Privacy Policy

Last updated: 9 October 2026

eTap is a brand of Ethos Concepts, based in Nairobi, Kenya. This policy explains what personal data we collect when you use eTap, why we collect it, who we share it with, and the rights you have under the Kenya Data Protection Act, 2019.

Who we are

Ethos Concepts is the data controller for eTap. You can reach us by email at print@ethosconcepts.co.ke or on WhatsApp at +254 141 026 985.

What we collect

Your account email address and password (the password is handled by our sign-in provider; we never see it in plain text)
The details you put on your card: name, position, company name, phone numbers, email addresses, websites, social media links, and an optional address
Profile photos, cover photos, and logos you upload
Payment records: the M-Pesa phone number used to pay and the M-Pesa receipt number, or the email and Paystack reference for card payments
Optional eTIMS invoice details you enter at checkout: company name and KRA PIN
Card view statistics, described under Cookies & Website Analytics below

We never receive or store your bank card number. Paystack handles it directly.

Why we use it

To create your account, build and publish your card, take payment, and produce and deliver your physical card. This is needed to perform our contract with you.
To prevent fraud and abuse, keep the service secure, and show you how often your card is viewed. These are our legitimate interests.
To keep payment and tax records. This is a legal obligation.
To send service emails such as order confirmations and renewal reminders. We do not send marketing messages unless you have agreed to receive them.

Your public card

Your card is public by design. On the Dynamic plan, anyone with the link, QR code, or NFC card can open your card page. On the Static plan, your contact details are stored inside the QR code itself. Either way, anyone who scans it can see and save the details you choose to add, so only add information you are happy to share.

Who we share it with

We do not sell your data. We share it only with the service providers that run eTap for us:

Supabase: account sign-in, our database, and storage of the photos and logos you upload
Vercel: hosting the website and keeping server logs
Upstash: rate limiting, card view counts, and short-lived locks that stop duplicate payments
Safaricom (M-Pesa Daraja): processing M-Pesa payments
Paystack: processing card payments
Resend: sending order, approval, and renewal emails

If you choose to upload your own card design, you send the files through a Google Form, so Google also processes those files. We may also disclose data where Kenyan law requires it.

International transfers

Supabase, Vercel, Upstash, and Resend store or process data on servers outside Kenya. We rely on the contractual data protection commitments these providers give their customers to keep your data safe.

How long we keep it

Account and card data: for as long as your account is active.
Payment records: for 7 years, to meet tax record-keeping rules.
Your public card page: visible until the card is archived or, on the Dynamic plan, the subscription and grace period end.
Daily view statistics: about 90 days.

How we protect it

All traffic uses HTTPS. Your account is protected by sign-in, and only you and our admins can change your card. Payments are confirmed with M-Pesa and Paystack before an order is accepted, and requests are rate limited to block abuse.

Your rights

Under the Kenya Data Protection Act, 2019 you have the right to:

Access the personal data we hold about you
Correct data that is wrong or out of date
Ask us to delete your data
Object to how we use your data
Receive your data in a portable format

To use any of these rights, email print@ethosconcepts.co.ke. If you are not happy with our response, you can complain to the Office of the Data Protection Commissioner (ODPC).

Children

eTap is not for anyone under 18, and we do not knowingly collect their data.

Cookies & Website Analytics

We only use storage that the site needs to work. When you sign in, your session is kept in your browser's local storage, and we cache your card draft there so your edits are not lost. We do not use advertising cookies and we do not use any third-party analytics tools.

Card view statistics

When someone opens a public card page, we record:

A daily view count for that card
The device type (for example iPhone or Android), worked out from the browser's user agent
A one-way hash of the visitor's IP address, used to count unique visitors per day and to link a Save Contact tap to a view. We never store the IP address itself, and the hash used to link a Save Contact tap expires after 24 hours.

These statistics are shown to the card owner and our admins as totals only.

Billing & Payments

M-Pesa payments are processed by Safaricom. We keep the paying phone number and receipt number.
Card payments are processed by Paystack. We keep the payment reference and email, never the card number.
We only store a KRA PIN and company name if you enter them to get an eTIMS invoice.
All prices are in Kenya Shillings and include 16% VAT.

See our Refund Policy for refunds and duplicate payments.

Information Management

Edit your card details at any time from your dashboard.
Manage your account details from the Account page.
To delete your account or a paid card, or to get a copy of your data, email print@ethosconcepts.co.ke. We may ask you to confirm your identity first. Payment records we must keep for tax purposes are retained as described above.