OnlyTap

Privacy policy

November 2026

This is a translation of the Spanish original. If the two differ, the Spanish version prevails.

Who
Volcano MKT (Miguel Monterrey Varela, sole trader, tax ID 42192719R), which provides the OnlyTap service. You can write to us at hola@onlytap.es.
What for
To provide the service, charge for it, handle support and keep it secure.
On what basis
The contract, legal obligations and our legitimate interest.
Who with
Nobody, unless the law requires it. Our providers process the data only on our behalf.
Your rights
Access, rectification, erasure, objection, restriction and portability, by writing to hola@onlytap.es.

1. Controller and scope

The controller is Miguel Monterrey Varela, trading as Volcano MKT, sole trader, tax ID 42192719R, Av. Carlos Francisco Lorenzo Navarro, 56, 38760 Los Llanos de Aridane (Santa Cruz de Tenerife), Spain. Email: hola@onlytap.es. Telephone: +34 611 775 077.

This policy covers the OnlyTap app and the links and pages it publishes, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). The onlytap.es website has its own policy.

If you have opened a business’s link, QR code, plaque or page, that business is the controller of that data and we process it on its behalf. To exercise your rights, contact the business. If you write to us, we will pass your request on to it.

2. What data we process

Your account
Name, email, a password stored in a way we cannot read, the date and version in which you accepted the terms and, if you sign in with Google, the identifier Google gives us.
Profile and billing
First and last name or company name, trade name, tax ID, contact person, telephone, address, country, time zone, language and billing notes.
Payments
The status of your subscription and your invoices. Your card details are processed by Stripe and do not pass through OnlyTap.
What you publish
Your links, files, menus, logos, QR codes, pages, contact blocks and wifi passwords.
Taps and scans
When someone opens a link, a QR code or a plaque we store the date and time, the link, the approximate country, the device type, the system, the browser and the page they came from. The country is taken from the IP address at that moment, with a local database, and the IP address is not stored with the visit. To count unique visits we use a summary that changes every day and from which the IP address cannot be recovered.
Support messages
When you write to us from Contact we process your name, your email, the reason, your message, the link you choose, the screenshot if you add one and, automatically, your account, your plan, the language and the page you came from. We use them only to answer you and resolve what you ask for. The copy that reaches our hola@onlytap.es mailbox is not deleted automatically: you can ask us to delete it. If other people’s details can be seen in a screenshot, cover them before you send it.
Content reports
Anyone can report a page. We process the reason, the message and, if given, their email, only to review the report and reply. We do not store their IP address. We are the controller of this data.
Support access to your account
To resolve a query or an incident, a member of support can enter your account. A record is kept of who entered, which account, from which support IP address and when.
Server logs
The servers log the requests they receive, with the IP address, for security and to resolve errors.

3. What we use it for and on what basis

Providing the service
Your account, your links, your pages, your statistics and the service emails, such as notices about charges or about links that are going to be deleted. Basis: the performance of the contract (Article 6.1.b GDPR).
Charging and invoicing
Basis: the performance of the contract and legal obligations (Article 6.1.c).
Handling support
Basis: the performance of the contract and, for suggestions, our legitimate interest in improving the service (Article 6.1.f).
Security and abuse
Server logs, content reports and the record of support access. Basis: our legitimate interest in protecting the service and those who use it (Article 6.1.f).

We do not send advertising with this data. We do not take decisions based solely on automated processing that produce legal effects on you (Article 22 GDPR).

4. Artificial intelligence

If you ask the AI to fill in a page, we send an artificial intelligence provider the description you write, the business type and the language, and it returns the text of the page. We send nothing else from your account. Do not write other people’s details in the description.

5. Cookies

The app uses only technical cookies, needed for it to work, so it does not ask for consent. It does not use analytics or advertising cookies.

onlytap_app_session (2 hours)
Keeps your session open.
XSRF-TOKEN (2 hours)
Protects forms against forged submissions.
remember_web_… (400 days)
Keeps you signed in to the account. It only appears if you tick “Remember me” or sign in with Google.
Local storage: theme, isOpen, collapsedGroups
These save the theme and how you left the menu in your browser. They do not leave it.

The redirects of links and the pages of businesses do not set cookies of their own.

If a business activates Google or Meta measurement on its page, the page shows its own notice and those tools load only if the person accepts. Their choice is saved in their browser. The business is responsible for that measurement.

If you accept measurement cookies on the onlytap.es website, those cookies apply to the whole domain and your browser also sends them to the app, which does not use them. They are managed from the website.

6. Who we share data with

We do not disclose your data to anyone, unless the law requires it. To provide the service we use providers that process it as data processors, under the contract required by Article 28 GDPR:

If you sign in with your Google account, Google confirms your name and email to us.

7. International transfers

As a rule, we do not transfer data outside the European Economic Area, but some technology providers may have entities outside it. In that case, the transfer relies on adequacy decisions, such as the EU-US Data Privacy Framework where it applies, or on standard contractual clauses and the other safeguards of Articles 44 et seq. GDPR.

8. How long we keep it

Account, profile and what you publish
While the account exists. When it is closed, we keep them for 12 months and they are then deleted.
Taps and scans
While the link exists. They are deleted with it or with the account.
Paused links and trash
Paused links, 12 months, with an email notice at least 30 days beforehand. Deleted links, 30 days in the trash.
Support messages
While your account exists, and they are erased with the rest of its data, at most 12 months after it is closed. The mailbox copy, until you ask us to delete it.
Content reports
They are deleted with the reported page or with its account.
Record of support access
Up to 5 years after the account is closed, so that we can prove that access.
Invoices and accounting
These are not part of the account deletion: 6 years (Article 30 of the Spanish Commercial Code) and, for tax purposes, at least 4 years (Spanish General Tax Law).
Server logs
14 days.
Backups
What has been deleted may remain in backups for up to 30 days.

9. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to hola@onlytap.es. We reply within one month. You can change much of your data yourself in My Profile and in Plan and billing, and you can close the account in My Profile.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

10. Minors

OnlyTap is for professionals only and is not aimed at minors.

11. Security

We apply technical and organisational measures to protect the data:

12. Changes to this policy

If we change this policy, we will publish the new version here and ask you to accept it again when you enter your account.