1. Who we are
Flap is run by Flap Tech Pvt. Ltd., Lazimpat-2, Kathmandu, Nepal (“Flap”, “we”, “us”). We are responsible (the “data controller”) for the personal data processed through flaap.me, the Flap Shop at shop.flap.com.np, our NFC cards, tags and stands, and the related apps and dashboards (together, the “Services”).
For anything about your data, email privacy@flap.com.np. We reply within 30 days.
2. The short version
- Your public profile is public: anyone who taps your Flap, scans your QR code or opens your link can see what you put on it. You choose what goes there.
- We record basic visit information when someone opens a Flap profile or business page (time, device type, shortened IP address, approximate city) so owners can see how their Flap is used.
- We do not sell personal data and we do not use advertising or tracking cookies.
- We use a small number of service providers (for example email, SMS and hosting) only to run the Services.
- You can edit your data at any time, delete your account in Settings, or email us to get a copy or have everything erased.
3. What we collect
Your account
- Email address, username / Flap ID and password (stored only as a one-way hash).
- If you sign in with Google: your Google account ID, name, email and profile photo.
- If you turn on fingerprint / Face ID sign-in (passkeys): a public key and device name. Your fingerprint or face never leaves your device.
Your profile (you decide what to add)
- Name, photos, job title, organisation, phone numbers, email, address, website, social media links, review links and a short description.
- Payment wallet details you choose to show (for example an eSewa or Khalti ID or QR code). We never ask for card numbers or wallet passwords.
- Optional personal details: date of birth, gender, language and blood type. Blood type is health information; we only store it if you enter it and tick the consent box, and you can remove it at any time.
- Emergency contacts you add (name, relation, phone, email). Please only add people who agree to be contacted. We message them only for the alerts you switch on (lost item found, new sign-in, account change).
Your Flap products
- The ID of each NFC card, tag, stand or QR code linked to your account, and settings such as lost mode, lost-item messages and vehicle details.
People who open a Flap profile, tag or business page
- When a profile, product tag or business page is opened we record the time, which Flap was opened, the button or link clicked, a shortened IP address (the last part is removed, so it does not identify your device), browser / device type, and an approximate city and country.
- Visitors can choose to send their own contact details to a profile owner (“Exchange contact”). Those details go to that owner.
People who report a lost item or contact a vehicle owner
- The name, phone number and message you type.
- Your location, so the owner can find their item: your exact location only if you tap “Share my exact location” (or allow it when you send a vehicle alert), otherwise an approximate area worked out from your IP address. This is sent to the owner and their emergency contacts. We never ask for your location just because you opened the page.
- Your IP address and device type, to stop abuse (for example repeated fake alerts).
Businesses and their customers
- Business owners: business details, staff members and roles, menus, products, prices, opening hours, photos and settings.
- Customers of a business on Flap: loyalty memberships and visits, orders (name, phone, delivery address, items), bookings, enquiries, and any review or rating you post.
Flap Shop orders
- Name, phone, email, delivery address, the items you order, payment method and status, and product reviews you write. Online payments are handled by the payment provider (for example eSewa); we receive a confirmation, not your wallet or card credentials.
Other features you use
- Messages and calls between Flap users. Call connection data is deleted automatically within about two minutes; zone chat messages after 24 hours.
- Places and travel passport check-ins (place, time and, if you allow it, location), and Flap Points history.
- Questions you send to the Flap AI assistant and the business data it needs to answer.
- Support requests and the emails we exchange with you.
Technical data
- Server logs (IP address, time, page requested, browser) used for security and fixing errors.
- If you connect Instagram, the message threads with your Instagram account. You can remove them from Instagram’s settings (“Apps and websites”); we then delete them automatically.
4. Why we use it (and our legal basis)
Where laws such as the EU / UK General Data Protection Regulation (GDPR) apply, we rely on the legal bases below. In Nepal we process data in line with the Individual Privacy Act, 2075 (2018) and its regulations.
| Purpose | Legal basis |
|---|---|
| Creating your account, showing your profile, linking Flap products, processing orders, bookings and deliveries | Performing our contract with you |
| Showing profile and business owners how their Flap is used (visit counts, taps, approximate locations) | Legitimate interests — owners need to know their product works; we only show approximate location and limit how long we keep it |
| Lost-item and vehicle alerts, including the finder’s location | Legitimate interests of the owner in recovering their property, and the finder’s choice to send the alert; exact location only with the finder’s consent |
| Keeping the Services secure, preventing spam, fraud and abuse | Legitimate interests |
| Blood type and other health details you add | Your explicit consent (the consent box when you add them); you can withdraw by deleting them |
| Service emails and SMS (sign-in codes, order updates, security alerts) | Performing our contract; legitimate interests (security) |
| Newsletters and offers | Your consent — you can unsubscribe at any time |
| Keeping invoices and order records, answering lawful requests | Legal obligation |
5. Who can see your data
- Everyone, for public content. Your public profile, business pages, menus, products and reviews can be seen by anyone with the link and may appear in search engines. People you share your profile with can save or forward it; we cannot control what they do with it.
- Businesses you interact with see your loyalty membership, visits, orders, bookings and messages with them, and the name shown on your review.
- Profile owners see visit statistics for their Flap and any contact details you choose to send them.
- Our service providers (listed in the next section), only to run the Services and under confidentiality.
- Authorities, when the law requires it or to protect someone’s safety.
- A buyer or successor if Flap is merged or sold; this policy will continue to apply to your data.
6. Service providers we use
| Provider | What for | Data involved |
|---|---|---|
| Cloud hosting and database providers | Running the website, apps and database | All data described in this policy |
| Email providers (SMTP) | Sign-in, order and alert emails | Email address, message content |
| Sparrow SMS (Nepal) | SMS alerts and codes | Phone number, message content |
| WhatsApp (Meta) and our WhatsApp messaging provider | WhatsApp alerts and messages you send | Phone number, message content |
| “Sign in with Google”, maps, and translating profiles (Google Cloud Translation, called from our servers) | Google account details; the profile text being translated (not the visitor’s identity); IP address when a map loads | |
| Meta (Instagram / WhatsApp) | Instagram messaging features, if you connect them | Instagram account ID, messages |
| Anthropic | The Flap AI assistant | Your questions and the business data needed to answer them |
| IP location provider (ipinfo.io or ip-api.com Pro, over an encrypted connection) | Turning an IP address into an approximate city | IP address |
| OpenStreetMap (Nominatim) | Turning map positions into addresses | Map coordinates |
| Cloudinary, QR code services | Images, QR codes | Image files, the link encoded in the QR code |
| eSewa and other payment providers | Taking payments | Order amount and reference; you enter payment details directly with them |
Each provider may only use the data to provide its service to us.
7. International transfers
We are based in Nepal and some of our providers are in other countries, including the United States and the EU. This means your data may be processed outside the country where you live. Where the GDPR applies, we rely on safeguards such as the European Commission’s Standard Contractual Clauses or the provider’s certification. You can ask us for details at privacy@flap.com.np.
9. How long we keep data
- Account and profile data: while your account is open. When you delete your account, your profile, contacts, messages you sent, tags, reviews, loyalty memberships, visit statistics and any businesses you own are deleted straight away and your Flap products are unlinked. Copies in backups are deleted within 90 days.
- Visit and tap records (with shortened IP addresses): deleted automatically after 12 months.
- Lost-item and vehicle alerts: kept with the owner’s tag history until the owner deletes it or their account.
- Call connection data: about two minutes. Zone chat: 24 hours. Sign-in and reply links: until they expire.
- Orders, invoices and payment records: as long as Nepal’s tax and accounting laws require.
- Reviews you post stay visible until you delete them or your account.
10. Your rights
Depending on where you live, you have the right to:
- Access your data and get a copy in a portable format.
- Correct it — most of it you can edit yourself in your dashboard.
- Delete it — use Delete account in your profile settings (accounts created with Google confirm with their email), or email us to have anything else erased, such as records not linked to your login.
- Object to processing based on legitimate interests, or ask us to restrict it.
- Withdraw consent at any time (for example, remove your blood type or unsubscribe from emails).
- Complain to a data protection authority. In the EU / UK that is the authority in your country.
To use any of these rights, email privacy@flap.com.np from the email address on your account (or tell us how to verify you). We answer within 30 days and do not charge for it.
If you are a business’s customer and want data that business entered about you changed or removed, you can contact the business directly or contact us and we will help.
11. Security
We use encrypted connections (HTTPS), hashed passwords, access controls and limits on repeated requests. No online service can be 100% secure, so please use a strong password, keep your sign-in private and tell us at privacy@flap.com.np if you think your account has been misused. If a breach puts your data at risk, we will tell you and the relevant authorities as the law requires.
12. Children
The Services are not meant for children under 16 and we do not knowingly collect their data. If you are under 18, please get a parent or guardian’s permission before buying anything. If you believe a child has given us personal data, contact us and we will delete it.
13. Changes to this policy
We will update this policy when the Services change. The date at the top shows the latest version. If a change is important, we will tell you by email or in the app before it takes effect.
14. Contact us
Flap Tech Pvt. Ltd.
Lazimpat-2, Kathmandu, Nepal
Email: privacy@flap.com.np