Privacy Policy

1. Who we are

Taptivo (“Taptivo”, “we”, “us”, “our”) is a New Zealand–based marketplace that connects event attendees with food trucks and vendors, available as a mobile app (iOS and Android), a web app, and this website. This policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have. We handle personal information in accordance with the New Zealand Privacy Act 2020.

Questions or requests about your information can be sent to support@taptivo.io.

2. Information we collect

What we collect depends on how you use Taptivo and which roles your account has:

• Account details — your email address, name, profile photo, phone number and address, and the sign-in method you use (email code, Google or Apple).
• Identity verification — verification is performed by Stripe Identity. You provide your ID document and a selfie directly to Stripe; Taptivo never receives or stores those images. We store only the verification outcome: your verified name, date of birth, document type and verification status.
• Payment information — payments and saved cards are processed by Stripe. Your full card number never touches our servers; we store only a reference to your Stripe customer record and card metadata (brand, last four digits, expiry) so you can manage your saved cards.
• Orders and transactions — the items you order, amounts paid, store credit applied, refunds, and the event and vendors involved.
• Vendor business details — if you activate the vendor role: your business name, NZ Business Number (NZBN) and related public registry data, category, description, menu (including photos), trading details, address and payout details (account name and the last digits of your bank account).
• Location — with your permission, your device location is used to find nearby events, to track deliveries in progress (runners), and to confirm handovers. Location is used while you use those features; we do not build a history of your movements.
• Photos and camera — with your permission, when you choose to upload a profile photo, a business logo or banner, or menu item photos.
• Messages and ratings — chat messages you send about an order or to support, and the ratings you give and receive after completed orders.
• Device and usage data — basic technical information such as device type, app version and request logs used to keep the service secure and reliable. The app also stores a copy of your recent data (menus, orders, cart) on your device so it keeps working with poor connectivity at event sites.

3. How we use your information

• To create and operate your account and its roles (customer, vendor, runner).
• To take orders, process payments and refunds, and pay vendors.
• To verify identity where required for safety and fraud prevention.
• To coordinate fulfilment — showing order status, runner delivery and handover.
• To operate order chat, support conversations and ratings.
• To send transactional email such as sign-in codes and order updates.
• To keep the service secure, prevent fraud and abuse, and comply with law.
• To improve the app, including fixing errors from technical logs.

We do not sell your personal information, and we do not use it for third-party advertising.

4. Who we share it with

Other users, as needed to fulfil an order.Vendors see the name and order details of customers who order from them; runners see the customer’s name, order and delivery location; customers see vendor business profiles and the first name of their runner. Ratings are shown as averages on profiles.

Service providers that process data on our behalf, under their own security and privacy obligations:

• Stripe— payment processing, saved cards, refunds and identity verification (Stripe Identity). See Stripe’s privacy policy at stripe.com/privacy.
• Google — optional Google sign-in, and Google Maps/Places for maps and address autocomplete.
• Apple — optional Apple sign-in on Apple devices.
• OpenAI — powers optional vendor tools such as menu import and AI-generated menu photos. Menu text and images are processed; customer personal information is not sent to OpenAI.
• Resend — delivery of transactional email (sign-in codes, notifications).
• Cloud hosting and database providers — our backend and database run on reputable cloud infrastructure which may be located outside New Zealand.

We may also disclose information where required by law, to enforce our terms, or to protect the rights and safety of users.

5. International transfers

Our service providers may store or process information outside New Zealand (for example, in the United States or Australia). Where they do, we take reasonable steps to ensure the information remains protected to standards comparable to the Privacy Act 2020.

6. Retention

We keep your information while your account is active. Order, payment and transaction records are kept as long as required for tax, accounting and dispute purposes (generally seven years in New Zealand) even after an account is deleted. Chat messages and ratings are kept while the related accounts exist. Data cached on your device is removed when you sign out or uninstall the app.

7. Security

Information is encrypted in transit (HTTPS). Access tokens are stored in your device’s secure storage. Access to production data is limited to authorised staff. Support staff can assist with your account through audited support sessions that cannot make payments or change your identity verification. No system is perfectly secure — if we become aware of a breach that causes serious harm, we will notify affected users and the Office of the Privacy Commissioner as required by law.

8. Your rights and choices

• Access and correction — you may request a copy of the personal information we hold about you and ask us to correct it. Most account details can be edited directly in the app.
• Permissions — location, camera, photo and notification access are optional and controlled in your device settings; core browsing works without them.
• Account deletion — you can delete your account in the app under Account → Delete account, or by emailing support@taptivo.io. Deletion removes your profile and sign-in; transaction records we must keep by law are retained but no longer linked to an active account.
• Complaints — contact us first and we will try to resolve the issue. You may also complain to the Office of the Privacy Commissioner (privacy.org.nz).

9. Children

Taptivo is not directed at children. You must be at least 16 years old to create an account, and at least 18 to purchase alcohol (where a vendor is licensed to sell it) or to operate as a vendor or runner. We do not knowingly collect personal information from children under 16; if you believe we have, contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. Material changes will be signalled in the app or by email, and the “last updated” date above always reflects the current version. Continued use of Taptivo after a change takes effect means you accept the updated policy.