Privacy Policy

SwfTap is operated by Avatar Studios (ABN 52 892 132 207), a sole trader based in New South Wales, Australia. In this policy, “we”, “us” and “our” mean that business. SwfTap gives people and businesses dynamic QR codes and short links, digital business-card profiles that NFC cards open, lead and booking forms on those profiles, and Secure Share for sending documents behind a password.

This policy explains what personal information we handle, why, who we share it with, and the choices you have. We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) in full, whether or not the small business exemption in that Act would otherwise apply to us.

You can reach us about anything in this policy at hello@swftap.com or the contact form (choose “Privacy request”). We aim to respond within 30 days.

Our customers are the people and businesses who sign up for SwfTap. For their account details, billing and use of the service, we decide what is collected and why, and this policy applies to us directly.

Our customers also collect information from their own audiences through SwfTap: the visitors who view their profiles or scan their QR codes, people who fill in their lead or booking forms, and people they send documents to. For that information the customer is the collector, and their own privacy policy governs what they do with it. We store and process it on their behalf. Section 11 explains what we do for those people.

From customers

• •Account details: your name, email address, password (stored only as a secure hash by our sign-in provider), two-factor authentication settings, and, if you choose to sign in with Google, the name and email address Google shares with us.
• •Workspace content: everything you put into SwfTap, such as link destinations, QR designs, profile text, photos, contact details and links, NFC card assignments, uploaded documents, and the names and email addresses of colleagues you invite.
• •Orders and billing: your plan, invoices, and for hardware orders the delivery name, address and phone number. Card payments are handled by Stripe, which gives us only the card brand, last four digits and expiry date. We never see or store full card numbers.
• •Connected accounts: if you connect Google Calendar, Calendly, Mailchimp, Klaviyo or Stripe, we keep the access tokens needed to act for you, encrypted, and the account name or email the provider gives us.
• •Messages: what you send us through the contact form or by email, and our replies.
• •Notes, places and reminders: the notes and checklists you write (on the web or in the SwfTap app), which of your contacts, places, Briefcase items and Moments each note is linked to, its colour, tags and pin, the places you save (a name, an address if you add one, the map point and a radius), and your reminder settings (times and repeats, and for reminders you set up in the app, which place or which contact they are for and which signals you chose). Notes are personal to you: other members of your workspaces can’t see them. Notes about other people are yours to keep responsibly; we store them on your instruction, as we do your contacts.
• •What stays on your phone: reminders by place, call, message or calendar are matched on your phone. SwfTap does not upload or keep your location history, never reads or stores the text of your messages, never records calls, and does not upload phone numbers, message details or calendar events for this. Only the places you choose to save, and your notes and reminder settings, are stored with your account.

From people who use our customers’ pages and links

• •Scan, click and view analytics: when someone scans a QR code, opens a short link or views a profile, we record the time, the type of device, the referring website, and an approximate location (country, region and city) worked out from the IP address. We look the location up in a geolocation database on our own servers and do not store the IP address with the event.
• •Lead and booking forms: whatever the form asks for, typically a name, email address, phone number and message, plus the requested time for a booking.
• •Email sign-up blocks: the email address, which is passed straight to the customer’s Mailchimp or Klaviyo account.
• •Secure Share recipients: recipients do not need an account and we do not ask who they are. Each share page says that opens and reading activity are shared with the sender. For each visit we record when the share was opened and for how long, an approximate location (city, region and country), the type of device, browser and operating system, the website that linked to it (its name only, not the full address), whether the password was entered and how many wrong attempts were made, which documents were viewed or downloaded, and how long each page was on screen. The location comes from our hosting provider, Vercel, which works it out from the IP address as the page is delivered; we never store the IP address. Visits are tied to random identifiers: one for the browser tab and one kept in that browser for that share only, so a return visit can be recognised. These identifiers are not shared between shares or senders. The sender sees all of this in a report, can download it, and can choose to be emailed when the share is first opened and a daily summary. Passwords entered to open a share are checked and not stored.

From everyone

• •Site analytics: Google Analytics records how pages on swftap.com are used (pages viewed, approximate location, device and browser), using cookies. See section 6.
• •Security data: IP addresses are used briefly to rate-limit public forms and sign-in, and reCAPTCHA assesses whether a form submission came from a person. Error reports may include the page, browser and the error that occurred.

You can browse our public pages without telling us who you are. You can’t use an account without giving us an email address, because we need it to sign you in and reach you about the account.

We use personal information to:

• •run the service: create and redirect your links and QR codes, host your profiles, deliver shared documents, and pass on the forms your visitors complete;
• •show customers the analytics, leads, bookings and Secure Share activity for their own content;
• •take payments, issue tax invoices, and ship hardware orders;
• •send service emails, such as receipts, invitations, security notices, payment problems and order updates;
• •send the weekly activity digest, if you turn it on;
• •answer enquiries and support requests;
• •keep the service secure: block spam, phishing and malicious links, scan uploads for malware, prevent fraud and abuse, and investigate problems;
• •understand how the website is used so we can improve it; and
• •meet our legal obligations, including tax record-keeping.

We do not sell personal information, and we do not use the content or audience data in a customer’s workspace to advertise to anyone. We use information only for the purpose we collected it for, a related purpose you would reasonably expect, or where the law allows or requires it.

Service emails about your account (receipts, invitations, security and billing notices) are part of running the service, so they continue while your account is open.

We send marketing or optional emails only with your consent, in line with the Spam Act 2003 (Cth). Each one identifies us and includes a working unsubscribe link, and we act on an unsubscribe within five business days. The weekly digest is off until you switch it on, and you can turn it off from its unsubscribe link or under Settings, Notifications.

Reminder emails for your notes are sent only for reminders you mark “Email me”. Each one has a link that stops all reminder emails, and you can turn them back on (or off) in Notes.

We use a small number of cookies and similar browser storage:

• •Essential: keeping you signed in, remembering which workspace you have open, and remembering that you have unlocked a password-protected share. The service doesn’t work without these.
• •Secure Share visits: a share page keeps a random identifier in your browser’s storage for that share only, so its sender can tell a return visit from a new viewer. Clearing your browser’s site data removes it.
• •Security: Google reCAPTCHA sets cookies and reads device information on pages with protected forms. Google’s privacy policy applies to that information.
• •Analytics: Google Analytics sets cookies to tell visits apart and measure how pages are used, including our customers’ public profile and share pages. We look at the reports in aggregate and do not use them to identify individuals or for advertising.

You can block or delete cookies in your browser settings, and opt out of Google Analytics with Google’s opt-out browser add-on. Blocking essential cookies will stop you signing in.

We share personal information only with the service providers we use to run SwfTap, and only what each one needs for its job:

Approximate locations for scans, clicks and profile views are worked out with MaxMind’s GeoLite2 database, which runs on our own servers, so no IP address is sent to MaxMind. For Secure Share visits, the approximate location comes from Vercel as it delivers the page. Either way, we store the location and not the IP address.

Connectors a customer switches on. A customer can connect their own accounts with other services to a profile, or have new leads posted to their own Slack or Microsoft Teams channel. When they do, the information below goes to that customer’s account with the provider, under the customer’s own agreement with it:

• •Google Calendar: a visitor's name, email and chosen time when they book through a profile (United States and other countries).
• •Calendly: booking details the visitor enters in the Calendly scheduler (United States).
• •Mailchimp: the email address a visitor submits to an email sign-up block (United States).
• •Klaviyo: the email address a visitor submits to an email sign-up block (United States).
• •Stripe (the customer's own account): payment details for a purchase made from a profile's buy button (United States and other countries).
• •Google Wallet: the profile details on a pass, when a visitor adds a profile to Google Wallet (United States and other countries).
• •Slack: a new lead's name, email, phone, company, message and the form it came from, posted to the Slack channel the customer set up an incoming webhook for (United States and other countries).
• •Microsoft Teams (Power Automate): the same lead details, posted to the Teams channel of the customer's own Workflow (the customer's Microsoft 365 region, which may be outside Australia).

Things you choose to share. Profiles, links and shares are designed to be seen by whoever you give them to, and members of a team workspace can see that workspace’s content. That is the service doing what you asked, not a disclosure by us.

We may also disclose information when the law requires it (for example, a court order), to protect someone’s safety, to investigate fraud or abuse, or to a buyer of the business, who would be bound by this policy.

Your account data, workspace content and uploaded documents are stored in Australia (Sydney). Some of our providers process information outside Australia, as the table in section 7 shows, mainly in the United States. Uploaded files are checked for malware on our own scanning server in India; they are scanned in memory and not stored there. Google, Stripe and Vercel may also process information in other countries where they or their own providers operate.

Before using a provider we check how it protects personal information, and we remain accountable under the Privacy Act for how these providers handle information we disclose to them.

• •All traffic to SwfTap is encrypted in transit (HTTPS).
• •Every request for workspace data is checked on our servers against workspace membership and role, so one customer can't see another's data.
• •Connected-account tokens are encrypted at rest (AES-256-GCM), and Secure Share passwords are stored only as salted hashes.
• •Two-factor authentication is available for every account.
• •Uploaded documents are scanned for malware, and recipients are warned about any file that has not been scanned.
• •Privileged administrative actions are recorded in an audit log.

No system is perfectly secure. If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

• •Your account: while it is open. You can delete it at any time from Settings. Your profiles, links, documents, leads, bookings and analytics are removed straight away, and any remaining copies in backups and logs are gone within 30 days. In a team workspace, the links, documents and shares you created stay with the workspace and pass to another member, and profiles assigned to you there are deleted.
• •Billing and order records: 7 years after the transaction, as Australian tax law requires, even after an account is deleted.
• •Analytics, leads and bookings: for as long as the customer keeps the workspace, profile or form they belong to, so the customer has their history.
• •Notes, places and reminders: until you delete them. When you delete a note, place or reminder its content is erased straight away; an empty marker (no text, links or places) stays for up to 30 days so your other devices remove it too, then it is deleted. Everything goes when you delete your account.
• •Rate-limit records: no more than 24 hours.
• •Contact messages: as long as we need them to deal with your enquiry and keep a record of it.

When we no longer need personal information for any lawful purpose, we delete it or remove anything that identifies you.

If you submitted a form on a profile, booked a meeting through one, received a document through Secure Share, or scanned a customer’s QR code, the business or person behind that page decided to collect that information. They are responsible for telling you how they use it, and for answering requests to access, correct or delete it, so please contact them first. Their contact details are usually on the page itself.

Our part is to store that information securely, keep it separate from every other customer’s, use it only to provide the service to that customer, and require our customers to collect it lawfully (see our Terms of Service). If you can’t reach the customer, or you think a page is collecting information unlawfully or is a scam, contact us at hello@swftap.com or the contact form (choose “Privacy request”). We will pass your request on, help the customer respond, and can disable the page if it breaches our terms.

You can see and correct most of your information yourself in the app, and download a copy of your account data from Settings. For anything else, ask us at hello@swftap.com or the contact form (choose “Privacy request”). We will need to confirm who you are before we release information, and we will respond within 30 days. We don’t charge for a request. If we refuse one, which the Privacy Act allows only in limited cases, we will explain why in writing and tell you how to complain.

If you think we have mishandled your personal information, please tell us at hello@swftap.com or the contact form (choose “Privacy request”), with enough detail for us to look into it. We will acknowledge your complaint within 7 days and aim to give you a full answer within 30 days.

If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

We will update this policy when what we collect or how we use it changes, and change the “last updated” date at the top. If a change is significant, we will email account holders before it takes effect.

Privacy questions and requests: hello@swftap.com or the contact form (choose “Privacy request”). Anything else: our contact page.

SwfTap is operated by Avatar Studios (ABN 52 892 132 207), New South Wales, Australia.