Privacy Policy

We collect the following categories of information:

• Account information — your name, email address, organization (company) name, role, and focus sector. Passwords are stored only as salted, hashed values; we never store them in plain text.
• Organization and project content — the projects, compliance checklists, notes, and related data you and your team create in the Service (“Customer Data”).
• Billing information — subscription and billing records. Payment card details are collected and processed directly by our payment processor, Stripe; we do not receive or store full card numbers.
• Communications — information you provide when you contact us or submit a form, such as your name, email, company, and message.
• Technical and usage data — information generated automatically when you use the Service, such as IP address, device and browser information, and session activity used to keep you signed in and to secure the Service.

We use the information we collect to:

• provide, operate, maintain, and improve the Service;
• create and manage your account and organization workspace;
• process subscriptions, billing, and related transactions;
• send transactional messages such as email verification, team invitations, password resets, and billing notices;
• secure the Service, prevent abuse, and enforce our Terms of Service;
• respond to your inquiries and provide support; and
• comply with legal obligations.

We use cookies that are strictly necessary to operate the Service — primarily to authenticate your session and keep you signed in securely. We also use Google reCAPTCHA on certain forms to protect against automated abuse; your use of reCAPTCHA is subject to Google’s privacy policy and terms. We do not use the Service to serve third-party advertising.

We do not sell your personal information. We share information only as needed to provide the Service:

• Service providers — including Stripe (payment processing), our email delivery provider (transactional email), our cloud hosting and database providers (application hosting and data storage), and Google (reCAPTCHA). These providers process information on our behalf under their own terms and privacy commitments.
• Within your organization — Customer Data is accessible to authorized members of your organization according to their roles.
• Legal and safety — when required by law or to protect the rights, property, or safety of Tactic Build, our users, or others.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

The Service is multi-tenant: each organization’s data is scoped to its own organization identifier and is not accessible to other organizations. Access within an organization is controlled by the roles assigned by that organization’s administrators.

We retain your information for as long as your account is active and as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we take reasonable steps to delete or de-identify it.

We use administrative, technical, and organizational safeguards designed to protect your information, including encryption in transit, hashed passwords, and tenant-level access controls. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Depending on your location, you may have rights to access, correct, update, or delete your personal information, or to object to or restrict certain processing. You can update much of your account information directly in the Service, and you may contact us to exercise applicable rights. You may also unsubscribe from non-essential emails; we may still send transactional messages necessary to operate the Service.

We operate in the United States, and your information may be processed and stored there or in other countries where we or our service providers operate. By using the Service, you understand that your information may be transferred to locations that may have data protection rules different from those in your country.

The Service is intended for business use by individuals who are at least 18 years old. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us so we can delete it.

The Service may link to or rely on third-party websites and services that we do not control. This Policy does not apply to those third parties, and we encourage you to review their privacy policies.

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice, such as by posting the updated Policy with a new “Last updated” date. Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

Questions or requests regarding this Privacy Policy? Reach us through our contact page.