Privacy policy

Last updated 29 October 2026

tapla is built to keep as little as possible. This page says what we do keep, why, who helps us with it, and how you get it deleted.

Who is behind tapla

tapla is run by JM Band ApS, Danish company registration (CVR) 41840943, Axel Gruhns Vej 10M, 8270 Højbjerg, Denmark. If you have questions about your data, write to contact@tapla.io or call +45 89 86 49 88.

Who is responsible for your data depends on how you use tapla:

• If you visit tapla.io, write to us or have an account for a venue, we are the controller.
• If you are a guest in a cloakroom that uses tapla, the venue is the controller. We are the venue's processor, and we only handle your data on the venue's instructions and under a data processing agreement with it.

When you write to us

The contact form asks for your name, your email, a message and, if you like, the name of your venue. When you send it, all of it goes to our inbox as an email through the mail service Resend. The form does not store the message on our server.

We use the email to answer you, and to help you get started if you become a customer. We delete it when we no longer need it.

To stop abuse we count how many messages come from the same IP address. Five an hour can be sent. The counter is kept in our database with the IP address as its key.

We may do this because we have a legitimate interest in answering the people who write to us (Article 6(1)(f) of the GDPR).

Venue accounts

Login is handled by Clerk. Clerk creates your user and looks after the password, which we never see. On our side we keep your email, your role (for example owner or staff), which venue you belong to, and what you tell us about the venue yourselves, such as company name, address, VAT number, contact person and phone number.

If you invite a colleague, we keep their email with the invitation. If you send feedback or a bug report from the dashboard, we keep the text, any screenshot and who sent it. Bug reports also go to our internal channel on Discord, so we can react quickly.

We use this to give you access, run the system and help you. The basis is our agreement with you (Article 6(1)(b)). We keep it for as long as the account exists. If you close the account, we delete it, unless bookkeeping law requires us to keep something for longer.

Guests in the cloakroom

Here the venue decides, and tapla is the processor. This is how it works today:

• The phone number. When you take a tag, you type your phone number. It is used to make sure that you are the one who gets the coat back. The number is stored encrypted. Staff can see it while the coat is hanging and use it to find your ticket.
• After pickup. When the coat has been handed out, or staff reset the tag, the number is removed from the tag.
• The venue's log. Each time something happens to a ticket, the system writes a line in the venue's log, for example that the tag was taken or the coat collected. The venue uses the log to see revenue and how busy it was. Today the log also keeps an encrypted copy of the phone number and, when you take the tag, your IP address. The venue's owner and admins can export the log with the numbers. The log is not deleted automatically.
• Your phone. The ticket opens in your phone's browser. So that only your phone can see the private part of the ticket, the browser stores a random id for it. If you pick a language, the browser remembers that too. This stays on your phone and is not a cookie.
• Wallet. If you save the ticket to Apple Wallet or Google Wallet, the ticket with the venue's name and the ticket number goes through Apple or Google. For Apple Wallet we keep a technical address for your phone so the ticket can be updated. It is deleted when the next guest takes the tag.
• Payment. If you pay in the queue, it happens at Stripe. Card details go straight to Stripe and never pass through us. We keep the amount, the status and Stripe's reference, so the venue can do its settlement.

To see or delete data from a visit, contact the venue. If you write to us, we pass your request on to the venue.

Suppliers who help us

These suppliers handle data on our behalf and only under an agreement with us:

• Vercel runs the website and the system.
• Neon runs the database where accounts, tags and logs are kept.
• Clerk handles login for venues.
• Stripe handles payment in the queue and payouts to the venue.
• Resend sends the email from the contact form to us.
• Discord receives bug reports from the dashboard in our internal channel.
• File storage for screenshots in bug reports and the venues' logos on the tickets.
• Apple and Google, but only when a guest saves the ticket to Wallet.

Several of them are American companies. When data leaves the EU, it does so under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Cookies

We use no cookies for statistics or marketing, and there is no tracking from Google, Meta or anyone else on the pages. That is why we do not ask for your consent. The front page and the contact page set no cookies.

The cookies we do use are needed for login to work:

• Clerk's login cookies, including __session and __client_uat, keep you logged in to the dashboard. They are set when you log in or create an account.
• tapla_tenant remembers which venue you chose last, if you have access to more than one. It lasts 30 days.
• session is only used for the tapla team's own admin login and lasts 12 hours.

The dashboard also remembers your language and how far you have got with the setup, in the browser's local storage. The guest's ticket uses no cookies, only the local storage on the phone described above.

Your rights

You have the right to see the data we hold about you, and to have it corrected or deleted. You can also ask us to restrict its use, object to it, or have the data handed over so you can take it somewhere else. Write to contact@tapla.io.

If you are unhappy with how we handle your data, you can complain to the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk, or to the authority where you live.

Changes

If we change anything on this page, we update the date at the top.