1. Introduction and Scope
This Privacy Policy describes how Jootsing Research Inc., a Delaware corporation with its principal place of business in San Francisco, California (“Company,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information in connection with the TapKit platform, including the TapKit API, macOS application, and all related services (collectively, the “Service”), and our website at tapkit.ai (the “Website”). TapKit is a product of Jootsing Research Inc. and is not a separate legal entity.
Because our data practices for the Service and for the Website differ materially, this Policy describes them separately: Section 3 covers information collected in connection with the Service, and Section 4 covers information collected on the Website. Sections 5 through 16 apply to both unless otherwise stated.
This Privacy Policy does not apply to third-party applications, websites, or services that you access or interact with through devices controlled by the Service. Those third parties have their own privacy policies, and we encourage you to review them.
Capitalized terms not defined in this Policy (including “Controlled Device,” “Customer Content,” “Third-Party Application,” and “Restricted Data”) have the meanings given in our Terms of Service.
2. Our Roles
We act in two distinct capacities. For account, billing, usage, and Website data, we determine the purposes and means of processing and act as the business or controller. For the contents of workflow inputs, screenshots, live streams, and automation session data processed at your direction (“In-Session Data”), you are the controller (or the equivalent under applicable law) and we act as your processor or service provider, as described in Section 12.
3. Information We Collect in Connection with the Service
3.1 Account Information
When you create an account, we collect information necessary to set up and manage your account, including your full name, email address, company or organization name, and password (stored in hashed form).
3.2 Billing Information
Payment processing for your TapKit subscription is handled by Stripe, Inc. TapKit does not directly store your full subscription payment card number or payment credentials. Please refer to Stripe’s privacy policy at https://stripe.com/privacy for information on how Stripe handles your payment data. We may receive limited billing information, such as the last four digits of your card number, card type, expiration date, and billing address, to display billing history and communicate about your subscription. Payment details used within Third-Party Applications during your authorized workflows are handled as In-Session Data under Section 3.5.
3.3 Service Usage Data
When you use the Service, we automatically collect certain technical and usage information, including API call logs (timestamps, endpoints called, response codes, and request metadata); session data (connection events, device pairing status, automation execution logs); the number of connected devices and active sessions; feature usage patterns and frequency; error logs and diagnostic data; and macOS application version and system information.
3.4 Device Metadata
To provide the Service, we collect metadata about connected devices, including device name, Unique Device Identifier (UDID), device model and model number, device serial number, hardware identifier, iOS version, phone number associated with the device, Wi-Fi MAC address, Bluetooth MAC address, battery level, device color code, and the list of installed applications on the Controlled Device. We may also collect Wi-Fi MAC addresses from Host Machines (macOS computers) used to operate the Service. The specific data points collected may vary depending on the device type, iOS version, and Service features in use.
3.5 Screenshots and Session Data
In the course of providing the Service, TapKit captures screenshots of Controlled Devices to execute automation commands, deliver API responses, and provide session traces and logs to you. Screenshots are captured in connection with automation commands and API requests initiated by you or a Third-Party Client acting on your behalf. Live screen streaming occurs only when you initiate it, to provide remote viewing and interaction. TapKit personnel do not view those live streams. We do not monitor your device screens in the background.
Screenshots and session data reflect the content displayed on your device and the inputs and actions used in your workflows. Depending on the workflows you authorize, they may include personal information about you or third parties, credentials, verification codes, payment details, or other sensitive information. We treat this information as In-Session Data and Customer Content, processed on your behalf as described in Section 12 to execute your automation commands, deliver visual traces and session logs, and diagnose errors and reliability issues. Retention and deletion are described in Section 9. You may request deletion by emailing privacy@tapkit.ai.
3.6 Automation Trajectories
We may record and retain automation trajectories — the ordered sequence of actions taken, screenshots captured, device states observed, and results produced during an automation session. We use trajectories to diagnose failures and debug automation workflows, to measure and improve automation accuracy and reliability, and for internal product analytics. We do not use trajectories to train machine-learning models except as described in Section 7. Trajectories are retained in accordance with Section 9, and you may request deletion at any time by contacting privacy@tapkit.ai.
3.7 AI and LLM Processing
To provide automation capabilities, the Service transmits screenshots and other device interaction data to third-party AI and large language model (“LLM”) providers for processing. These transmissions are made solely to execute your automation commands and deliver the Service. Our current AI/LLM providers are listed in Section 8. All AI/LLM providers are used solely to process automation commands on your behalf and are contractually bound to maintain the confidentiality of data transmitted to them.
3.8 Communications Data
When you contact us via email, support channels, or forms on our Website, we collect the content of your communications along with associated metadata (such as your email address and timestamps) to respond to your inquiries and improve our Service.
4. Information We Collect on the Website
4.1 Web Analytics
When you visit tapkit.ai, we may collect standard web analytics data, including IP address, browser type and version, operating system, pages visited and referring URLs, and date and time of visit.
4.2 Advertising Pixels
With your consent where required, we use advertising pixels and tags from third-party platforms — currently Meta (Meta Pixel), Google (Google Ads), TikTok (TikTok Pixel), and LinkedIn (LinkedIn Insight Tag) — to measure the effectiveness of our advertising campaigns, understand which marketing channels drive sign-ups, and deliver targeted advertisements to Website visitors on those platforms’ networks. These technologies may collect your IP address, browser and device identifiers, pages visited, actions taken on the Website (such as signing up or clicking a link), and cookie data, and transmit that information to the respective advertising platforms. This activity constitutes “sharing” of personal information for cross-context behavioral advertising under certain state privacy laws; Section 11.2 describes your right to opt out.
4.3 B2B Visitor Identification
We use a B2B visitor identification service (RB2B) that may match your visit to publicly available business contact information — such as your name, company name, professional email, or LinkedIn profile — using IP-based reverse lookup, device signals, and third-party identity graphs. This means we may learn your identity from your visit even if you do not fill out a form. This service is used for B2B sales outreach, is active only after you accept the corresponding cookies on our Website, and constitutes “sharing” under certain state privacy laws. You may opt out as described in Section 11.2, including through your cookie preferences.
4.4 Cookies and Similar Technologies
Our Website uses cookies and similar technologies. The types we use include:
- Strictly necessary cookies. Required for the Website to function and cannot be disabled.
- Analytics cookies. Help us understand how visitors interact with the Website.
- Functional cookies. Enable enhanced functionality and personalization.
- Marketing and advertising cookies. Placed by the third-party advertising platforms described in Section 4.2. The data collected by these cookies is governed by the respective platforms’ privacy policies.
- Visitor identification technologies. The RB2B service described in Section 4.3.
You can accept or change your cookie preferences at any time using the “Cookie preferences” link in the footer of our Website, or through your browser settings. Disabling cookies may affect Website functionality. We also honor opt-out preference signals as described in Section 11.5.
5. What We Do Not Do
To be clear about the boundaries of our data practices:
- No background monitoring. We do not monitor your device screens in the background. Screenshots are captured in connection with your automation commands and API requests, including those initiated by a Third-Party Client acting on your behalf. Live screen streaming occurs only when you initiate it for remote viewing and interaction, and TapKit personnel do not view those live streams.
- Credentials used only for authorized workflows. When you authorize a workflow such as signing in, retrieving a verification code, or completing a checkout, the Service may process the credentials, codes, or payment details needed to carry it out. We do not use those details to access accounts or perform transactions independently of your instructions. These details may be included in stored screenshots or session data and are subject to Section 9.
- Limits on regulated uses. The Service is not offered as a regulated-data repository. Workflows involving Restricted Data are subject to Section 5.3 of the Terms. Sensitive information that is submitted or captured during a permitted workflow is handled as Customer Content, and deletion may be requested at privacy@tapkit.ai.
- No profiling of third parties. We do not use information about individuals who appear in your automation sessions — such as contacts, users, or subjects within Third-Party Applications — to build profiles of those individuals, to market to them, or for any purpose other than providing the Service to you.
- No sale of personal information. We do not sell personal information for monetary consideration in any context. Our use of advertising and visitor-identification technologies on the Website constitutes “sharing” under certain state laws, as described in Sections 4 and 11.2, and you can opt out of it.
6. How We Use Information
We use the information we collect for the following purposes:
- Providing and operating the Service: creating and managing accounts; connecting and managing Controlled Devices; processing and executing automation commands; generating and delivering API responses, including screenshots when requested; and processing payments and managing subscriptions.
- Improving and developing the Service: analyzing usage patterns; identifying and fixing bugs, errors, and performance issues; reviewing screenshots and session data to diagnose automation failures and improve Service reliability; developing new features; and conducting internal research and analytics. Use of Customer Content for model training is governed exclusively by Section 7.
- Communication: sending transactional communications (account confirmations, billing receipts, service alerts); providing customer support; sending product updates relevant to your use of the Service; and sending marketing communications (only with your consent where required by law; you may opt out at any time).
- Website marketing and advertising: measuring advertising effectiveness, understanding which channels drive sign-ups, delivering targeted advertisements, and identifying business visitors for B2B sales outreach — in each case as described in Section 4 and subject to your opt-out rights.
- Security, enforcement, and legal compliance: securing the Service; enforcing our Terms of Service and Acceptable Use Policy; complying with applicable legal obligations; and responding to lawful requests from governmental authorities.
7. AI Model Training
Default: no training without opt-in. We do not use your screenshots, automation trajectories, or other Customer Content to train or improve machine-learning or artificial-intelligence models — whether ours or a third party’s — unless you expressly opt in.
If you opt in. If you choose to allow training use, we will de-identify or aggregate trajectory data before using it for model training or benchmarking wherever feasible. You may withdraw your consent at any time with prospective effect; data already incorporated into trained models or into de-identified aggregate datasets that no longer identify you may not be retrievable or deletable.
Execution is not training. Transmitting screenshots and interaction data to our AI/LLM providers to execute your automation commands, as described in Section 3.7, is not a training use.
9. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, taking into account the nature and sensitivity of the information, the service you request, operational and security needs, and applicable legal obligations. The criteria below describe how retention is determined. We do not currently operate an automatic deletion schedule for screenshots or automation trajectories, and they do not automatically expire after 90 days. You may request deletion of your account, screenshots, session data, or trajectories by emailing privacy@tapkit.ai. We handle deletion requests manually, subject to identity verification and applicable legal exceptions, and respond within the time required by applicable law. When information is no longer necessary for an applicable purpose, we will delete or de-identify it. Where immediate deletion from backups is not possible, retained copies remain protected and are not used for ordinary operations pending deletion.
| Category | Retention period or criteria |
|---|---|
| Account information | For account administration while the account is active, and afterward only as necessary to resolve outstanding matters or meet legal obligations; deletion may be requested by email. |
| Billing information | Up to 7 years (tax and accounting compliance) |
| Service usage data (API logs, session data) | As reasonably necessary to operate and secure the Service, investigate errors, and resolve support issues, considering the sensitivity of any content in the logs; deletion may be requested by email. |
| Screenshots and visual data | As reasonably necessary to provide requested session traces and investigate workflow failures or support issues. No automatic 90-day expiry; deletion may be requested by email. |
| Automation trajectories | As reasonably necessary to provide and troubleshoot your workflows. No automatic 90-day expiry; deletion may be requested by email. Training use requires the separate opt-in described in Section 7. |
| Device metadata | While needed to connect and manage the device, and afterward only as necessary for operational, security, or legal purposes. |
| Website analytics data | Per our analytics providers’ retention policies, typically no longer than 24 months |
| Communications data | As long as reasonably necessary to resolve your inquiry and for our records, typically no longer than 24 months |
10. Data Security
We implement commercially reasonable administrative, technical, and physical safeguards designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit using TLS/SSL; encryption of sensitive data at rest; secure hashing of passwords; access controls limiting employee access to personal information on a need-to-know basis; regular security assessments of our systems and practices; and API key authentication and rate limiting. While we strive to protect your personal information, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.
11. Your Rights and Choices
11.1 All Users
You may access, update, or correct your account information at any time through your account settings. To delete your account, contact us at privacy@tapkit.ai. You may opt out of marketing emails by clicking the “unsubscribe” link in any marketing email or by contacting privacy@tapkit.ai; you will continue to receive transactional communications related to your account.
11.2 California Residents
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), gives you rights to know, delete, and correct personal information we hold about you; to opt out of the sale or sharing of personal information; and to be free from discrimination for exercising these rights. We do not sell personal information. We do “share” certain Website data for cross-context behavioral advertising, as described in Sections 4.2 and 4.3. You may opt out of sharing via the “Do Not Sell or Share My Personal Information” link in the footer of our Website, by broadcasting an opt-out preference signal as described in Section 11.5, or by contacting privacy@tapkit.ai.
The following table summarizes the categories of personal information we have collected in the preceding 12 months, with recipients and sale/sharing status:
| Category | Examples | Disclosed To | Sold / Shared? |
|---|---|---|---|
| Identifiers | Name, email, account identifiers, IP address | Service providers (hosting, payments, support); advertising platforms (Website identifiers only) | Not sold. Website identifiers “shared” unless you opt out |
| Commercial information | Subscription history, billing records | Payment processor; service providers | Not sold or shared |
| Internet or other network activity | Service usage logs; Website browsing and interaction data | Service providers; advertising platforms (Website data only) | Not sold. Website activity “shared” unless you opt out |
| Geolocation (coarse) | IP-derived approximate location | Service providers; advertising platforms | Not sold. Website data “shared” unless you opt out |
| Professional information | Company, business email, LinkedIn profile (via B2B visitor identification on the Website) | B2B identification provider; sales tools | Not sold. “Shared” — consent-gated; opt-out available |
| Audiovisual or similar information | Screenshots of Controlled Devices captured during automation sessions you initiate | AI/LLM and hosting subprocessors, solely to provide the Service | Not sold or shared |
| Inferences | Product usage patterns (analytics) | Analytics service providers | Not sold or shared |
Sensitive personal information may be processed when it is submitted or displayed during workflows you authorize, including account credentials, payment details, and the contents of messages. We do not use sensitive personal information to infer characteristics about you, and we use and disclose it only for purposes permitted by 11 C.C.R. § 7027(m). Retention criteria are set out in Section 9. You may designate an authorized agent to submit requests on your behalf. We will verify your identity before acting on a request where appropriate and will not discriminate against you for exercising your rights. To exercise your rights, contact privacy@tapkit.ai.
11.3 Other U.S. State Privacy Rights
Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Tennessee, Maryland, and other states with comprehensive privacy laws may have rights to confirm whether we process their personal data; to access, correct, delete, and obtain a portable copy of it; and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects. We do not sell personal data or engage in such profiling; our Website advertising practices constitute targeted advertising, which you may opt out of as described in Sections 11.2 and 11.5. To exercise any right, contact privacy@tapkit.ai. If we decline to act on your request, you may appeal by replying to our response with the word “Appeal”; if your appeal is unsuccessful, you may contact your state Attorney General.
11.4 EEA, United Kingdom, and Switzerland
If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following legal bases: (a) performance of a contract (to provide the Service); (b) legitimate interests (to secure and improve the Service and communicate with you); and (c) consent (for marketing communications, advertising cookies, and visitor-identification technologies, where applicable). You have the rights of access, rectification, erasure, restriction of processing, data portability, and objection, and the right to withdraw consent at any time with prospective effect. To exercise these rights, contact privacy@tapkit.ai. You also have the right to lodge a complaint with a supervisory authority in your jurisdiction.
Your personal data may be transferred to and processed in the United States, where our servers and operations are located. Where such transfers occur from the EEA, UK, or Switzerland, we rely on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission (supplemented by the UK Addendum or International Data Transfer Agreement where applicable).
11.5 Opt-Out Preference Signals
We recognize and honor opt-out preference signals, including the Global Privacy Control (GPC), as a valid request to opt out of the sharing of personal information for cross-context behavioral advertising for the browser or device transmitting the signal. Because there is no industry consensus on interpreting legacy “Do Not Track” signals, we treat GPC as the operative opt-out signal.
12. Data Processing on Behalf of Customers
When you use the Service to automate devices, you may process personal data of third parties (for example, data visible in applications on your Controlled Devices). For that In-Session Data, you are the data controller (or the equivalent under applicable law) and TapKit acts as your data processor or service provider. In that capacity, we process In-Session Data only on your documented instructions — which include executing your automation commands, delivering session traces to you, and debugging and securing the Service as permitted by our agreement with you — and not for our own purposes, except as expressly permitted by Section 7 if you opt in to training.
You are responsible for ensuring that your use of the Service complies with all applicable privacy laws, including providing any required notices and obtaining any required consents from individuals whose personal data is displayed or processed during your automation sessions. Our Data Processing Agreement, which includes the Standard Contractual Clauses where applicable, is available at https://tapkit.ai/dpa or by contacting privacy@tapkit.ai.
13. Children’s Privacy
The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe that a child has provided us with personal information, please contact us at privacy@tapkit.ai.
14. Third-Party Links and Services
The Service and Website may contain links to third-party websites, applications, or services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. If we make material changes, we will notify you by posting the updated Privacy Policy on our Website and, where appropriate, by sending you an email notification before the changes take effect. We will not use previously collected personal information in ways that are materially different from what was disclosed at the time of collection without providing notice and obtaining any consent required by applicable law.
16. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
Email: privacy@tapkit.ai
Jootsing Research Inc., San Francisco, California
For questions about our Terms of Service, please visit https://tapkit.ai/terms or contact legal@tapkit.ai.