Trust and privacy
TapMat keeps as little as it can, keeps it in Australia, and builds the legal details in so your shop does not have to think about them.
What TapMat holds
| Member number | A short code on the pass, kept on the customer's phone |
|---|---|
| Visit times | When each visit was counted, and at which shop |
| Points and rewards | Progress toward each reward and rewards collected |
| Name, email or phone | Only if the customer chooses to share them with one shop |
What TapMat never holds
- Card or payment details
- What was bought or how much was spent
- A customer account or password
- Anything from a customer app, because there is none
Built to follow Australian law
Each shop's state decides which rules apply, and TapMat applies them automatically. Our handling is mapped law by law, and a legal review of the full register comes before paid plans.
- Spam Act 2003
- Messages go only to customers who opted in with that shop. Every message names the shop and how to contact it, and one click unsubscribes at once. Consent is recorded with the exact notice the customer saw.
- Privacy Act 1988 and the Australian Privacy Principles
- Minimal data by design, a privacy notice before any personal details are collected, details kept with the one shop they were shared with, and customers can remove them any time.
- Australian Consumer Law
- Every reward condition, window and end date is shown to the customer, and rewards earned before an offer ends can still be claimed.
- Trade promotion lotteries
- Not needed: TapMat rewards count visits and never run prize draws, so no state permit applies.
Security and reliability
- Taps that cannot be faked
- Every tap is checked against the sticker's own counter or cryptography, and only one visit per hour counts for each customer.
- Separate logins
- Owners, staff and the platform team each have their own login and see only what their job needs. A disabled login stops working within 30 seconds.
- Secrets kept locked away
- Keys and passwords live in Azure Key Vault, not in the code.
- Hosted in Australia
- Customer data is stored in Microsoft Azure, Australia East.
- Built to keep the counter working
- Each part runs separately, so a busy dashboard never slows a customer's tap, and every update can be rolled back in minutes.
- Tested on every change
- Hundreds of automated tests check the rules on every change, and browser tests run the real customer, owner and staff journeys before each release.
People approve, software suggests
When TapMat adds AI help for owners, it will suggest and never act on its own: nothing is sent until the owner approves it. Taps and rewards at the counter never depend on AI, so they keep working whatever happens elsewhere.
3 monthsfree
Put your shop on the shelf
Join the free 3-month pilot. We write and test your sticker, set up your shop, and you choose the rewards. No lock-in, no setup fee, no card details.