Privacy Policy

Tap by ServiceAi · tap.serviceaihq.com · effective 5 November 2026

ServiceAi HQ LLC ("ServiceAi", "we") runs Tap by ServiceAi: digital business cards, NFC tap cards, lead capture, and business phone lines with calls, texts and an optional AI receptionist, on the web at tap.serviceaihq.com and in the Tap by ServiceAi iPhone app. This policy describes what we collect, why, who processes it, how long we keep it, and what we never do with it. We do not sell personal information, we do not share it for advertising, and we use no advertising networks or cross-app tracking.

Your account

You sign in with your email address and a one-time code we email you (or, on the web, with Google, which only confirms your email to us). We keep your email, name, and the profile you build: title, company, phone, links, photo or logo, and the other content you add. Your profile is public on purpose; it is what a card opens. If you join a team, the team owner can see your team membership and shared lines.

People who reach you

Visitors who submit the form on your card or exchange details with you provide a name, email, and optionally a phone number, company and message. Callers and texters to your business number provide their phone number and what they say. This becomes a contact on your account, and the owner is emailed an alert about new leads, texts, voicemails and AI-answered calls. ServiceAi also keeps a copy of new leads, call summaries and texts in its own customer-relationship system (HubSpot) to operate and support the service. A lead's email domain may be read by an AI model to guess the lead's industry; the guess is labelled as one.

SMS / text messaging

Consent. We send text messages only to people who have opted in — by submitting a form that carries explicit SMS consent language, or by texting one of our numbers first. Consent is collected at the point of submission and is never a condition of purchase.

No third-party marketing — ever. Phone numbers and SMS opt-in consent are not shared with, sold to, or disclosed to any third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties.

Opting out. Reply STOP to any message to unsubscribe immediately, or HELP for help. Message frequency varies by conversation; message and data rates may apply.

Texts sent and received on a business number are carried by Twilio and stored on the account so the owner can read the conversation.

Phone calls, voicemail and the AI receptionist

• Calls you answer are connected live through Twilio and are not recorded. We keep a call log: the numbers, time, direction, duration and outcome.
• Voicemail. A caller who leaves a voicemail hears a beep first. The recording and its transcript are made by Twilio; the transcript and a link to the recording are stored on the owner's account.
• AI receptionist. If the owner turns it on, missed calls are answered by an automated assistant that says it is an AI in its first sentence. The conversation is processed by ElevenLabs, whose voice agent uses a Google Gemini model to understand and reply. The transcript and a short summary are stored on the owner's account and ElevenLabs keeps a record of the conversation. The assistant can hand the call to the owner, with a one-sentence note about who is calling.
• The app's phone. To ring your iPhone for calls to your business number, the app registers an Apple push token with Twilio and uses your microphone only while you are on a call.

Your voice (optional)

If you choose to have the receptionist answer in your own voice, you record about a minute of speech in the app after reading a consent sentence aloud. That recording is sent to ElevenLabs to build a voice model used only for your receptionist. It is never used for anyone else and never sold. Recording again replaces the old voice and deletes it from ElevenLabs. Deleting your account deletes the voice from ElevenLabs; to remove it without deleting your account, email us.

Card taps and page visits

When someone taps a card or opens a profile page, we log it so the cardholder can see their own activity: date and time, the browser's user-agent (to show the device type), the approximate city, region, country and time zone that our network provider (Cloudflare) derives from the connection, the referring page, which card or link was used, and a first-party visit id. We do not store IP addresses with these records, precise location, advertising identifiers or device fingerprints. An IP address is used only to limit abuse and is held for no more than an hour.

Cookies and browser storage

tap.serviceaihq.com uses only first-party cookies, none for advertising: a sign-in cookie (up to 90 days), a repeat-visit cookie on card pages (one year), an unlock cookie when a card has an access code (12 hours), and a referral cookie when you arrive from someone's referral link (30 days). A per-tab visit id is kept in the browser's session storage. Pages load Sentry's error-reporting script so we can fix broken pages.

The iOS app

Your session token is stored in the iOS Keychain, restricted to the device and excluded from iCloud and encrypted backups. It is sent only to tap.serviceaihq.com, over HTTPS. The app asks for each permission only when you use the feature that needs it.

• Address book. If you choose to import contacts, the app reads your address book on the phone and shows you the list. Only the people you pick are sent to our server (name, phone, email and company), so they can reach you directly instead of the receptionist. Saving a scanned card to your address book writes it on the phone. We never read your address book in the background.
• Camera and photos for the card scanner. Text on a business card is recognised on your phone. Only the recognised text is sent to our server, where an AI model (Cloudflare Workers AI) sorts it into a name, title and company; the photo never leaves your device.
• Logo or photo. An image you pick for your profile or card theme is uploaded and shown on your public profile.
• NFC. Writing a card stores only your card's web address on it.
• Crash and performance reports. The app sends crash reports, a sample of performance traces and which screens and buttons were in use to Sentry: device model, OS and app version, and the code path. They carry no name, email, IP address, contacts, messages or profile content, and are not linked to your account.

The app shows no ads.

App analytics and advertising measurement (Google and Meta)

From version 1.0 (build 42) the iOS app uses Google Analytics for Firebase and the Meta (Facebook) SDK to count how the app is used and to learn which of our own ads on Google and Meta led people to install it or buy a card.

• What they receive. Which screens are opened and which features are used (for example "card saved" or "text sent", never what you typed), sign-in steps, that a card was ordered and its price, app version, device model, OS, language, an approximate location that Google and Meta work out from the IP address, and identifiers their SDKs create for this install. They never receive your name, email, phone number, messages, contacts, card content or account id, and we do not give them one.
• Your choice (App Tracking Transparency). After your first success in the app (your card saved, or a card written) iOS asks whether Tap may track you. Only if you tap Allow do Google and Meta receive your device's advertising identifier (IDFA) and use the data to measure and personalise ads across other companies' apps and websites. If you tap Ask App Not to Track, no advertising identifier is collected, ad storage and personalisation stay off, and the app works exactly the same. Change it any time in Settings → Privacy & Security → Tracking.
• Ad measurement without tracking. Apple's SKAdNetwork can tell Google or Meta that an install came from one of their ads without identifying you or your device.
• We do not sell your data. We do not sell or rent personal information, and nothing here is shared with anyone except Google and Meta through their own SDKs, under their policies: Google, Meta.
• Opting out. Turn tracking off as above, reset your advertising identifier in iOS Settings, or email us and we will ask Google and Meta to delete analytics data for your install.

Contact briefings (optional, on request)

The contact read is a briefing about one of your contacts, written from the texts, calls and card activity already stored on your account plus notes you typed. It runs on Cloudflare Workers AI, is generated only when you ask, is labelled as AI in the app, and is not used to train models. Where a public-web look-up is enabled, the contact's name and company are sent to a search provider (Firecrawl) to find public pages about them.

Payments

Cards and plans are bought on our website through Stripe. Stripe receives your card details; we never see or store them. We keep your billing status and Stripe customer and subscription ids.

Who processes data for us

Each processes data only to provide the service. Some cards open pages hosted elsewhere (a website, a booking page, a video); those sites have their own policies.

How long we keep it

• Your account, profile, contacts, messages, call log and card tap history: until you delete them or the account.
• Page-visit analytics: 180 days, then deleted automatically.
• Sign-in codes: deleted once used or expired. Expired sessions: deleted.
• Payment webhook records: 90 days.

Deleting your account and your rights

You can edit or delete your profile content at any time, and delete the whole account from inside the app (Menu → Delete account). That removes the profile, contacts, messages, call log, analytics, cards and phone number from our systems immediately; releases the number; cancels any subscription; and asks ElevenLabs and Twilio to delete your cloned voice, your receptionist, its conversation records and your voicemail recordings. It cannot be undone. Copies already in ServiceAi's CRM, in processors' routine backups, or held where the law requires (for example payment records at Stripe) are removed on request or on their providers' schedules.

Anyone, including a person whose details are in a customer's contacts, can email us to access, correct or delete what we hold about them. We answer within 30 days. California residents have these rights under the CCPA; we do not sell or share personal information and do not discriminate against anyone who uses them. Reply STOP to end texts.

Children

Tap is a business tool and is not directed to children under 13. We do not knowingly collect their information; if you believe we have, email us and we will delete it.

Changes

If what we collect or who processes it changes, we update this page and the effective date above.

Contact

ServiceAi HQ LLC · info@serviceaihq.com · (855) 338-2849

Questions: info@serviceaihq.com · serviceaihq.com