Privacy Policy

Effective Date: May 28, 2026 · Last Updated: May 28, 2026

TIP TAP WORLD LLC, an Arizona limited liability company ("TipTap World," "we," "us," or "our"), operates the TipTap World service available at https://tiptap.world (the "Service"). This Privacy Policy describes the personal information we collect, how we use and disclose it, the choices and rights you have with respect to that information, and how to contact us. This Privacy Policy is incorporated into and forms part of our Terms of Service. By accessing, registering for, or using the Service, you agree to the practices described in this Privacy Policy.

1. Scope and Applicability

This Privacy Policy applies to personal information processed by TipTap World in connection with the Service, including our website, web application, NFC and QR code workflows, SMS communications, and related support channels. It does not apply to information collected by third-party services we rely on to deliver the Service (notably Stripe, Inc. for payments and identity verification, and Twilio, Inc. for SMS delivery), each of which is governed by its own privacy notice. We identify those providers throughout this Policy and link to their privacy notices where appropriate.

2. Information We Collect

2.1 Information You Provide

When you create an account or use the Service, we collect:

• Account information: your name or display name, email address, password (stored as a one-way hash), and account role (tipper or worker).
• Phone number: required for workers who receive tips and for users claiming tips; optional for tippers who do not wish to receive transactional SMS. Phone numbers are used for verification, tip claim links, and the other categories described in Section 5.
• Identity verification data: for workers, we facilitate identity verification through Stripe Identity, which may collect a government-issued photo identification, a live selfie, date of birth, and the last four digits of your Social Security Number (or equivalent) to comply with US Know-Your-Customer ("KYC") and anti-money-laundering ("AML") regulations. Raw verification documents are processed and stored by Stripe; we receive only verification status and minimal metadata.
• Bank account or debit card information: for workers to receive payouts via Stripe Connect. This information is processed and stored by Stripe; we do not store full bank account or card numbers.
• Tipper payment method information: credit, debit, or other supported payment credentials, tokenized by Stripe. We store the last four digits, brand, and expiration of a payment method to display it to you, but we do not store full payment card numbers.
• NFC tag and QR code identifiers: the unique identifiers associated with NFC tags or QR codes registered to a worker; identifiers are encrypted at rest.
• Profile content: any optional display photo, biography, or service description you choose to include on your public-facing profile.
• Communications you send us: support inquiries, feedback, dispute submissions, and any other messages you send to us.

2.2 Information Collected Automatically

• Device and connection data: IP address, approximate location (derived from IP), browser type and version, operating system, device identifiers, screen resolution, language preference, and referring/exit URLs.
• Usage data: pages and screens viewed, features used, links clicked, session duration, and timestamps.
• Cookies and similar technologies: we use essential cookies for authentication, session continuity, and security. We use a small number of first-party analytics cookies to measure aggregate usage. We do not use third-party advertising cookies, cross-site tracking pixels, or session-replay tools.
• Transaction metadata: tip amounts, currency, fees, timestamps, parties to the transaction, and outcome (success, refund, dispute, chargeback).
• Log and security data: request logs, error reports, authentication attempts, and other data necessary to detect, investigate, and prevent fraud, abuse, and security incidents.

2.3 Information From Third Parties

We may receive information from third-party providers acting on our behalf, including verification outcomes from Stripe Identity, payout and dispute status updates from Stripe Connect, SMS delivery receipts and STOP/HELP keyword events from Twilio, and information from anti-fraud and risk-scoring services we may use to protect the platform.

3. How We Use Information

We use the information we collect to:

• Provide, operate, maintain, and improve the Service, including processing tips, payouts, and refunds.
• Authenticate users and secure accounts (passwords, verification codes, suspicious-activity detection).
• Verify worker identity via Stripe Identity for legal compliance, payout eligibility, and fraud prevention.
• Send transactional SMS communications as described in Section 5.
• Send service-related emails, such as receipts, payout confirmations, account notices, and material changes to these legal terms.
• Detect, investigate, prevent, and address fraud, security incidents, prohibited or illegal activity, and violations of our Terms of Service.
• Respond to support inquiries and communicate with you about your account or transactions.
• Comply with legal obligations, including tax reporting (e.g., IRS Form 1099-K), responding to lawful requests from regulators or law enforcement, and resolving disputes.
• Generate aggregated or de-identified analytics to understand usage and improve the Service. De-identified data is not used to re-identify individuals.

4. Legal Bases for Processing (EEA/UK)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, our processing of your personal information is based on one or more of the following legal bases under the EU and UK General Data Protection Regulations ("GDPR"):

• Performance of a contract with you (e.g., to create your account, process tips, and deliver payouts).
• Compliance with a legal obligation (e.g., KYC/AML, tax reporting, responding to lawful requests).
• Our legitimate interests (e.g., securing the Service, preventing fraud, improving the Service), where those interests are not overridden by your rights and interests.
• Your consent, where we ask for it (e.g., opt-in to transactional SMS). You may withdraw consent at any time without affecting prior processing.

5. SMS and Text Message Communications

This section governs all SMS messages sent to or received from the phone number you register with TipTap World. Our SMS gateway provider is Twilio, Inc.

Opt-in. You opt in to receive transactional SMS messages from TipTap World by affirmatively checking the SMS consent checkbox during account signup, on the dedicated SMS opt-in page within the Service, or by replying to claim a tip sent via NFC, QR code, or phone-number entry. Providing a phone number to us alone does not constitute consent; an affirmative opt-in is required.

Categories of messages we may send:

• Account verification codes — one-time passcodes sent to confirm signup, login, or phone-number changes (typically 1 message per request).
• Tip claim links — sent to a worker when a tipper sends a tip via NFC, QR code, or direct phone-number entry, allowing the worker to claim the tip (1 message per tip).
• Tip received notifications — sent to a registered worker when a tip is successfully credited to their account (1 message per tip).
• Welcome messages — a one-time message confirming account activation for new workers.
• Payout confirmations — sent to workers when funds are transferred from their TipTap World balance to their bank account (1 message per payout).

Frequency. Message frequency varies based on your activity. A typical worker may receive between 1 and 10 messages on an active day; a tipper typically receives only verification messages. Frequency may be higher during peak activity or onboarding.

Cost. Message and data rates may apply per your mobile carrier's plan. TipTap World does not charge you for sending or receiving messages, but your carrier may.

Opt-out (STOP). You may opt out at any time by replying STOP, UNSUBSCRIBE, CANCEL, END, or QUITto any SMS message from TipTap World. You will receive one final confirmation that you have been unsubscribed, and we will not send you further SMS messages from that originating long code or short code. You may re-subscribe at any time by opting back in within the Service. Opting out of SMS may impair core functionality of the Service (for example, you will not be able to claim tips that require an SMS claim link).

Help (HELP). Reply HELP, INFO, or SUPPORT to any TipTap World message to receive a reply identifying TipTap World as the sender, the support email address support@tiptap.world, and a link to this Privacy Policy and our Terms of Service.

No sale or sharing of phone numbers. TipTap World does not sell, rent, lease, or share phone numbers with any third party for that third party's own marketing, advertising, or promotional purposes. Phone numbers are used solely to deliver the Service and the SMS categories described in this section. Phone numbers and related SMS consent records are shared only with our SMS gateway provider, Twilio, Inc., and only as strictly necessary to deliver these transactional messages on our behalf.

Supported carriers. SMS is delivered through major US mobile carriers, including AT&T, Verizon, T-Mobile, US Cellular, and their resellers. Carriers are not liable for delayed or undelivered messages.

6. How We Share Information

We share personal information only with the categories of recipients listed below, and only as needed to provide the Service or as required by law.

• Payment processor: Stripe, Inc. processes payments, payouts, dispute resolution, and identity verification (Stripe Identity). Stripe's privacy notice is available at https://stripe.com/privacy.
• SMS gateway: Twilio, Inc. delivers SMS messages on our behalf. Twilio's privacy notice is available at https://www.twilio.com/legal/privacy.
• Cloud infrastructure providers: we use third-party cloud services (such as Vercel, Render, and Amazon Web Services) for application hosting, database storage, and operational logging. These providers are bound by contractual data protection obligations.
• Other users (limited): when a tipper sends a tip, the receiving worker may see the tipper's first name or display name and the tip amount. A worker's first name or display name (and optional public profile content) may be shown to tippers. Sensitive details such as full legal name, contact information, financial accounts, and identity documents are never shared between users.
• Professional advisors: our legal, accounting, audit, and insurance advisors, under duty of confidentiality.
• Legal, safety, and compliance: we may disclose information in response to lawful subpoenas, court orders, or governmental requests, or where we believe in good faith that disclosure is necessary to comply with law, enforce our Terms, prevent fraud, or protect the rights, property, or safety of any person.
• Business transfers: if TipTap World is involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to standard confidentiality protections. We will notify you of any change in ownership or use of your personal information.

We do not "sell" personal information for money, and we do not "share" personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA/CPRA").

7. Cookies and Tracking

We use only essential and first-party cookies. Essential cookies enable authentication, security, and the basic operation of the Service. First-party analytics cookies help us understand aggregate usage patterns. We do not use third-party advertising cookies, do not participate in cross-context behavioral advertising, and do not load tracking pixels from advertising networks. We honor the Global Privacy Control (GPC) browser signal as a valid opt-out request from users in jurisdictions that recognize it.

8. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information, including HTTPS/TLS encryption in transit, encryption of sensitive fields at rest, hashed passwords using industry-standard one-way functions, role-based access control on a need-to-know basis, audit logging, and regular vulnerability monitoring. Payment card data is processed and stored exclusively by Stripe, a PCI DSS Level 1 certified service provider. No system is perfectly secure; although we work hard to protect your information, we cannot guarantee absolute security and are not liable for unauthorized access beyond our reasonable control.

9. Data Retention

We retain personal information for as long as your account is active and as needed to provide the Service, comply with our legal obligations (for example, tax and financial records are typically retained for at least seven years from the end of the relevant tax year), resolve disputes, and enforce our agreements. When you delete your account, we delete or de-identify personal information that we are not required to retain by law, generally within 90 days of deletion, subject to ongoing legal, accounting, or fraud-prevention requirements.

10. International Data Transfers

TipTap World is operated from the United States, and our service providers may be located in the United States and other jurisdictions. If you access the Service from outside the United States, your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those of your jurisdiction. Where required by applicable law (for example, for EEA, UK, or Swiss residents), we rely on appropriate safeguards for cross-border data transfers, including the European Commission's Standard Contractual Clauses and equivalent UK and Swiss mechanisms.

11. Your Privacy Rights — General

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and obtain a copy in a portable format.
• Correct inaccurate or incomplete personal information.
• Delete your account and associated personal information, subject to legal retention requirements.
• Opt out of certain processing, including SMS (reply STOP) and any non-essential analytics where applicable.
• Withdraw consent where processing is based on consent, without affecting prior processing.
• Lodge a complaint with a data protection authority.
• Receive non-discriminatory treatment for exercising any of these rights.

To exercise any of these rights, email privacy@tiptap.world. We may need to verify your identity before fulfilling your request, and we will respond within the timeframes required by applicable law (typically 30–45 days, with one extension where permitted).

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the CCPA/CPRA provides you with specific rights regarding your personal information.

Categories of personal information we collect. Within the prior 12 months, we may have collected the following categories of personal information (as defined in California Civil Code §1798.140):

• Identifiers (name, email, phone number, IP address, account identifiers).
• Customer records (payment method information processed by Stripe, bank account information processed by Stripe, tip history).
• Commercial information (transaction history).
• Internet or network activity (device, browser, and usage data).
• Geolocation data (approximate, derived from IP address).
• Professional or employment-related information (for workers, where voluntarily provided).
• Sensitive personal information, limited to: government-issued identification numbers and identity documents (processed by Stripe Identity), and account login credentials. We use sensitive personal information only for the limited purposes permitted under CCPA/CPRA §7027 (such as providing the Service, security, fraud prevention, and legal compliance), and not to infer characteristics about you.

Sources, purposes, and recipients. The sources of this information are you, your device, and our third-party service providers (notably Stripe and Twilio). We collect this information for the business purposes described in Section 3. We disclose this information to the categories of recipients described in Section 6.

No sale; no sharing for cross-context behavioral advertising. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

Your California rights. Subject to verification of your identity, you have the right to: (a) know what personal information we have collected, used, disclosed, and (if applicable) sold or shared; (b) delete personal information we have collected, subject to exceptions; (c) correct inaccurate personal information; (d) opt out of any sale or sharing (not applicable, as we do not sell or share); (e) limit our use of sensitive personal information (we already limit such use as described above); and (f) receive non-discriminatory service for exercising your rights.

To exercise your California rights, email privacy@tiptap.world. You may also designate an authorized agent to make a request on your behalf, subject to verification.

13. European Privacy Rights (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights, subject to applicable exceptions: the right to access, rectify, erase, restrict processing of, and port your personal information; the right to object to processing based on our legitimate interests; the right to withdraw consent where processing is based on consent; and the right to lodge a complaint with your local supervisory authority.

Data controller. Unless otherwise specified, TIP TAP WORLD LLC is the controller of your personal information. Contact: privacy@tiptap.world.

International transfers. Personal information transferred from the EEA, UK, or Switzerland to the United States is protected by appropriate safeguards as described in Section 10.

14. Children's Privacy

The Service is intended for users 18 years of age or older. We do not knowingly collect personal information from individuals under 13 years of age (or under 16 in the EEA/UK). If we learn we have collected personal information from a child, we will delete it promptly. If you believe a child has provided us with personal information, please contact privacy@tiptap.world.

15. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service at least 30 days before the change takes effect, except where a shorter period is required by law. The "Last Updated" date at the top of this Policy reflects the most recent revision. Your continued use of the Service after the effective date of a revised Policy constitutes your acceptance of the revised terms.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

TIP TAP WORLD LLC
8058 E Aster Dr
Scottsdale, AZ 85260
Privacy: privacy@tiptap.world
Support: support@tiptap.world
Legal: legal@tiptap.world

For the legal terms that govern your use of the Service, see our Terms of Service.