Privacy Policy

Last updated: October 2026

This policy explains how TapTapGoose collects and uses your personal data when you use our website and buy our cards. We are the data controller. We comply with UK data protection law (UK GDPR and the Data Protection Act 2018).

1. What we collect

Order details — your email address, delivery preferences, and the name and delivery address of the recipient you choose. (When you provide a recipient’s details, please make sure you’re happy to share them with us to fulfil your order; we use them only to produce and deliver that card.)
Waitlist — your email address, if you join our launch waitlist.
Your uploaded content — the video, voice message, or text you add to a card.
Payment information — handled by Stripe; we receive confirmation of payment but not your full card number.
Technical data — basic information your browser sends (e.g. IP address) and cookies needed to run the site.

2. How & why we use it

To create, produce, and deliver your order (performance of our contract with you).
To host your message and make it available to your recipient for the storage period you chose.
To send you service emails such as order confirmations (performance of contract).
To send optional reminder emails, only if you opt in (consent, which you can withdraw at any time).
To tell you when we launch, and now and then about new designs and offers, only if you join our waitlist or opt in at checkout (consent, which you can withdraw at any time with the unsubscribe link in every email).
To meet legal obligations and to prevent fraud or misuse (legitimate interests / legal obligation).

3. Who we share it with

We only share data with providers that help us run the service, including:

Stripe — payment processing.
Cloudflare — secure storage of your uploaded media.
Resend — sending our emails.
Delivery partners (e.g. Royal Mail) — to post your card.

We do not sell your personal data.

4. International transfers

Some of our providers process data outside the UK (for example, our email and payment partners may use servers in the United States). Where personal data is transferred outside the UK, we rely on appropriate safeguards recognised under UK data protection law — such as the UK International Data Transfer Agreement / Addendum or an adequacy decision — so your data remains protected.

5. How long we keep it

Your uploaded message stays available to your recipient for the storage period you select at checkout. After that period it becomes eligible for deletion. We remove expired media periodically, so deletion may not be immediate, and in some cases we may retain it for a limited further time for operational, backup, or legal reasons. We do not keep personal data for longer than we reasonably need to. Order and transaction records are retained for as long as necessary to run the business and to meet legal and accounting obligations.

6. Your rights

You have the right to access, correct, or delete your personal data, to object to or restrict certain processing, to data portability, and to withdraw consent. To exercise any of these, contact us at contact@taptapgoose.com. You also have the right to complain to the UK Information Commissioner’s Office (ICO).

7. Cookies

We use only the cookies necessary to operate the site (for example, to keep your basket and session working). We do not use them to track you across other websites.

8. Changes to this policy

We may update this policy from time to time. Any changes will appear on this page with a revised “last updated” date, so please check back occasionally.

9. Contact

For any privacy question, email contact@taptapgoose.com.