Privacy Policy

Last updated: 5 April 2026

Good Moves Studio ("we", "us") operates the TapIn loyalty stamp card system. This policy explains what personal data we collect when you use TapIn, why we collect it, how long we keep it, and your rights under the EU General Data Protection Regulation (GDPR).

1. Data controller

Good Moves Studio
Prenzlauer Berg, Berlin, Germany
Contact: info@goodmovesstudio.com

2. What we collect

• Phone number — required to identify you across visits and to send your stamp card link.
• First and last name (optional) — collected when you redeem your 10th-visit reward class.
• Visit history — the date and time of each stamp you earn.
• Device push token (optional) — if you add the stamp card to Apple Wallet or Google Wallet, we receive an anonymous push token that lets the wallet app auto-update your card after each visit. We cannot use this token for any other purpose.

3. Why we collect it (legal basis)

• Contract performance (Art. 6(1)(b) GDPR) — running the stamp card program you're participating in.
• Legitimate interest (Art. 6(1)(f) GDPR) — fraud prevention (detecting duplicate check-ins).
• Consent (Art. 6(1)(a) GDPR) — SMS delivery. You explicitly agree to receive one SMS per member containing your wallet pass download link.

4. Who we share it with

We share the minimum necessary data with these processors under standard Data Processing Agreements:

• Twilio (US / Ireland) — SMS delivery. Receives your phone number and the one-time welcome message only.
• Railway (US) — hosts our database.
• Apple — if you add the pass to Apple Wallet, Apple's push notification service delivers update pings. Apple does not see your phone number or visit data.
• Google — same as above for Google Wallet on Android.
• Mindbody (US) — if you already have a Mindbody account with the studio, we link your TapIn record to your existing Mindbody client so your reward class can be automatically applied.

We do not sell your data. We do not share it with advertisers. We do not run any analytics or tracking on this service.

5. How long we keep it

• Active members: as long as you have an active stamp card, plus 24 months after your last visit.
• Inactive members: 24 months after your last visit, then automatic deletion.
• Deleted on request: immediately, with no backup recovery.

6. Your rights (GDPR)

• Right to access (Art. 15) — request a copy of everything we have on you.
• Right to rectification (Art. 16) — correct any inaccurate data.
• Right to erasure (Art. 17) — delete your data immediately. Use our self-service form at /delete-my-data.
• Right to object (Art. 21) — stop processing your data for marketing or any other purpose.
• Right to complain — lodge a complaint with the Berlin data protection authority (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

7. Cookies and tracking

This service does not use cookies, analytics, fingerprinting, or any third-party tracking.

8. Changes to this policy

We will notify you of material changes via the wallet pass update mechanism or by email. The "last updated" date at the top of this page always reflects the current version.