Privacy Policy

This policy applies to the mobile app TapAlive and to this website. It explains which personal data we process, for which purposes and on what legal basis.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. General information

We process personal data exclusively in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). We only collect data that is necessary to operate the app and to provide the functions you have chosen.

TapAlive can be used without a user account. Neither registration nor an email address is required.

3. What data we collect

3.1 Device data (collected automatically)

• Anonymous device ID (UUID): generated locally on your device on first launch and used to associate your settings. It contains no personal reference and is not combined with other identifiers.
• App version and operating system: for error analysis and compatibility checks.
• Expo push token: a technical identifier required to deliver push notifications to your device.

3.2 Data you enter

• First name (used to address you in alert messages)
• Age (optional)
• Phone number (for SMS verification and the buddy system)
• Emergency contacts (name and phone number)
• Check-in interval, reminders and message templates
• Theme setting (light / dark)

3.3 Location data (with consent, Art. 6 (1) (a) GDPR)

Location data is collected exclusively during an SOS or a check-in. With a Premium subscription, location updates are additionally sent every 30 seconds while an SOS is active.

No location data is collected in the background while the app is closed. Consent to the use of location data can be withdrawn at any time in your device settings or in the app.

3.4 Audio (Premium, optional)

If you enable this function, a recording of up to 60 seconds is made during an active SOS and transmitted to your emergency contacts. Recordings are deleted after 30 days. No recording takes place at any time without an active SOS.

3.5 Battery status

Your battery level is evaluated for the buddy function. If it falls to 10 % or below, your buddy receives a push notification – at most twice per day. The function can be disabled at any time.

3.6 Phone contacts (with consent)

If you import emergency contacts from your address book, the name and phone number of the selected contact are transferred. There is no disclosure to third parties and no full synchronisation of your address book.

3.7 Subscription data

Payment is processed through the Apple App Store or Google Play. Through the service provider RevenueCat we receive only the subscription status (active / inactive, plan, expiry date). We do not receive credit card details or other payment data.

4. When you visit this website

When you access this website, the hosting provider automatically processes server log data:

• IP address (anonymised where possible)
• date and time of access
• the page or file requested
• HTTP status code
• referrer (previously visited page)
• browser, operating system and language setting

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the technically faultless and secure operation of the website. This data is not merged with other data sources.

5. Purposes and legal bases

Where processing is based on your consent, you may withdraw it at any time with effect for the future (Art. 7 (3) GDPR). The lawfulness of processing carried out before the withdrawal remains unaffected.

6. Contacting us

If you write to us by email or through the contact form, we process your details in order to handle your enquiry and any follow-up questions. The legal basis is Art. 6 (1) (b) GDPR, or Art. 6 (1) (f) GDPR for general enquiries without a contractual context.

We delete this data as soon as the purpose for storing it ceases to apply, unless statutory retention obligations prevent this.

7. Recipients and sub-processors

We use carefully selected service providers with whom data processing agreements under Art. 28 GDPR are in place:

8. Payment processing

Payments are processed by external service providers – in particular Apple and Google, where applicable supplemented by PayPal or Stripe. These providers process payment data as independent controllers under their own privacy policies. Payment details such as credit card numbers are not transmitted to us.

9. Cookies

On this website we use only strictly necessary cookies or local storage entries that are required for the site to work – for example to remember your theme choice and your cookie decision. No consent is required for these (sec. 25 (2) TDDDG).

Optional cookies for audience measurement or marketing are set only with your express consent (Art. 6 (1) (a) GDPR). Without consent, no tracking takes place. You can change or withdraw your decision at any time via the „Cookie settings“ link in the footer.

The app does not use cookies.

10. Retention periods

11. Your rights as a data subject

You have the following rights in relation to us:

• Access to the data we process about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)
• Lodging a complaint with a supervisory authority (Art. 77 GDPR)

The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW). Independently of this, you have the right to lodge a complaint with any supervisory authority in the place where you reside.

Requests regarding your rights can be sent informally to: kontakt@viraai.de

For the deletion of your data there is a dedicated page with step-by-step instructions and a request form: Delete account & data.

12. SSL/TLS encryption

For security reasons, this website and the app use SSL/TLS encryption. You can recognise an encrypted connection by the „https://“ prefix in the address bar and the padlock symbol. When encryption is active, the data you transmit to us cannot be read by third parties.

13. Children

Our service is not directed at persons under the age of 16. We do not knowingly collect personal data from children under 16. Should we become aware that such data has been transmitted to us, we will delete it without delay.

14. Updates to this policy

This privacy policy is dated June 2025. Further development of the app or changes in legal or regulatory requirements may make an update necessary. The current version is always available on this page.

15. Contact

If you have any questions about data protection, you can reach us at: kontakt@viraai.de