Privacy Policy
Who is responsible and what this policy covers
Dr.-Ing. Stefan Hoppe, Merzstr. 7a, 92224 Amberg, Germany. Email: support@taptopayonphone.app. Telephone: +49 151 50887777. VAT ID: DE312238079.
This policy applies only to the invoice app with Apple ID 6827601437, its supporting service when used with that App, and these invoice-app pages on taptopayonphone.app. Other apps on this domain have separate privacy information. We are responsible for our merchant-account administration, service security, website and support processing. Merchants decide which customer data to enter and why; we handle their customer and invoice requests to provide the service on their instructions. Stripe and Apple also process information under their own policies.
Stripe connection and Team Access
Stripe handles account sign-in and read/write authorization through Stripe Connect. Our service exchanges the authorization code and issues an App session credential. Cloudflare D1 stores the connected Stripe account ID, session-token hash and token-generation material, creation time and agreed App fee terms. We retrieve account information such as country and default currency from Stripe. We do not store your Stripe password, full account-verification documents or Stripe OAuth access token in D1; our Connect permissions nevertheless allow access to information Stripe makes available for the requested features.
A random installation identifier links sign-in, team sessions and notifications. It is not an advertising identifier. Sign-in state expires after 30 minutes and the installation-bound exchange code after 5 minutes. Used or expired records are removed by sign-in processing and daily cleanup; expiry does not guarantee immediate physical deletion.
For Team Access, D1 stores the chosen access name, account ID, invitation hash and generation material, status, dates, and the active installation, session and token-hash information. Invitation links contain an access name and token. The recipient and sharing service you choose receive them; our service does not send team invitation emails. Entries have no automatic time-based expiry. The owner can inspect and revoke access. Team members can manage customers and the App-created invoice list; account-wide Payments, Payouts and team management are owner-only.
Customers, invoices, tax and email delivery
Customer names or company names, email addresses, billing addresses and optional telephone numbers pass through our Cloudflare Worker to and from Stripe. The App requires a name, email and billing address, including a state for US addresses, for its invoice workflow. These are the App’s input requirements, not a statement that the same fields satisfy every jurisdiction’s invoice rules. The merchant supplies customer data or selects an existing Stripe customer. Customer records are stored on that merchant’s Stripe account, not in a separate D1 customer database.
Invoice requests include the customer ID, descriptions of products or services, unit prices, quantities, currency, entered tax percentages, inclusive/exclusive tax settings, payment terms and request identifiers. Stripe stores invoice contents and calculates tax amounts using the percentages you enter. The shared price-includes-tax preference is stored for your connected account in our Cloudflare database. App, installation, connection and request identifiers in Stripe metadata associate an invoice with its creating installation and owner or team connection. Authorized users of the same connected account can see invoices created by this App on that account.
When you confirm, our service finalizes the invoice and requests email delivery by Stripe to the customer email saved on that invoice. Stripe processes the address, invoice information and delivery data for that purpose. Hosted invoice and PDF links, QR codes and their contents are disclosed to the people and services you choose when sharing. The App generates QR codes locally. Payment details entered on Stripe’s hosted invoice page go directly to Stripe; neither the App nor our server receives full card numbers or card security codes.
D1 stores operational invoice IDs, account and request hashes, creation times and email-attempt/completion timestamps to link invoice records, identify duplicate deliveries of the same request and record known email outcomes. It does not store full invoice contents or a separate financial transaction history. A successful send request records Stripe’s acceptance of the request, not proof that an email reached an inbox.
Embedded Payments and Payouts
The account owner can open Stripe’s embedded Payments and Payouts components. Our service authenticates the App session and obtains a short-lived, component-restricted Stripe AccountSession. Its client secret and Stripe publishable key load the component; AccountSession secrets are not stored in D1 and API JSON responses are marked not to be cached. Stripe processes account-wide payment information and eligible actions such as refunds, captures or disputes, and balances, external bank accounts, payout settings and eligible payouts. These views may include activity outside this App. Stripe controls the features available for the account and processes information entered there under its own agreements and privacy policy.
Paid and overdue push notifications
If you allow notifications, the App registers with Apple Push Notification service (APNs) and sends its device token, delivery environment and app bundle identifier to our service. D1 links these to the installation, connected account and owner/team connection and records the registration time. Stripe events and periodic checks, normally every 15 minutes for open invoices, can trigger paid or overdue alerts to the installation that created the invoice. The service checks the latest invoice and active connection before sending.
Apple receives the device token and notification payload: invoice number, amount, currency, result text, invoice and account IDs, installation and event IDs, event time, test/live mode and app identifier. The payload does not include the customer’s name, email or billing address. Your iOS settings control what can appear on the lock screen. Foreground alerts are kept in Notification Center without a banner or sound.
D1 notification data contains invoice, account, installation, connection and event identifiers, invoice status, notice type, check and delivery times and retry/claim state. It does not contain invoice amounts, currency or customer contact details. Cloudflare Queues holds invoice/account identifiers, job type and test/live mode for checks, delivery and retries. Alerts older than 24 hours are suppressed for delivery; this does not mean that the underlying records are deleted after 24 hours.
You can disable notifications in iOS settings. On the next signed-in registration synchronization the App attempts to remove a disallowed registration. Logout also attempts removal, but a network or authentication failure can leave the server registration in place. Earlier invoice alerts may still arrive while that connection remains active.
Information on your device
The App stores its session credential in the iOS Keychain with this-device-only protection after the first unlock. Updated App versions store the installation identifier and review-mode preference in local preferences alongside account ID, country, currency, merchant/team role, team access name, agreed fee information and onboarding/terms state. During an upgrade, the existing installation identifier is retained and older non-credential Keychain entries are removed after migration. The identifier can remain after logout; a fresh installation does not reuse an identifier or review preference left in the Keychain. Older App versions can keep those settings in the Keychain until updated. Unfinished form and invoice requests are not retained for automatic resubmission. The updated App attempts to remove recovery records from earlier versions when it starts; protected or unavailable device storage may delay removal.
Loaded customer and invoice information is held for display; the current APNs token is held in App memory rather than separately saved in preferences. The invoice workflow does not request camera, Bluetooth, local-network or device-location permission. Region information can come from the Stripe account or device locale. Payment and account authentication offered by Stripe, Apple or another payment provider is handled by that provider. Stripe’s embedded components may process device, interaction and security information for their services; see Stripe’s Privacy Policy and Apple’s Privacy Policy.
Website, security logs and support
Cloudflare hosts these pages and our API, D1 records and background queues. It processes connection and request information such as IP address, time, URL, browser/device information and security metadata. We use hashed authentication information for rate limits. Worker logs and sampled traces are enabled. Diagnostic records can include request IDs, error codes or messages, methods and paths; URLs or errors can contain resource identifiers, OAuth codes or invitation information. Device logs cover authentication, API and push-registration failures; the App has no separate endpoint for uploading those device logs.
These pages set no cookies of our own and load no advertising or website analytics scripts. Cloudflare security features may use necessary cookies where enabled. We do not sell personal information or use it for cross-app advertising. Support messages and contact details are used to respond to you.
Recipients and international processing
If you choose a logo in Settings, the App checks only the image you select: it must be JPG or PNG, at least 128 pixels wide and high, and smaller than 512 KB. It rejects files that do not meet these requirements. Accepted image bytes are transmitted unchanged, including any metadata present in the selected file. When you confirm with the checkmark, the image passes through our Cloudflare Worker to Stripe and is stored as part of your Stripe account branding. We do not store a separate logo file in D1 or our own file storage. The App can retrieve the current logo through the Worker to show its preview. Removing a logo clears its branding assignment; it does not erase earlier Stripe file records or copies already included in documents.
When you confirm the invoice wizard, new customer details are saved to Stripe. Selecting an existing customer uses their saved details without changing them. Existing customer details can be edited separately in Settings. Account owners set their public business name and address separately in Settings or during onboarding. Those details are saved to Stripe and used for future invoices.
Information is shared with Stripe for the connected-account, customer, invoice, tax, email, payment and embedded-account features; with Cloudflare for hosting, security, operational storage and queues; with Apple for App distribution, device services and push delivery; and with recipients or services you choose for sharing. Information may also be disclosed when required by law or needed to establish, exercise or defend legal claims.
These providers may process information outside your country, including outside the European Economic Area. Where required, international transfers rely on applicable adequacy decisions or safeguards such as standard contractual clauses under the relevant provider agreements. Contact us for information about the applicable safeguards. See Stripe’s Data Processing Agreement, Cloudflare’s Privacy Policy and Cloudflare’s Data Processing Addendum.
Retention, logout and deletion
Device registrations are eligible for cleanup after 90 days without an update; invalid APNs tokens are also removed when reported. Operational records for invoice requests, email attempts, status checks and notifications currently have no automatic age limit. They remain linked to the merchant connection for reliable retries and suppression of duplicate messages until removed following a valid deletion request or confirmed Stripe deauthorization. Merchant and team-access records likewise have no automatic age limit. Support correspondence is retained as needed to handle enquiries and related claims; no fixed automatic deletion period is configured.
Deleting a team entry removes that entry and its current device registration. Existing Stripe invoices and operational invoice-routing records can remain; delivery checks prevent alerts to revoked team connections. When a verified Stripe deauthorization event confirms that our access has ended, the merchant record and dependent team, invoice-operational and device records are deleted. This depends on successful receipt and processing of the event. It does not delete Stripe’s records or identifiers already in queued jobs.
Logout clears the device’s sign-in and attempts to unregister push delivery, but it does not revoke Stripe access, delete the merchant/team entry, erase Stripe invoices or remove all local preferences. Uninstalling does not send a server-deletion request. Cloudflare log, trace, queue and backup retention follows the applicable service plan and configuration separately; operational cleanup does not guarantee immediate removal from backups. For deletion requests contact us. The merchant and Stripe handle customer, invoice and payment records they control.
Legal bases, choices and your rights
Where the GDPR applies, our own merchant-account administration uses Article 6(1)(b) for the requested contract/service, security and support use Article 6(1)(f) for our legitimate interests in operating and protecting the service and responding to enquiries, and mandatory legal obligations use Article 6(1)(c). Merchants determine the purposes and lawful bases for their customer and invoice data; we process their service requests on their instructions. Required connection and invoice fields are needed to provide the relevant feature; without them that feature cannot be provided. Notifications are optional and can be turned off in device settings.
Subject to the conditions of applicable law, you may request access, correction, deletion, restriction or portability and object to processing, including processing based on legitimate interests. If processing relies on consent, you can withdraw it without affecting earlier lawful processing. Contact support@taptopayonphone.app. You may complain to a competent data-protection authority, including the Bavarian Data Protection Authority. Where Stripe or Apple controls data independently, use its privacy channels. For customer-data requests, contacting the merchant that issued the invoice can also be appropriate.
The App is intended for business users, not children. We do not use these App records to make solely automated decisions with legal or similarly significant effects about individuals. Stripe and payment providers make their own payment, compliance and fraud-prevention decisions under their respective policies.