TAP Business Privacy Policy
Last updated: October 7, 2026
This policy is for the TAP Business (TAPBiz) app only (com.neverhold.tapbiz) and the organization portal at neverhold.co/tapbiz. Consumer TAP has a separate Privacy Policy. Neverhold Lite / dialer has a separate Privacy Policy.
1. Who we are
Neverhold ("we") publishes TAP Business. Contact: [email protected]. Website: neverhold.co.
2. CCPA/CPRA categories
Under California CCPA/CPRA (Cal. Civ. Code §§ 1798.110, 1798.130), these are the categories of personal information TAPBiz may collect about you.
- Identifiers (account id, email, phone, username)
- Customer records / profile (display name, company, job title, work contact fields)
- Professional or employment-related information (org role, assigned cards, team or segment membership)
- Internet / network activity related to TAPBiz features (shares, inbox actions, portal use)
- Geolocation (only if you grant location for a feature that needs it, such as Nearby on some Android versions)
- Commercial information (organization plan, seat status, billing references)
- Customer content you or your organization create (business cards, context messages, meeting requests, CRM records your admin pulls or writes back)
TAPBiz does not collect TAP Medical ID or other health information, does not send emergency SMS, and does not run ads or a loyalty-points program.
Categories of sources
- You (account signup, profile, card fields, share context, inbox actions)
- Your organization admin (invites, assigned templates, teams, segments, kiosk programs)
- Your device (local cache of assigned cards and allowed contacts)
- Authentication providers (email or phone one-time codes via Supabase Auth and Twilio when used)
- Payment processors (Stripe and PayPal) for organization plans bought on the website
- The CRM your organization declares in the portal, when an admin connects it and confirms a pull or write-back
Business or commercial purposes
- Provide company cards and nearby TAP Share (and Broadcast Share where your organization enables it)
- Account authentication and organization membership (owner, admin, employee)
- Seat limits, billing, and the organization portal
- Sync the contact segment an admin assigns to field phones and kiosks
- Write field captures back to the CRM your organization declared
- Customer support and security
- Crash diagnostics, when enabled in the build
Categories of third parties / processors
- Supabase (auth, organization data, portal functions)
- Twilio (SMS or voice one-time codes for phone verification, when used)
- Stripe and PayPal (website checkout for organization plans)
- Firebase Crashlytics (crash diagnostics), if enabled in the build
- The CRM your organization connects: HubSpot, Salesforce, Zoho, Pipedrive, Microsoft Dynamics, Google, Microsoft Outlook, a CSV, TAPsoft, or another system your admin names
- OS share targets you choose when exporting a file
We do not sell personal information. TAPBiz does not use an advertising identifier for ads.
3. What TAP Business collects (detail)
Account and membership
Email, password (hashed by our auth provider), optional username, and optional verified phone. Membership links your user id to an organization, a role, and a seat.
Business cards and directory
Fields on company or event cards and your role overlay (name, title, phone, email, and similar work fields). Organization contacts and share records your role is allowed to see. The phone keeps an offline cache of the cards and contacts assigned to that seat.
TAP Share
Nearby / Bluetooth (and on some Android versions, location permission) so devices can find each other when a share is started. You may attach a context message or meeting request. We do not use discovery permissions for ads or maps, and we do not track you in the background for exchange.
Photos and camera
Card and profile pictures use the Android system Photo Picker, or the camera if you take a new photo. TAPBiz does not request access to your entire photo library.
Portal, segments, and CRM
Organization owners declare which CRM the company uses before any import. An admin maps a CRM list, view, team, filter, or CSV onto TAPBiz seats or teams, then confirms a pull. A later pull updates matching records. Field phones and kiosks receive only the assigned segment. They do not hold CRM tokens. Captures from the field can be written back to that declared CRM. TAPBiz is the control plane for that connection. It is not a second deal, task, or opportunity CRM.
Billing
Organization plans bought on neverhold.co are processed by Stripe or PayPal. We store the plan, seat limit, and the processor references needed to keep seats active. We do not store full card numbers.
Diagnostics
Firebase Crashlytics may receive crash reports. Those reports are not card contents or CRM credentials.
4. How we use it
- Run TAPBiz for your organization and its members;
- Enforce roles and seat limits;
- Sync assignments, kiosks, inbox outcomes, and the confirmed CRM segment;
- Process website billing and support requests;
- Improve reliability (crashes).
5. Sharing
We do not sell your personal information. Processors are listed in section 2. A card or lead you share with another person is sharing you start. Organization admins can see audit and inbox data for their organization. CRM sync happens when your organization has declared a CRM and an admin confirms a pull or a write-back.
6. Retention and deletion
On-device data stays until you clear it, uninstall, leave the organization, or delete your account. Organization records stay while the organization is active, subject to admin deletion and legal requirements. In the app, use account settings where available. On the web: delete-account.html. Organization owners should also remove seats in the admin portal.
7. Your rights (access / Request my data)
Access, correction, and deletion under CCPA/CPRA, PIPEDA, Mexican LFPD, and GDPR where they apply. In TAPBiz: About → Request my data (PDF and/or JSON of on-device account data). Under CCPA/CPRA § 1798.130(b), we are not obligated to regenerate this package more than twice in 12 months; re-sharing your last local package is unlimited. Organization directory data may also require your admin. Contact [email protected].
8. Children
TAPBiz is a business product. It is not directed at children under 13 (or 16 where a higher age applies). Do not create an account for a child.
9. Related products
Consumer TAP may collect card, proximity, and optional TAP Medical ID data described in the TAP Privacy Policy. The Neverhold dialer may collect call-related data described in the Neverhold Privacy Policy. The same email can be used to sign in, but TAPBiz seats and organization data are not the consumer TAP Medical ID, ads, or loyalty systems.
By using TAP Business you agree to this policy and the TAP Business Terms and Conditions.