Privacy Policy

Version 1.0 — Effective July 27, 2026

1. Introduction

TapLure, LLC (“TapLure,” “Company,” “we,” “us,” or “our”) operates a technology marketplace platform that connects independent licensed massage therapists (“Therapists”) with spas, hotels, clinics, resorts, and other venues (“Venues”). This Privacy Policy describes how we collect, use, disclose, store, and protect your personal information when you access or use the TapLure website, mobile application, and related services (collectively, the “Platform”).

By using the Platform, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree with the practices described herein, you must not use the Platform.

TapLure is a technology platform — not a massage therapy provider, staffing agency, employment agency, or employer. Nothing in this Privacy Policy creates an employment, agency, or joint-venture relationship between TapLure and any user.

2. Information We Collect

2.1. Information You Provide Directly

We collect information you voluntarily provide when creating an account, using the Platform, or communicating with us.

For All Users:

• (a) Name, email address, phone number, and mailing address;
• (b) Account login credentials;
• (c) Profile information, including profile photographs;
• (d) Communications with other Users through the Platform;
• (e) Communications with TapLure, including customer support inquiries.

For Therapists (in addition to the above):

• (f) Massage therapy license number, issuing state, and expiration date;
• (g) Professional certifications and credentials (including CPR/First Aid certification);
• (h) Professional liability insurance information (ABMP, AMTA, or equivalent — $1M/$3M minimum);
• (i) Social Security Number or Employer Identification Number (for tax reporting and background check purposes);
• (j) Date of birth;
• (k) Consent forms and authorization for background checks;
• (l) Child Abuse clearance documentation (where required by state law);
• (m) Banking or payment account information for receiving payments;
• (n) Work history, specializations, and professional references;
• (o) Availability and scheduling preferences.

For Venues (in addition to the above):

• (p) Business name, type, and description;
• (q) Business address(es) and location(s);
• (r) Employer Identification Number (if applicable);
• (s) Business license and insurance documentation;
• (t) Billing and payment information, including credit card or bank account details;
• (u) Authorized representative contact information.

2.2. Information Collected from Third Parties

We may receive information about you from third-party sources, including:

• (a) Background Check Providers. Criminal history records, sex offender registry results, identity verification results, and other information obtained through background screening services. Background check data is subject to applicable federal and state consumer reporting laws, including the Fair Credit Reporting Act (“FCRA”).
• (b) License Verification Services. Confirmation of license status, disciplinary history, and related information from state licensing boards or third-party verification services.
• (c) Payment Processors. Transaction data, payment confirmation, and fraud screening results from our third-party payment processing partners.
• (d) Identity Verification Services. Results from identity verification procedures, including document authentication.

2.3. Information Collected Automatically

When you access or use the Platform, we automatically collect certain information, including:

• (a) Device information (device type, operating system, unique device identifiers);
• (b) Log data (access times, pages viewed, IP address, referring URL);
• (c) Location data (with your consent, precise geolocation data; without consent, approximate location based on IP address);
• (d) Usage data (features used, search queries, interactions with other Users);
• (e) Cookies, pixel tags, and similar tracking technologies (see Section 8).

3. How We Use Your Information

We use the information we collect for the following purposes:

• (a) Platform Operations: To create and manage your account, facilitate connections between Therapists and Venues, process transactions, and provide customer support;
• (b) Verification and Safety: To verify Therapist licenses, conduct background checks, verify identities, and promote the safety and integrity of the Platform;
• (c) Payment Processing: To process payments between Venues and Therapists, issue refunds, and generate tax documents (Form 1099-NEC);
• (d) Communications: To send you service-related notices, updates, security alerts, and administrative messages;
• (e) Improvement: To analyze usage patterns, troubleshoot technical issues, and improve the Platform’s features and functionality;
• (f) Marketing: To send promotional communications about TapLure’s services (you may opt out at any time);
• (g) Legal Compliance: To comply with applicable laws, regulations, legal processes, or governmental requests;
• (h) Fraud Prevention: To detect, investigate, and prevent fraudulent, unauthorized, or illegal activity;
• (i) Dispute Resolution: To resolve disputes between Users and enforce our Terms of Service.

4. How We Share Your Information

We may share your information with the following categories of recipients:

• (a) Other Users. When a Therapist and Venue engage through the Platform, certain profile information is shared between the parties as necessary to facilitate the engagement. Therapist profiles may display their name, profile photo, qualifications, ratings, reviews, and general availability. Venue profiles may display the business name, location, and engagement history. TapLure does not control what a Therapist or Venue does with information shared through the Platform.
• (b) Background Check and Verification Providers. We share personal information with third-party providers to conduct background checks, license verifications, and identity verifications as described in Section 2.2.
• (c) Payment Processors. We share payment information with third-party payment processors to facilitate transactions.
• (d) Service Providers. We may share information with third-party vendors, consultants, and service providers who perform services on our behalf, such as hosting, data analytics, customer support, email delivery, and marketing.
• (e) Legal Obligations. We may disclose your information if required by law, regulation, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of TapLure, our Users, or the public.
• (f) Business Transfers. In connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred to the acquiring entity. We will notify you via email or a prominent notice on the Platform before your information becomes subject to a different privacy policy.
• (g) With Your Consent. We may share your information with third parties when you have provided explicit consent.

5. Background Check Data — Special Provisions

Background check data is collected and processed in compliance with the Fair Credit Reporting Act (“FCRA”) and applicable state consumer reporting laws.

Before a background check is initiated, Therapists will receive a clear and conspicuous written disclosure (separate from all other documents) and must provide written authorization, as required by the FCRA.

If an adverse action is taken based in whole or in part on information contained in a background check report (for example, denial of access to the Platform), TapLure will provide the affected individual with:

• (a) A pre-adverse action notice, including a copy of the consumer report and a summary of rights under the FCRA;
• (b) A reasonable waiting period (no less than five business days) before taking final action;
• (c) A final adverse action notice after the waiting period has elapsed, including the name and contact information of the consumer reporting agency, a statement that the agency did not make the adverse decision, and notice of the individual’s right to dispute the accuracy of the report and obtain an additional free copy.

Background check data is stored securely and access is limited to authorized personnel with a legitimate business need. Background check reports are retained for a period of three (3) years from the date the report was obtained, or as required by applicable law, whichever is longer. TapLure does not use background check information for any purpose other than evaluating a Therapist’s eligibility to use the Platform.

6. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, use, alteration, and destruction. These measures include:

• (a) Encryption of sensitive data in transit (TLS 1.2 or higher) and at rest;
• (b) Access controls limiting access to personal information to authorized personnel on a need-to-know basis;
• (c) Regular security assessments and vulnerability testing;
• (d) Secure data storage with industry-standard infrastructure providers;
• (e) Multi-factor authentication for administrative accounts;
• (f) Incident response procedures for potential data breaches.

Despite our efforts, no method of electronic storage or transmission over the Internet is completely secure. We cannot guarantee the absolute security of your information. You acknowledge and accept this inherent risk.

7. Data Breach Notification

In the event of a data breach that compromises your personal information, TapLure will:

• (a) Investigate and contain the breach promptly;
• (b) Notify affected individuals without unreasonable delay, and in no event later than required by applicable state and federal law;
• (c) Provide a description of the breach, the types of information involved, and steps individuals can take to protect themselves;
• (d) Notify state attorneys general, the Federal Trade Commission, and/or other regulatory bodies as required by law;
• (e) Offer identity theft protection services when the breach involves Social Security Numbers or financial account information.

8. Cookies and Tracking Technologies

We use cookies, pixel tags, and similar tracking technologies to collect usage data, remember your preferences, and improve the Platform.

Types of Cookies We Use:

• (a) Essential Cookies: Required for the Platform to function (authentication, security, load balancing). These cannot be disabled.
• (b) Analytics Cookies: Help us understand how users interact with the Platform (page views, session duration, error rates).
• (c) Preference Cookies: Remember your settings and choices (language, region, display preferences).

You may manage your cookie preferences through your browser settings, though disabling cookies may affect the functionality of the Platform. We may use third-party analytics services (such as Google Analytics) that use cookies and similar technologies to collect and analyze usage information. We do not use cookies for targeted advertising.

9. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Platform’s services. Specific retention periods include:

• (a) Account information: Duration of account plus two (2) years after deletion or deactivation;
• (b) Transaction and payment records: Minimum of seven (7) years as required by federal tax laws;
• (c) Background check reports: Three (3) years from the date obtained, or as required by applicable law;
• (d) Communications and support records: Three (3) years from the date of last communication;
• (e) Automatically collected data (logs, usage): Two (2) years;
• (f) Dispute and legal records: Duration of the matter plus applicable statute of limitations.

Upon account deletion or deactivation, we will delete or anonymize your personal information within ninety (90) days, except as required to fulfill the retention obligations described above.

10. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• (a) Access. The right to request a copy of the personal information we hold about you;
• (b) Correction. The right to request correction of inaccurate or incomplete personal information;
• (c) Deletion. The right to request deletion of your personal information, subject to certain exceptions (such as legal retention requirements);
• (d) Portability. The right to request a copy of your information in a structured, commonly used, machine-readable format;
• (e) Opt-Out of Marketing. The right to opt out of marketing communications at any time by following the unsubscribe instructions in our emails or contacting us directly;
• (f) Location Data. You may disable location services through your device settings at any time;
• (g) Do Not Sell or Share. The right to opt out of the sale or sharing of your personal information (see Section 11).

To exercise any of these rights, please contact us at privacy@taplure.com. We will respond to your request within the timeframe required by applicable law, and in no event later than forty-five (45) days from receipt of a verifiable request.

We will not discriminate against you for exercising any of these rights. We will not deny you services, charge different prices, or provide a different level of service because you exercised a privacy right.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”).

11.1. Categories of Personal Information Collected

In the preceding twelve (12) months, we have collected the following categories of personal information:

• (a) Identifiers (name, email, phone, SSN, license numbers);
• (b) Personal information under Cal. Civ. Code § 1798.80(e) (address, insurance policy number, education, employment history);
• (c) Protected classification characteristics (age, date of birth);
• (d) Commercial information (transaction history, services purchased/provided);
• (e) Internet or other electronic network activity (browsing history, search history, interaction with Platform);
• (f) Geolocation data;
• (g) Professional or employment-related information (license, certifications, work history);
• (h) Inferences drawn from any of the above to create a profile about you.

11.2. Your California Rights

As a California resident, you have the right to:

• (a) Know what personal information is collected, used, shared, and sold;
• (b) Delete personal information held by us and our service providers;
• (c) Correct inaccurate personal information;
• (d) Opt out of the sale or sharing of personal information;
• (e) Limit use of sensitive personal information to specified purposes;
• (f) Non-discrimination for exercising your rights.

To exercise these rights, contact us at privacy@taplure.com or use our “Do Not Sell or Share My Personal Information” mechanism when available on the Platform. We will verify your identity before processing any request. You may designate an authorized agent to submit a request on your behalf.

11.3. Sale and Sharing Disclosure

TapLure does not sell your personal information. TapLure does not share your personal information for cross-context behavioral advertising. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

11.4. Sensitive Personal Information

We collect certain sensitive personal information (SSN, precise geolocation, background check results) solely for the purposes of providing the Platform services, verifying identity and eligibility, conducting background checks, and complying with legal obligations. We do not use sensitive personal information for purposes beyond those permitted under the CCPA/CPRA.

12. Other State Privacy Rights

Residents of states with applicable consumer privacy laws — including but not limited to Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and Texas (TDPSA) — may have additional rights including the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, profiling, and the sale of personal data.

To exercise any rights available to you under applicable state privacy law, contact us at privacy@taplure.com. We will process your request in accordance with the applicable law’s requirements and timelines.

13. Children’s Privacy

The Platform is not intended for individuals under the age of eighteen (18). We do not knowingly collect personal information from children under eighteen (18). If we learn that we have collected personal information from a child under eighteen (18), we will take steps to delete such information promptly. If you believe a child under eighteen (18) has provided us with personal information, please contact us at privacy@taplure.com.

14. Third-Party Links and Services

The Platform may contain links to third-party websites or services that are not operated or controlled by TapLure. This Privacy Policy does not apply to those third-party websites or services. We are not responsible for the privacy practices of any third party. We encourage you to review the privacy policies of any third-party websites or services you visit.

15. Data Minimization

TapLure follows the principle of data minimization. We collect only the personal information that is reasonably necessary to operate the Platform, comply with legal requirements, and fulfill the purposes described in this Privacy Policy. We do not collect personal information that is unrelated to our services, and we periodically review our data collection practices to ensure they remain proportionate to our needs.

16. International Data

The Platform is operated from the United States. If you access the Platform from outside the United States, your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those of your jurisdiction. By using the Platform, you consent to the transfer of your information to the United States.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Privacy Policy on the Platform and updating the “Last Updated” date at the top of this page. For material changes that affect how we use or share your personal information, we will provide at least thirty (30) days’ advance notice via email to the address associated with your account. Your continued use of the Platform following such changes constitutes your acceptance of the updated Privacy Policy.

18. Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:

Last Updated: July 27, 2026