Privacy Policy

Who we are

TakFap Review (“TakFap”, “we”) provides guest feedback, review management and the TakFap Review mobile app for restaurants. This policy explains what we collect on our website, on guest feedback pages and in the app, and what we do with it.

For questions or requests, contact us on WhatsApp at +355 69 962 2685.

Restaurant accounts

When a restaurant owner or team member uses TakFap, we process:

• Name, email address and password (stored only as a secure hash)
• Restaurant and location details, logos, QR codes, guest questions and staff names added by the restaurant
• Team roles and which locations each person can access
• Sign-in sessions, including IP address and browser or device type, and a log of important account actions for security
• Notification settings and, in the app, a push notification token and device name

Guests who leave feedback

Guests do not need an account. When a guest scans a restaurant's QR code, we process:

• Star ratings, written answers and categories the guest chooses
• The staff member the guest selects, if the restaurant asks
• The browser language, to show the page correctly
• A one-way daily code made from the IP address and browser, used only to count scans without identifying anyone
• The IP address, for a short time, to prevent spam and abuse

We do not ask guests for their name, email or phone number. Feedback is visible only to the restaurant's team.

Google Business Profile

If a restaurant connects its Google Business Profile, we import its Google reviews (reviewer name, rating, text and replies) and store Google access tokens encrypted. The restaurant can disconnect at any time.

Loyalty cards (TakFap Loyalty)

Some restaurants offer a digital loyalty card through TakFap. Joining is optional and needs no account: the card lives behind a private link that only the guest has. We store only a scrambled version of that link, so we cannot open the card for anyone. When a guest joins or uses a card, we process:

• A card number, the stamps or points collected, rewards unlocked and used, and when and at which location each visit was confirmed — with the bill amount on points cards
• Only if the guest chooses to give them: name, phone number and birthday (day and month)
• Whether the guest agreed to receive offers and messages from the restaurant, and the language they use
• The latest offer or reminder sent to the card
• If the guest adds the card to Apple Wallet or Google Wallet: a device identifier and push token from Apple, or the pass held by Google, so the card can update itself
• If the guest searches for cards nearby: their approximate position, used once for that search and not stored
• The IP address, for a short time, to prevent abuse of joining and of the staff PIN

The restaurant's team sees its own members and their details, to give stamps and rewards. Offers and reminders are sent only to guests who agreed, at most one automatic message a week, and the guest can change this on the card at any time. Rewards are never tied to leaving a review.

A guest can change their details or delete the card themselves from the card page (“Your details” → “Delete my card”). Personal details are erased at once; only anonymous totals (such as the number of visits) stay with the restaurant.

How we use data

• To provide the service: collecting feedback, alerting the restaurant and showing reports
• To analyze Google reviews and draft replies with AI, when the restaurant uses this feature
• To keep accounts secure and prevent abuse
• To contact restaurants about their account

We do not sell personal data and we do not use it for advertising.

Service providers

We use trusted providers to run TakFap. They process data only on our behalf:

• Encore Cloud — application hosting and database
• Vercel — website hosting
• DeepSeek — AI analysis and reply drafts for Google review text (not private guest feedback)
• Expo, Apple and Google — delivery of push notifications to the app
• Google — reviews, only for restaurants that connect a Business Profile
• Apple Wallet and Google Wallet — loyalty cards that guests choose to add to their wallet

Some providers process data outside Albania and the European Union. We share only what each service needs.

Cookies and local storage

We use one essential cookie to keep you signed in. Your browser also stores simple preferences such as theme and language, and — for guests with a loyalty card — the link to their card, so they can find it again. We do not use advertising or tracking cookies.

How long we keep data

• Account and restaurant data: while the account is active. When you delete your account — in the app, or by asking us — we delete your personal data unless the law requires us to keep it.
• Guest feedback: for as long as the restaurant keeps its account, or until the restaurant or the guest asks us to delete it.
• Loyalty cards: for as long as the restaurant offers its card, or until the guest or the restaurant deletes the card.
• Expired sign-in sessions: deleted within 7 days.

Your rights

You can ask us to access, correct, export or delete your personal data, or object to how we use it. Restaurant team members can change most details themselves in Settings. You can delete your account yourself in the TakFap Review app: More → Settings → Delete account. Guests who want their feedback removed can contact the restaurant or us. Guests can delete their loyalty card themselves from the card page.

You can also complain to the data protection authority in your country — in Albania, the Commissioner for the Right to Information and Protection of Personal Data.

Security

Connections use HTTPS, passwords are hashed, Google tokens are encrypted, and each restaurant can see only its own data. No system is perfectly secure; if a serious breach affects you, we will tell you as the law requires.

Children

TakFap is made for businesses and is not directed at children under 16.

Changes

We may update this policy. We will change the date at the top and, for important changes, tell restaurants in the app or by message.