Privacy Policy
This policy explains how Tapa, a service of JMK Technologies, Ghana, handles personal data, in line with Ghana's Data Protection Act, 2012 (Act 843).
Two kinds of data
- Business accounts. For the people who sign up and use the dashboard, Tapa decides how the data is used (we are the "data controller").
- Your customers. When your customers message your business on WhatsApp, Tapa processes their data on your behalf (we are your "processor"). Your business is responsible for telling customers how their data is used.
What we collect
- Account details: business name, type, address, your name, email, WhatsApp number, password (stored scrambled, never in plain text), plan and payment history.
- Customer messages and orders: customers' WhatsApp names and numbers, messages and voice notes, orders, bookings, delivery addresses and location pins, and payment status.
- Riders: names and phone numbers you add for deliveries.
- Technical data: login sessions and basic server logs, used for security.
We don't collect card or Mobile Money PINs. Payments are entered on Paystack's pages.
How we use it
- To run the service: reply to customers, take orders and bookings, send payment links and order updates, show your dashboard and reports.
- To bill your subscription and help you with setup and support.
- To keep Tapa secure and fix problems.
We don't sell personal data, and we don't use your customers' data to market our own services to them.
Who we share it with
- Meta (WhatsApp), to send and receive messages.
- Paystack, to process payments.
- Anthropic (AI), when the AI assistant is on, to understand typed messages; and a speech-to-text provider for voice notes, when switched on.
- Our hosting provider, which stores the data on secure servers.
- Authorities, only when the law requires it.
Some of these providers process data outside Ghana, for example in the United States or Europe. We only use providers that protect data with security and contractual safeguards.
How long we keep it
Customer chats are deleted automatically after 12 months, and delivery addresses and location pins are removed from finished orders after 90 days. We keep other account and order data while your account is open. When a business closes its account in Settings, its data and its customers' data are deleted at once; we keep only our own subscription payment records, as accounting law requires. A business can also delete one customer's data at their request. Rider links stop showing customer details 12 hours after a delivery.
Security
Data is sent over encrypted connections. Passwords are scrambled, saved Paystack keys and WhatsApp tokens are encrypted, and phone numbers are hidden in our server logs. Each business sees only its own customers, riders and drivers see only the deliveries assigned to them, and our team's access to a business dashboard is limited to owners and recorded. No system is perfectly secure; tell us at once if you think your account has been misused.
Your rights
You can ask to see, correct or delete your personal data, or object to how it's used. Customers of a business on Tapa should contact that business first; we'll help the business respond. You can also complain to Ghana's Data Protection Commission.
Changes
We'll update this page when our practices change and tell business users about important changes.
Contact
Support: support@tapa.chat
Enquiries: hello@tapa.chat