Legal
Privacy Policy
Last updated: 13 September 2026
This Privacy Policy explains how Shazark S.r.l. ("tapphost", "we", "us") collects, uses and protects your personal data when you visit tapphost.com, use our hosting, AI automation and marketing services or take part in our affiliate programme, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Italian law.
1. Data Controller
Shazark S.r.l. — VAT/P.IVA IT12620720966 — REA 2673165
Registered office: Corso Buenos Aires 77, 20124 Milano (MI), Italy
Website: tapphost.com · Email: privacy@tapphost.com · PEC: shazark@pec.it
2. What data we collect
- Account & contact data — name, email, phone, company, billing address, VAT number / Codice Fiscale, and (for Italian VAT-registered businesses) SDI code or PEC used for electronic invoicing.
- Service data — the websites, domains, files, databases and configurations you host with us.
- Payment data — processed by our payment providers (e.g. Stripe, PayPal); we store only tokens/references, never full card numbers.
- AI & automation data — content and messages processed by AI agents and automations you enable, used to deliver those features.
- Affiliate programme data — if you join: joining date and accepted Terms version, your personal link, the customers you referred and commissions earned and paid. If you sign up as an affiliate without buying: first and last name, email and country; you choose your password through the link we email you, and WHMCS stores it only as a one-way hash. If you request a payout: country of tax residence; tax code, VAT number or foreign tax ID; company name and tax regime; date and place of birth or residence address; IBAN or account number and BIC, account holder, or PayPal address; the declarations on occasional activity, activity carried out abroad and sanctions.
- Attribution data — if you arrive through an affiliate link and accept marketing cookies, the number of the affiliate who referred you, linked to your order.
- Usage & technical data — IP address, browser/device, pages viewed, logs, needed for security and to operate the service.
- Cookies & similar technologies — see our Cookie Policy.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide hosting, AI and marketing services; manage account and billing | Performance of a contract (Art. 6(1)(b)) |
| Run the affiliate programme: joining, calculating and paying commissions | Performance of a contract (Art. 6(1)(b)) |
| Tax compliance on commissions: invoices, receipts, withholding tax, annual certificates and withholding-agent returns | Legal obligation (Art. 6(1)(c)) |
| Checking EU VAT numbers (VIES) and that payees are not subject to sanctions | Legal obligation (Art. 6(1)(c)) and legitimate interest in paying lawfully (Art. 6(1)(f)) |
| Link an order to the affiliate who referred you | Consent to marketing cookies for reading the code (Art. 6(1)(a)); legitimate interest in paying commissions correctly for recording it on the order (Art. 6(1)(f)) |
| Security, fraud prevention (including commission fraud), service improvement, aggregate statistics | Legitimate interest (Art. 6(1)(f)) |
| Statistics & marketing cookies, promotional emails | Consent (Art. 6(1)(a)) |
| Accounting, tax and legal obligations (incl. e-invoicing) | Legal obligation (Art. 6(1)(c)) |
4. AI-powered features
When you enable AI agents or automations, relevant content may be processed by AI/LLM providers acting as our processors to generate responses and perform actions. We do not use your customers' conversation data to train third-party foundation models without a legal basis, and we contractually bind providers to appropriate safeguards.
5. Affiliate programme
If you are an affiliate, we process your data to run your participation and pay you. The tax and bank details you enter when requesting a payout are visible only to our administrative staff and tax advisor, and are never sent by email.
If an affiliate referred you, that affiliate sees in their client area only what they need to check their commissions: your first name with a shortened surname (or company name), the product bought, the service status, a partially masked domain and the commission earned. They do not see your email, contact details or payment data; from the commission amount, however, they can work out what you spend on the service they recommended. The affiliate and tapphost act as independent controllers, and the affiliate must not use this data for other purposes.
6. Recipients and processors
We share data only with providers who process it on our behalf under a data-processing agreement, including our infrastructure/hosting provider, payment processors, email/SMTP providers, analytics providers (with consent), AI/LLM providers for the features you activate, our tax advisor, PayPal (for payouts you choose to receive that way, as an independent controller) and the European Commission's VIES system (to check EU VAT numbers). Tax data on commissions is reported to the Italian Revenue Agency as required by law. We never sell your personal data.
7. International transfers
Where a provider processes data outside the EU/EEA, we rely on adequacy decisions or Standard Contractual Clauses and additional safeguards as required by the GDPR. If you live outside the EU/EEA and request a payout, the data needed for the payment is sent to your bank or to PayPal because this is necessary to perform our contract with you (Art. 49(1)(b) GDPR).
8. Data retention
We keep personal data only as long as necessary for the purposes above: for the duration of your contract and, thereafter, for the periods required by accounting and tax law (generally 10 years for invoicing data, receipts and withholding records on commissions) or to defend legal claims. The attribution cookie lasts 90 days. Non-tax affiliate programme data is kept for the duration of participation and up to 12 months after it ends, to handle reversals. Service and log data are retained for shorter, security-appropriate periods.
9. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict and port your data, to object to processing, and to withdraw consent at any time. To exercise your rights, contact privacy@tapphost.com. You may also lodge a complaint with the Italian Data Protection Authority (Garante, garanteprivacy.it).
10. Security
We apply appropriate technical and organisational measures — encryption in transit (HTTPS/SSL), access controls, backups and monitoring — to protect personal data against unauthorised access, loss or alteration.
To protect your account, sign-in sessions have a limited lifetime, changing your password ends the sessions on your other devices, the most sensitive actions require you to confirm your password, and repeated attempts are limited. For this we process, for no longer than necessary, technical data such as your IP address, a session identifier and sign-in times (legitimate interest in security, Art. 6(1)(f)). If you sign up for the affiliate programme for free, we send you a personal link to choose your password: we only keep a cryptographic fingerprint (hash) of the link, which expires after 72 hours.
11. Cookies
We use cookies as described in our Cookie Policy. You can manage your choices anytime via the "Cookie preferences" link in the site footer.
12. Changes
We may update this Policy; the "Last updated" date reflects the latest version. Material changes will be communicated through the site.