tap·the·table
Log in

Privacy Policy

Last updated: 28 July 2026

1. Introduction

TapTheTable ("we", "us", "our") is operated by Moducraft (Pty) Ltd (Reg: 2026/138609/07). This Privacy Policy explains how we collect, use, and protect personal information in compliance with the Protection of Personal Information Act, 2013 (POPIA) and other applicable data protection laws.

2. Information we collect

Business Owners (Account Holders): When you register for TapTheTable, we collect your name, email address, phone number, business name, and address. If you subscribe to a paid plan, we collect payment information through our payment processor (PayFast).

Diners (Menu Viewers): We do not collect personal information from diners who scan QR codes and view menus. QR code scanning is anonymous. We log anonymised scan data (hashed IP addresses, timestamps, user agent strings) for analytics purposes only.

Automatically Collected Data: We also automatically collect limited technical information when you visit our website:

  • IP address (anonymised where possible)
  • Browser type and version
  • Pages visited and time spent
  • Referring website

3. How we use your information

We use the information we collect to:

  • Provide and maintain our service
  • Process payments and manage subscriptions
  • Send service-related communications (account updates, billing notices)
  • Provide customer support
  • Generate aggregated analytics for business owners
  • Improve our platform and develop new features
  • Comply with legal obligations

We will never sell, rent, or share your personal information with third parties for marketing purposes.

4. Legal basis for processing

Under POPIA, we process your information based on:

  • Consent – when you register an account, submit a contact form, or sign up for communications
  • Contractual necessity – when we need your information to deliver services you have engaged us for, including managing your subscription and providing the QR-code menu platform
  • Legitimate interest – for website analytics, service improvement, and platform security

5. Cookies and tracking

Our website uses cookies for analytics, cookie consent management, and essential site functionality. Specifically:

  • Essential cookies – session cookies and CSRF tokens required for authentication, security, and core site functionality. These are strictly necessary and cannot be disabled.
  • Google Analytics cookies (_ga, _ga_*) – used to distinguish unique visitors and track site usage. These cookies are set when you visit our site and expire after 2 years. The data collected is anonymised and used to understand how visitors interact with our site. See Google's privacy policy for details. You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on.
  • Microsoft Clarity – used for heatmaps, session recordings, and behaviour analytics to help us understand how visitors interact with our site. Clarity may set cookies and collects anonymised usage data. See Microsoft's privacy statement for details.
  • Osano cookie consent manager – manages your cookie preferences and records your consent choices. See Osano's privacy policy for details.

We do not use third-party tracking cookies or advertising cookies on the public menu pages viewed by diners.

You can control cookies through your browser settings or via the Osano consent banner. Disabling analytics cookies will not affect your ability to use the site.

6. Data security

We implement industry-standard security measures including encryption in transit (TLS/SSL), hashed passwords, and secure server infrastructure. QR code security tokens rotate daily to prevent misuse.

7. Third-party services

We may use the following third-party services that process data on our behalf:

  • PayFast – payment processing for subscriptions. PayFast handles all card details directly; we do not store your payment card information. See PayFast's privacy policy for details.
  • Google Analytics – website usage statistics (page views, traffic sources, device types). Google Analytics uses cookies to collect anonymised usage data. See Google's privacy policy for details. You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on.
  • Microsoft Clarity – heatmaps, session recordings, and behaviour analytics to help us understand how visitors use our site. See Microsoft's privacy statement for details.
  • Osano – cookie consent management. See Osano's privacy policy for details.

Each third-party service has its own privacy policy governing the use of your data. All third parties are bound by data processing agreements.

Some of these providers are based outside South Africa, which means your information may be processed or stored in other countries, including in the European Union and the United States. Where this happens, we take reasonable steps to ensure your information is protected in line with Chapter 9 of POPIA (Section 72).

8. Data retention

We retain account data for as long as your account is active. After account closure, we retain data for 90 days before permanent deletion. Anonymised analytics data may be retained indefinitely. We retain your information only for as long as necessary to fulfil the purposes described in this policy, or as required by law.

9. Your rights under POPIA

As a data subject under POPIA, you have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate information
  • Request deletion of your personal information
  • Object to the processing of your information
  • Request a copy of your data in a portable format
  • Withdraw consent at any time
  • Lodge a complaint with the Information Regulator

To exercise any of these rights, contact us at [email protected].

You also have the right to lodge a complaint directly with the Information Regulator (South Africa):

The Information Regulator (South Africa)
Website: inforegulator.org.za
POPIA complaints: [email protected]
Telephone: 010 023 5200

10. Children's privacy

Our services are not directed at children under 18. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this privacy policy from time to time. The most current version will always be available on this page with the updated date shown above.

12. Information Officer and contact

Moducraft (Pty) Ltd has appointed an Information Officer who is responsible for our compliance with POPIA and for handling requests relating to your personal information.

We also maintain a PAIA Manual, prepared under the Promotion of Access to Information Act, which describes the records we hold and how to request access to them. It is available on request from our Information Officer.

For any privacy-related question or request, or to reach our Information Officer, please contact:

Moducraft (Pty) Ltd
Email: [email protected]
Telephone: 061 503 8366
92-94 Rosmead Avenue, Kenilworth, Cape Town 7708, South Africa