OnlyTap

Privacy policy

What data we process when you use the OnlyTap app, what we use it for and what rights you have.

November 2026

This is a translation of the Spanish original. If the two differ, the Spanish version prevails.

Who
Volcano MKT (Miguel Monterrey Varela, sole trader, tax ID 42192719R), which provides the OnlyTap service. You can write to us at hola@onlytap.es.
What for
To provide the service, charge for it, handle support and keep it secure.
On what basis
The contract, legal obligations and our legitimate interest.
Who with
Nobody, unless the law requires it. Our providers process the data only on our behalf.
Your rights
Access, rectification, erasure, objection, restriction and portability, by writing to hola@onlytap.es.

1. Controller and scope

The controller is Miguel Monterrey Varela, trading as Volcano MKT, sole trader, tax ID 42192719R, Av. Carlos Francisco Lorenzo Navarro, 56, 38760 Los Llanos de Aridane (Santa Cruz de Tenerife), Spain. Email: hola@onlytap.es. Telephone: +34 611 775 077.

This policy covers the OnlyTap app and the links and pages it publishes, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). The onlytap.es website has its own policy.

If you have opened a business’s link, from its QR code, its NFC chip or directly, that business is the controller of that data and we process it on its behalf. To exercise your rights, contact the business. If you write to us, we will pass your request on to it.

2. What data we process

Your account
Name, email, a password stored in a way we cannot read, the date and version in which you accepted the terms and, if you sign in with Google, the identifier Google gives us.
Profile and billing
First and last name or company name, trade name, tax ID, contact person, telephone, address, country, time zone, language and billing notes.
Payments
The status of your subscription, your invoices and what you pay with: the brand and last four digits of the card, also when you pay with Apple Pay or Google Pay, or the email of your PayPal or Link account. The rest of your payment details are processed by Stripe and, depending on how you pay, by PayPal, Apple or Google, and do not pass through OnlyTap.
What you publish
Your links, files, menus, logos, QR codes, pages, contact blocks and wifi passwords.
Opens (QR code scans, taps on the chip or direct links)
When someone opens a link, from a QR code, a chip or directly, we store the date and time, the link, the approximate country, the device type, the system, the browser and the page they came from. The country is taken from the IP address at that moment, with a local database, and the IP address is not stored with the visit. To count unique visits we use a summary that changes every day and from which the IP address cannot be recovered. Cloudflare receives the IP to deliver the link, but we do not store it with the visit.
Support messages
When you write to us from Contact we process your name, your email, the reason, your message, the link you choose, the screenshot if you add one and, automatically, your account, your plan, the language and the page you came from. We use them only to answer you and resolve what you ask for. The copy that reaches our hola@onlytap.es mailbox is not deleted automatically: you can ask us to delete it. If other people’s details can be seen in a screenshot, cover them before you send it.
Content reports
Anyone can report content they reached through OnlyTap. We process what they give us to find it (the address that opened, or the business and the place where the QR code or chip was), the reason, the message and, if given, their name and email, only to review the report, reply and deal with the authorities. We also keep a copy of the reported page as it was. We do not store their IP address. The copy that reaches our mailbox is not deleted automatically: whoever reports can ask us to delete it. We are the controller of this data.
Support access to your account
To resolve a query or an incident, a member of support can enter your account. A record is kept of who entered, which account, from which support IP address and when.
Server logs
The servers log the requests they receive, with the IP address, for security and to resolve errors.

3. What we use it for and on what basis

Providing the service
Your account, your links, your pages, your statistics and the service emails, such as notices about charges or about links that are going to be deleted. Basis: the performance of the contract (Article 6.1.b GDPR).
Charging and invoicing
Basis: the performance of the contract and legal obligations (Article 6.1.c).
Handling support
Basis: the performance of the contract and, for suggestions, our legitimate interest in improving the service (Article 6.1.f).
Security and abuse
Server logs, content reports and the record of support access. Basis: our legitimate interest in protecting the service and those who use it (Article 6.1.f) and, for reports, the legal obligation to handle them under the Digital Services Act (Article 6.1.c).

We do not send advertising with this data. We do not take decisions based solely on automated processing that produce legal effects on you (Article 22 GDPR).

4. Artificial intelligence

If you ask the AI to fill in a page, we send an artificial intelligence provider the description you write, the business type and the language, and it returns the text of the page. We send nothing else from your account. Do not write other people’s details in the description.

5. Cookies

The app uses only technical cookies, needed for it to work, so it does not ask for consent. It does not use analytics or advertising cookies.

onlytap_app_session (2 hours)
Keeps your session open.
XSRF-TOKEN (2 hours)
Protects forms against forged submissions.
remember_web_… (400 days)
Keeps you signed in to the account. It only appears if you tick “Remember me” or sign in with Google.
Local storage: filament:theme:mode, filament:sidebar:…
These save the theme and how you left the menu in your browser. They do not leave it.

The redirects of links and the pages of businesses do not set cookies of their own.

When you search for your business for Google reviews, the map of each result is Google's, which may set its own cookies under its privacy policy. It only loads if you run that search.

If a business activates Google or Meta measurement on its page, the page shows its own notice and those tools load only if the person accepts. Their choice is saved in their browser. The business is responsible for that measurement.

If you accept measurement cookies on the onlytap.es website, those cookies apply to the whole domain and your browser also sends them to the app, which does not use them. They are managed from the website.

6. Who we share data with

We do not disclose your data to anyone, unless the law requires it. To provide the service we use providers that process it as data processors, under the contract required by Article 28 GDPR:

If you sign in with your Google account, Google confirms your name and email to us.

If you pay with PayPal, PayPal processes your PayPal account details as a controller, under its own privacy policy.

If you pay with Apple Pay or Google Pay, Apple or Google processes your wallet details under its own privacy policy.

7. International transfers

As a rule, we do not transfer data outside the European Economic Area, but some technology providers may have entities outside it. In that case, the transfer relies on adequacy decisions, such as the EU-US Data Privacy Framework where it applies, or on standard contractual clauses and the other safeguards of Articles 44 et seq. GDPR.

8. How long we keep it

Account, profile and what you publish
While the account exists. When it is closed, we keep them for 12 months and they are then deleted.
Opens
While the link exists. They are deleted with it or with the account.
Paused links and trash
Paused links and pages, 12 months, with an email notice at least 30 days beforehand. Deleted links, 30 days in the trash.
Support messages
While your account exists, and they are erased with the rest of its data, at most 12 months after it is closed. The mailbox copy, until you ask us to delete it.
Content reports
While they are open and up to 12 months after they are resolved, even if the reported page or account is deleted before. The mailbox copy, until we are asked to delete it.
Record of support access
Up to 5 years after the account is closed, so that we can prove that access.
Invoices and accounting
These are not part of the account deletion: 6 years (Article 30 of the Spanish Commercial Code) and, for tax purposes, at least 4 years (Spanish General Tax Law).
Server logs
14 days.
Backups
What has been deleted may remain in backups for up to 30 days.

9. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to hola@onlytap.es. We reply within one month. You can change much of your data yourself in My Profile and in Plan and billing, and you can close the account in My Profile.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

10. Minors

OnlyTap is for professionals only and is not aimed at minors.

11. Security

We apply technical and organisational measures to protect the data:

12. Changes to this policy

If we change this policy, we will publish the new version here and ask you to accept it again when you enter your account.