Tap Links — Data Sunsetting & End-of-Service Policy

Operator: Mace Design LLC (a New York limited liability company) d/b/a “Tap Links”
Effective date: 2026-05-18 · Version: 1.1

Summary

• When a customer relationship ends, the customer has a 30-day window to export their data through the dashboard.
• We move Customer Content to a frozen state on Day 30, permanently delete it from production on Day 90, and purge it from backups within approximately 30 days thereafter.
• Customers may request immediate deletion, a longer export window, or destruction of cryptographic keys for devices they have scrapped.

This summary is informational and subject to change. In a conflict between this summary and the formal text below, the formal text controls.

This policy describes what happens to customer data, physical hardware, and cryptographic keys when a customer relationship with Tap Links ends. It applies when:

• A customer terminates their relationship with Tap Links (for convenience, or because they no longer need the Service),
• Tap Links terminates the relationship for cause (e.g., uncured breach, repeated AUP violations, end of life of a beta engagement),
• A customer’s account becomes inactive for an extended period without payment or response, or
• Tap Links discontinues the Service entirely.

It complements (and is incorporated by reference into) our Terms of Service, the Master Services Agreement, the Data Processing Addendum, and the Privacy Policy. In the event of a conflict between this policy and a signed MSA, the signed MSA controls.

1. Headline summary

These windows are the defaults. They can be shortened or extended by an Order or by written instruction from the Customer (within the bounds of applicable law and our retention obligations).

This section describes the process Tap Links will follow when a customer relationship ends. As a young company we have not yet had occasion to run a full customer offboarding at scale; the timelines are commitments, executed manually by the operator, not automated jobs.

2. Definitions

• “Customer Content” has the meaning in the Terms of Service and includes destination URLs, link names, group names, brand assets, and other content submitted to or generated through the Service by Customer.
• “Personal Information” has the meaning in the Data Processing Addendum.
• “Tap Links–locked device” means a device that Tap Links cryptographically locked with AES-128 (the default for Tap Links devices). Devices that the customer left unlocked or locked with their own credentials are not Tap Links–locked.
• “Effective Termination Date” means the date the contractual relationship ends, as determined under the Terms of Service or the applicable MSA.

3. What happens to Customer Content

3.1 During the relationship

Customers can self-serve export at any time. Exports are CSV or JSON dumps of:

• Device roster (UID, status, current destination URL, name, tap count, last-tapped timestamp).
• Link history (chronological changes to destination URLs).
• Tap events (aggregated; without individual IP detail unless Customer specifically requests with appropriate justification).
• Group definitions and memberships.
• User roster (Authorized Users on the account).

Contact hello@taplinks.com if you need an export format that isn’t covered by the self-serve flow.

3.2 Through the 30-day export window

For 30 days after the Effective Termination Date, Tap Links will:

• Continue to honor self-serve and on-request exports of Customer Content at no additional charge.
• Maintain Customer Content in a normal, readable form so that Customer can audit, migrate, or reconcile records.
• Disable Authorized Users’ ability to make changes through the dashboard (read-only access by default).
• Continue redirecting taps on existing devices to their then-configured destinations (so that devices in the field do not abruptly fail).

3.3 Day 30 — frozen state

At the end of the 30-day window:

• Dashboard access is fully revoked. Re-export requires direct contact with Tap Links and may incur a reasonable handling fee (waived for customers in good standing).
• NFC redirects pause: tapping a device resolves to a generic “this device is no longer active” holding page hosted by Tap Links. The destination URL stored for each device is preserved in the database but not served.
• Customer Content is moved into a “frozen” partition that is read-only for Tap Links personnel and inaccessible from the customer-facing dashboard.

3.4 Day 90 — permanent deletion

At Day 90 after the Effective Termination Date, Customer Content is permanently deleted from Tap Links’ production infrastructure, except:

• Records subject to legal hold, subpoena, an ongoing investigation, an active insurance claim, or other binding obligation.
• Financial records (invoices, receipts, payment metadata): retained for 7 years per US tax/accounting standards.
• Tap Links does not currently maintain a dedicated log of access to Customer Content. If one is introduced, this policy will be updated with its retention period.
• De-identified aggregate statistics (e.g., total taps per month across the whole platform) where Customer Content has been irreversibly anonymized.

3.5 Backups

Customer Content is captured in our cloud provider’s (Cloudflare) standard, provider-managed backups. Tap Links does not operate a separate backup system or a backup-deletion process; after the production deletion at Day 90, Customer Content persists only in the provider’s backups and ages out on the provider’s own rotation schedule, which Tap Links does not control.

We will not restore Customer Content from a provider backup after the Day 90 production deletion absent a binding legal obligation to do so.

4. What happens to physical devices in the field

When a customer relationship ends, the physical devices the customer purchased are still their property. They sit wherever they were placed. What changes is the cloud-side behavior:

4.1 Redirect pause (Day 30)

At Day 30 after termination, NFC taps on the customer’s devices resolve to a Tap Links–hosted “this device is no longer active” holding page. The page is plain and short; it does not display the customer’s branding, business name, or any link to the customer.

If you want a different behavior (e.g., redirect to a final URL of your choosing, or to your own holding page) please write to us before Day 30.

4.2 Device cryptographic state

• Tap Links–locked devices: the AES-128 key remains in our infrastructure until you ask us to destroy it, or until we determine that the device is unlikely to remain in use (typically multiple years). Destroying the key removes it permanently; the device cannot be re-locked or re-purposed after that point.
• Unlocked devices: no key exists. The customer (or a third party) can re-program the URL on the chip at any time using an NFC-write app and a phone or USB reader.
• Customer-locked devices: the customer controls their own key. Tap Links has no role.

4.3 Decommissioning a destroyed or scrapped device

If you destroy or scrap a Tap Links–locked device, you can ask us to permanently delete its key from our infrastructure by emailing hello@taplinks.com with the device’s UID. We will require you to re-confirm the UID before we delete, because the deletion is irreversible, once the key is gone, the device cannot be unlocked or re-locked. See the procedure in our Security Overview § 5.

4.4 Reuse of decommissioned device chemistry

The physical device (housing, finish, NFC inlay) is just an NFC tag once decommissioned. The customer (or a successor in interest) may reuse the chip if they have the technical means to program it. Tap Links does not assist in third-party reuse and offers no warranty for any post-decommission use.

5. What happens to Authorized Users

5.1 During the 30-day window

Authorized Users retain read-only dashboard access. We send a courtesy email to each Authorized User on the account on the Effective Termination Date informing them of the timeline and providing the export link.

5.2 After Day 30

Authorized User access is fully revoked. Session tokens are invalidated. User records are retained in the frozen partition for a reasonable period consistent with applicable law and contractual obligations, then deleted.

5.3 Re-engagement

If the customer re-engages Tap Links within the Day 30–90 window, we can reactivate the account from the frozen state at no additional cost. After Day 90 the data is gone and reactivation effectively means starting over.

6. Tap Links–initiated terminations

Where Tap Links is the party initiating termination (per Terms of Service § 8.2 or the applicable MSA), we will give the customer no less than 30 days’ written notice before the Effective Termination Date, except where:

• The termination is for an immediate-and-serious AUP violation (CSAM, malware distribution, fraud, etc.): see Acceptable Use Policy § 8 paragraph (4). In those cases, we may terminate without prior notice and report to law enforcement.
• The termination is required by law or a binding order of a government authority, we will give whatever notice is consistent with that law or order.

Even in immediate-termination cases, the data-sunsetting timeline above (30/90/120 day windows) still applies once the relationship has ended, subject to legal holds.

7. Tap Links discontinuing the Service

If Tap Links decides to discontinue the Service entirely (e.g., shutting down operations, winding down the company, divesting), we will:

• Give all current customers at least 120 days’ written notice before the discontinuation date.
• Continue normal operation through that notice window.
• Provide a final export of Customer Content at no charge during that window.
• Where commercially feasible, identify a successor or migration option for affected customers (a third-party vendor that can host the redirect, for example), though we make no commitment to do so.
• Honor the data-sunsetting timeline above starting from the discontinuation date.

In a sale-of-business scenario, this policy may transfer to a successor entity. The successor is bound by the same retention and deletion obligations until they give you 30 days’ notice of any change.

8. Customer-initiated requests

A customer can short-circuit the standard timeline by sending a written request to hello@taplinks.com:

• “Delete immediately”: we will delete Customer Content within 7 business days of confirmation, skipping the 30-day window. Devices stop redirecting at the same time. Backups still purge on the normal rotation. This is irreversible, confirm carefully.
• “Extend export window”: we can extend the 30-day export window by up to an additional 60 days on request, at no charge for the first request.
• “Decommission these devices”: we will delete the listed Tap Links–locked device keys after re-confirmation. The 24h decommission turnaround applies; see Security Overview § 5.

9. Legal hold

If we receive a subpoena, court order, litigation hold, or other binding legal request that references Customer Content, we will:

• Suspend the standard deletion timeline for any data covered by the hold.
• Where lawful and practical, give the affected customer notice so they can seek to challenge the request.
• Resume the normal timeline as soon as the hold is lifted.

Holds do not extend retention beyond what the underlying law requires.

10. Contact

• Sunsetting questions or requests: hello@taplinks.com
• Device decommissioning: hello@taplinks.com
• Privacy / data-deletion rights: hello@taplinks.com