Privacy Policy

Effective Date: March 25, 2026 · Last Updated: March 25, 2026

1. Introduction

TAC Service ("we", "us", "our") operates the TAC Service mobile application (the "App"), a point-of-sale terminal that enables merchants to accept contactless card payments via Stripe Terminal (Tap to Pay on iPhone and Tap to Pay on Android).

This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our App. By using TAC Service, you agree to the practices described in this policy.

If you have questions about this policy, contact us at privacy@tablecoin.com.

2. Data We Collect

2.1 Account Data

When you sign in with Google or Apple, we receive and store:

• Email address
• Display name
• User identifier (unique ID from your sign-in provider)

2.2 Payment and Transaction Data

When you process payments through the App, we collect:

• Transaction amounts (in USD or EUR)
• Transaction timestamps
• Payment intent identifiers (Stripe reference IDs)
• Tip amounts and platform fee amounts
• Currency selection

Important: TAC Service never processes, stores, or transmits raw credit or debit card numbers. All card interactions are handled entirely by the Stripe Terminal SDK, which is PCI DSS Level 1 certified.

2.3 Stripe Merchant Data

If you onboard as a merchant, we store:

• Your Stripe connected account ID
• Bank account connection status (active, pending, or action required)
• Payout eligibility status

2.4 Device Data

Through Firebase (Google's mobile platform), the following may be collected:

• Device type and operating system version
• App version
• Firebase installation identifier

2.5 Locally Stored Data

The following data is stored only on your device and is never transmitted to our servers:

• Authentication tokens (JWT access and refresh tokens) -- stored in encrypted secure storage (iOS Keychain / Android EncryptedSharedPreferences)
• App configuration preferences (currency, simulated mode setting)
• Terms acceptance status

3. How We Use Your Data

• Account management: To create and maintain your account, authenticate your identity, and restore your session.
• Payment processing: To create payment intents, process contactless card payments, and calculate platform fees on your behalf through Stripe.
• Merchant onboarding: To facilitate your Stripe connected account setup and monitor your payout eligibility.
• Transaction records: To display your payment history within the App.
• Customer support: To respond to your inquiries and troubleshoot issues.
• Legal compliance: To meet financial record-keeping obligations and respond to lawful requests.

4. How We Share Your Data

We do NOT sell your personal data. We do not share your data for advertising or marketing purposes.

5. Data Retention

• Account data: Retained as long as your account is active. Deleted upon account deletion request.
• Transaction data: Retained for 7 years from the transaction date, as required for financial record-keeping under US tax and accounting regulations.
• Authentication tokens: Stored locally on your device. Cleared when you sign out or delete the App.
• Device identifiers: Retained by Firebase per Google's data retention policies.

6. Data Security

• All network communication uses HTTPS (TLS encryption). The App rejects plain HTTP connections in production.
• Authentication tokens are stored in platform-specific encrypted storage (iOS Keychain, Android EncryptedSharedPreferences).
• We never handle raw card data -- all payment card processing occurs within the PCI DSS Level 1 certified Stripe Terminal SDK.
• Backend access tokens expire after 1 hour and are automatically refreshed.

7. Your Rights

7.1 All Users

• Access: You may request a copy of the personal data we hold about you.
• Correction: You may request correction of inaccurate data.
• Deletion: You may request deletion of your account and associated data by contacting us at privacy@tablecoin.com. In-app account deletion will be available in a future update.

7.2 European Economic Area (GDPR)

If you are located in the EU/EEA, you have additional rights under the General Data Protection Regulation:

• Right to data portability (receive your data in a structured, machine-readable format)
• Right to restrict processing
• Right to object to processing
• Right to lodge a complaint with your local data protection authority

Our legal basis for processing your data is: (a) performance of a contract (payment processing), (b) legitimate interest (account management, security), and (c) your consent (where applicable).

For GDPR inquiries, contact: privacy@tablecoin.com.

7.3 California Residents (CCPA)

If you are a California resident, you have the right to:

• Know what personal data we collect and how it is used
• Request deletion of your personal data
• Opt out of the sale of personal data (we do not sell personal data)
• Non-discrimination for exercising your privacy rights

8. Children's Privacy

TAC Service is not directed at individuals under the age of 13 (or 16 in the EU). We do not knowingly collect personal information from children. If we learn that we have collected data from a child, we will delete it promptly.

9. Third-Party Services

Our App integrates with the following third-party services, each governed by their own privacy policies:

• Stripe -- Payment processing
• Google / Firebase -- Authentication and mobile platform services
• Apple -- Sign In with Apple authentication

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page and notify you through the App. Your continued use of TAC Service after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

TAC Service
Email: privacy@tablecoin.com