Privacy Policy

1. Who we are and how to contact us

NeonTap is operated by Neon Visuals, a sole proprietorship owned by Vikas Vishwakarma, having its principal place of business at Room No. 20, Vishwakarma Rahiwashi Sangh, Jogeshwari–Vikhroli Link Road, Mumbai, Maharashtra – 400093, India.

For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary in respect of the personal data described in this policy, and you are the Data Principal.

This policy explains what personal data we collect when you use NeonTap, why we collect it, how long we keep it, and the rights you hold over it. Write to us at contact@neonvisuals.in with any question about it.

2. What personal data we collect (account email, profile content, tap/scan analytics, payment metadata)

Account email. We collect the email address you use to sign in. We use it to send you a one-time sign-in code and to contact you about your account and your orders. We do not use passwords, so your email address is the identifier for your account.

Profile content. We store what you place on your Profile: your name, description, contact details, links and any other material you add. You choose this content and you can change or remove it at any time.

Order and delivery information. For a physical Card we collect your delivery name, address and phone number, and the details of the Card or Cards supplied to you.

Tap and scan analytics. When a Viewer opens a Profile we record a coarse-grained event so that we can show you how often your Card is being used. These records are deliberately minimal. We do not record the Viewer's IP address and we do not store a raw user-agent string. We do not identify Viewers and we do not build profiles of them.

Payment metadata. Payments are processed by our payment provider. We receive and store a record of the transaction — an identifier, the amount, the status and the date. We do not receive or store your full card number, your CVV, your UPI PIN or your bank credentials.

Technical and security records. We keep limited records needed to operate the service securely, including counters used to rate-limit sign-in attempts and to prevent abuse, and a record of your acceptance of our Terms and of this policy.

We do not collect special categories of sensitive personal data, and we ask that you do not place such data on a Profile.

3. How we use it, and the basis on which we do

We process your personal data for the following purposes:

• To provide the service — creating and authenticating your account, activating Cards, publishing your Profile, and resolving a tap or scan to your Profile.
• To fulfil orders — producing, despatching and delivering Cards, and handling replacements.
• To process payments and manage subscriptions — including renewal, cancellation and refunds.
• To show you your own analytics — the counts and trends we display in your dashboard.
• To keep the service secure — detecting and preventing abuse, fraud and unauthorised access.
• To communicate with you — sign-in codes, order updates, service notices, and replies to your enquiries.
• To comply with law — tax and accounting obligations, and responses to lawful requests from competent authorities.

We process this data on the basis of the consent you give when you create an account and accept this policy, and, where applicable, for the legitimate uses permitted under the Digital Personal Data Protection Act, 2023, including compliance with legal obligations.

We do not sell your personal data. We do not use your personal data for advertising, and we do not share it with advertisers.

4. Consent, and how to withdraw it

When you create an account we ask you to accept our Terms & Conditions and this policy. We record that acceptance, including the version accepted and the time of acceptance. Where we publish a materially changed version, we ask you to accept it again.

You may withdraw your consent at any time by writing to contact@neonvisuals.in and asking us to close your account.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Because the personal data described in section 2 is what makes the service work, withdrawing consent means we can no longer provide NeonTap to you: your Profile is unpublished, your username is released, and your Card ceases to resolve to a Profile. We retain only what we are required to retain under section 8.

5. Third parties and processors (Supabase, Vercel, Resend, Razorpay)

We use the following processors to operate NeonTap. Each processes personal data on our instructions and for no independent purpose of its own:

• Supabase — database, authentication and file storage. Holds account, profile, order and analytics records.
• Vercel — application hosting and content delivery. Processes requests to the service.
• Resend — transactional email delivery. Processes your email address and the contents of sign-in and notification emails.
• Razorpay — payment processing. Collects and processes your payment instrument details directly; we receive only the transaction metadata described in section 2.
• Courier partners — delivery of physical Cards. Receive the delivery name, address and phone number on your order.

Some of these providers process or store data outside India. Where that happens, we rely on the transfers permitted under applicable Indian law and on the contractual protections offered by each provider.

We disclose personal data to a third party outside this list only where you ask us to, or where we are required to do so by law or by order of a competent authority.

6. What becomes public when a profile is published

A published Profile is public. Everything you place on it — your name, description, contact details and links — can be seen by anyone who taps your Card, scans your QR code, or opens your link, and may be indexed by search engines.

Your account email address is not published unless you choose to display it as a contact method on your Profile.

Please do not publish information you are not willing for the public to see. You may unpublish a Profile at any time, which removes it from public view; copies already saved by a Viewer or cached by a search engine are outside our control.

7. Analytics and cookies

We use cookies and equivalent browser storage only where they are necessary to operate the service — principally to keep you signed in and to protect against abuse. We do not use advertising cookies, and we do not use third-party tracking or profiling tools on Profile pages.

Our analytics are first-party and deliberately coarse. We count events such as taps, scans and link clicks so that we can show a Profile owner how their Card is being used. As stated in section 2, we do not record Viewer IP addresses or raw user-agent strings, and Viewers are not identified.

A Viewer does not need an account, and we do not require a Viewer to accept anything in order to view a Profile.

8. Data retention

We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as the law requires.

• Account and profile data — kept while your account is open. On closure, we delete or irreversibly anonymise it within 30 days, except where a longer period is required below.
• Order and delivery records — kept for the period required by applicable tax and accounting law, currently at least 8 years from the end of the relevant financial year.
• Payment records — kept for the same statutory period. Payment instrument details are held by our payment provider, not by us.
• Analytics events — kept for 24 months, then deleted. These records do not identify Viewers.
• Security and rate-limit records — kept for a short operational period, ordinarily not more than 90 days.
• Records of consent — kept for as long as your account is open and for 3 years afterwards, so that we can demonstrate what you accepted and when.

Where deletion is not immediately possible because of backups, we isolate the data from active use and delete it on the normal backup rotation.

9. Rights of the data principal (access, correction, erasure)

Subject to applicable law, you have the right to:

• Access — obtain a summary of the personal data we hold about you and how we process it.
• Correction and completion — have inaccurate or incomplete data corrected. Most profile and account data can be corrected directly in the editor.
• Erasure — ask us to delete your personal data, subject to the retention periods in section 8.
• Withdraw consent — as described in section 4.
• Nominate — nominate another person to exercise your rights in the event of your death or incapacity.
• Grievance redressal — raise a complaint with us as described in section 10, and escalate to the Data Protection Board of India if you are not satisfied with our response.

To exercise any of these rights, write to contact@neonvisuals.in from the email address associated with your account. We may ask you to verify your identity before we act, so that we do not disclose your data to someone else.

We respond to a request within 30 days. Where a request is manifestly unfounded or repetitive, we may decline it and will tell you why.

10. Grievance officer and grievance redressal process

If you have a complaint about how we handle your personal data, write to our Grievance Officer:

Grievance Officer: Vikas Vishwakarma Email: contact@neonvisuals.in Address: Neon Visuals, Room No. 20, Vishwakarma Rahiwashi Sangh, Jogeshwari–Vikhroli Link Road, Mumbai, Maharashtra – 400093, India

We acknowledge every complaint within 48 hours of receiving it and aim to resolve it within 30 days. We will tell you in writing what we have decided and why.

If you are not satisfied with our response, or if we do not respond within the period above, you may complain to the Data Protection Board of India in accordance with the Digital Personal Data Protection Act, 2023.

11. Children

NeonTap is not intended for children. You must be at least 18 years of age to create an account, and we do not knowingly collect personal data from anyone under 18.

If we become aware that an account has been created by a person under 18, we close it and delete the associated personal data.

If you believe a child's personal data has been published on a Profile or provided to us, write to contact@neonvisuals.in and we will act promptly.

12. Changes to this policy and version history

We may update this policy. Each version carries a version number and an effective date, both shown at the top of this document.

Where a change materially affects how we handle your personal data, we ask you to accept the new version when you next sign in, and we record your acceptance against that version. Minor corrections that do not affect your rights may be made without a new acceptance.

The version in force at any time is the one published at tap.neonvisuals.in/legal/privacy.

13. Contact

Neon Visuals Room No. 20, Vishwakarma Rahiwashi Sangh, Jogeshwari–Vikhroli Link Road, Mumbai, Maharashtra – 400093, India

Email: contact@neonvisuals.in Business hours: Monday – Saturday, 9:00 AM – 7:00 PM IST