In short
- We collect only what is needed to create your account and show the page you build.
- What you put on your public page can be seen by anyone who opens it; nothing else is shown.
- No ads, no advertising ID, no sale or rental of information.
- Visit statistics are anonymous (no IP address, no cookie).
- The app reads NFC cards on the phone and sends nothing beyond opening the page.
- You can delete your account yourself, at any time.
1. What this policy covers
It covers the CapTap service: the cap-tap.com website, users' public pages and the CapTap Android app (ID com.capcommun.captap), which shows cap-tap.com full screen. It complements Cap Commun's general privacy policy; for CapTap, this page applies first.
2. Information collected and why
| Information | Why | Required? |
|---|---|---|
| Name and email address | Create and manage your account, sign you in, write to you about the service (for example to reset your password) | Yes |
| Password | Sign you in. It is stored in hashed form (PBKDF2): no one, not even Cap Commun, can read it | Yes, unless you sign in with Microsoft or Google |
| Your Microsoft or Google account identifier | Sign you in with "Continue with Microsoft" or "Continue with Google", if you choose to | No |
| Content of your page: title, organization, phone, links, sections, photo, colours | Show your public page, the contact card (vCard) and the QR code | No (your choice) |
| Replies to the forms on your page | Pass on the messages visitors send you | — |
| Organization and role | Let your organization's administrators manage the team's accounts and cards | Only in a team |
| Custom web address (Premium) | Show your page on your organization's domain | No |
| Subscription: plan, status, Google Play purchase token, dates | Turn Premium on, renew it or end it based on what Google tells us | Only for Premium |
| Visit and click statistics for your page: device type, language, link clicked | Show you how many people view your page. Anonymous: no IP address, no cookie | — |
| Session cookie | Keep you signed in securely (HttpOnly cookie) | Yes, once signed in |
| Hashed IP address after failed sign-ins | Block attempts to guess passwords. Kept 24 hours at most | — |
The Android app collects nothing more than the website. It has no access to your contacts, location, photos or files. It uses:
| Permission | Why |
|---|---|
| NFC | Read the address stored on a CapTap card. Reading happens on the phone; nothing is stored or sent, other than opening the card's page |
| Internet | Show cap-tap.com |
| Google Play billing service | Allow the Premium subscription purchase |
You choose your profile photo on the website (in the app, through Android's file picker): the app has no ongoing access to your photos.
3. What is public
Your CapTap page is made to be shared: anything you show on it can be seen by anyone who opens it (through the card, the QR code or the link), and copied or saved to their contacts. With Premium, you can also make it appear in Google. Only put on it what you are willing to make public. Your sign-in email address is not shown unless you add it to your page yourself.
5. Service providers and hosting locations
We do not sell, rent or share your information with third parties for their own purposes. We use providers that process it on our behalf, following our instructions:
| Provider | Role |
|---|---|
| Cloudflare | Hosting of the website, the database and profile photos; protection against attacks; custom web addresses |
| Payment and management of the Premium subscription (Google Play); "Continue with Google" sign-in if you choose it; display of the app by Chrome | |
| Microsoft | "Continue with Microsoft" sign-in if you choose it; sending the service's emails |
| Anthropic | Writing assistant (Premium), only if you use it: the text you submit is sent to it to produce a suggestion |
| Jotform | Order form for the physical NFC card, if you order one |
These providers may store or process information outside Québec, including in the United States. Before entrusting information to them, we assessed that they provide adequate protection, as Québec law requires. Information may also be disclosed when the law requires it (for example under a court order).
6. Accounts managed by an organization
If your account belongs to an organization on CapTap, its administrators can view and edit your card's details, change your role, send you a password reset link and remove your account from the organization. They never see your password. The organization is responsible for how it uses these features with its staff.
7. Security
- All communications are encrypted (HTTPS).
- Passwords are stored as a hash, never in plain text.
- Repeated sign-in attempts are blocked for a while.
- Access rules (who can read or change what) are enforced on our server.
- The app backs up no data to Android's cloud: your session stays in Chrome, and your data on cap-tap.com.
No system is perfectly secure. If a confidentiality incident presents a risk of serious harm, we will notify you and the Commission d'accès à l'information, as the law requires.
8. Retention and deletion
Your information is kept as long as your account exists. At any time, you can:
- edit or remove the content of your page in My profile;
- permanently delete your account in My profile > Delete my account, or by following the steps on cap-tap.com/suppression-compte.
Deletion erases your account, page, links, sections, QR codes, photo, statistics and form replies. A Google Play subscription must first be cancelled in Google Play (Payments and subscriptions), otherwise Google keeps billing it. Transaction information we must keep for accounting and tax purposes is kept for the period the law requires (usually six years), then destroyed.
A physical NFC card only holds the address of your page: once the account is deleted, it leads to a page that no longer exists.
9. Intended audience
CapTap is intended for adults (18 and over) and organizations, for professional use. It is not designed for children.
10. Your rights and privacy officer
Cap Commun complies with Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). You can ask to access your information, correct it, receive it in a common format, or withdraw your consent.
For any question or request, write to the person in charge of the protection of personal information:
Teo Blanc
Cap Commun, Montréal (Québec)
Email: teo@cap-commun.com
We reply within 30 days. If you are not satisfied with our answer, you can file a complaint with the Commission d'accès à l'information du Québec.
11. Changes
If we change this policy, for example when a feature is added, the new version will be published on this page with its effective date. A significant change will also be announced to you by email or in the service.