
5.2 Venue Guest Insights
Please read this section carefully. Mytab provides participating venues with insights derived from guest activity. Where a venue you have transacted with is concerned, this may include your visit history at that venue, spending patterns, item and category preferences, typical party size, visit frequency, and derived loyalty indicators. This information is presented to venue staff to inform service.
Venues receive insights only for guests who have transacted with them, or who have an active match or open tab with them. We do not disclose your activity at one venue to a different venue in identifiable form. Aggregated and de-identified insights, which do not identify you, may be shared more broadly.
You may opt out of venue guest insights at any time as described in Section 8. Opting out does not prevent a venue from receiving the information necessary to serve you and process your payment.
5.3 Service Providers
We share information with vendors who perform services on our behalf, including payment processors and gateways, cloud hosting and storage providers, analytics and crash-reporting providers, customer support platforms, communications providers for email and SMS, fraud prevention and identity verification services, and professional advisors. These vendors are contractually restricted to using information only to perform services for us.
5.4 Payment Networks and Financial Institutions
We share transaction data with payment processors, card networks, and issuing banks as required to authorize, settle, and dispute transactions.
5.5 Other Group Members
If you participate in a split tab, other participants can see your name and the portion of the tab allocated to you.
5.6 Legal and Safety
We may disclose information where we believe in good faith it is required by law, subpoena, court order, or governmental request, or where necessary to investigate fraud, enforce our agreements, or protect the rights, property, or safety of any person.
5.7 Business Transfers
If Tapitab is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction. We will notify you of any such transfer and any material change to this Policy.

6. Data Retention
We retain personal information for as long as your account is active and thereafter as needed to:

• Comply with financial recordkeeping and tax obligations, generally seven years for transaction records

• Resolve disputes and defend chargebacks, which may be initiated up to approximately 120 days after a transaction and longer in limited circumstances

• Enforce our agreements and comply with legal obligations

• Prevent fraud and abuse, including retention of limited identifiers associated with closed or restricted accounts

Location data associated with matching activity is retained in identifiable form for 24 months and is then deleted or irreversibly de-identified. Marketing preferences are retained until you withdraw consent.

7. Security
We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, payment tokenization, access controls, and monitoring. Our payment practices are designed to align with applicable Payment Card Industry Data Security Standard requirements.
No system is completely secure. We cannot guarantee the security of information transmitted to us, and you provide information at your own risk. If we become aware of a breach affecting your personal information, we will notify you as required by applicable law, including the New York SHIELD Act.

8. Your Rights and Choices
8.1 All Users
Account access and correction. You may review and update account information in the app.
Account deletion. You may delete your account through the app or by emailing privacy@tapitab.com. We will delete or de-identify your information except where retention is required as described in Section 6.
Location. You may enable or disable location access through your device settings.
Push notifications. You may disable notifications through your device settings.
Marketing email. You may unsubscribe using the link in any marketing email. You will continue to receive transactional messages about your tabs and account.
SMS. If you consent to receive text messages, you may opt out by replying STOP. Message and data rates may apply.
Venue guest insights. You may opt out of Section 5.2 insight sharing at [INSERT LOCATION IN APP] or by emailing privacy@tapitab.com.
8.2 State Privacy Rights
Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws may have rights to:

• Know what personal information we collect, use, and disclose

• Access a copy of your personal information in a portable format

• Correct inaccurate personal information

• Delete personal information, subject to legal retention requirements

• Opt out of the sale or sharing of personal information

• Opt out of targeted advertising

• Limit the use of sensitive personal information, which for Mytab includes precise geolocation and financial account information

• Be free from discrimination for exercising these rights

To exercise these rights, email privacy@tapitab.com or use the in-app privacy controls. We will verify your identity before responding, typically by confirming control of your registered email or phone number. An authorized agent may submit a request on your behalf with proof of authorization.
We respond within 45 days, extendable by an additional 45 days where reasonably necessary. If we deny your request, you may appeal by replying to our response; we will respond to appeals within the timeframe required by your state's law.
California residents may also request disclosure of the categories of personal information collected, the sources, the business purposes, and the categories of third parties to whom it was disclosed in the preceding 12 months.
Global Privacy Control. We honor opt-out preference signals, including Global Privacy Control, transmitted by your browser.
8.3 Users Outside the United States
The Services are operated from the United States and intended for users in the United States. If you access the Services from elsewhere, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.

9. Third-Party Services
The Services integrate with Apple Pay, Google Pay, and other third-party services. Your use of those services is governed by their own privacy policies, which we do not control. Venues you visit are independent businesses responsible for their own privacy practices regarding information they collect directly from you.

10. Changes to This Policy
We may update this Policy from time to time. We will post the revised version with an updated "Last Updated" date. If changes are material, we will provide notice through the app, by email, or by other reasonable means before the changes take effect. Your continued use of the Services after the effective date constitutes acceptance.

11. Contact Us
Questions, requests, or complaints: Tapitab Inc. Attn: Privacy 447 Broadway, Floor 2 New York, NY 10013 privacy@tapitab.com