Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Legal & Compliance·33 in this wave

Approve: Legal & ComplianceTo do · blocker NEEDS MATTHEW: privacy-policy §6 publishes an admission against interestTo do · blocker Verify support@tactile-connect.com delivers end-to-endBlocked · blocker MATTHEW: eight legal documents marked DRAFT — NOT IN FORCE are published and now linked from marketingTo do · blocker Draft Terms of ServiceDone Draft Privacy PolicyTo do Draft Acceptable Use PolicyDone DMCA takedown policy + register agentTo do DSAR + account-deletion processTo do App Store privacy labels + Play Data SafetyTo do DECIDE: "no third-party data sales" pledge dropped from canonical S13To do Add IP-assignment and NDA agreements to S13's pre-launch checklistTo do Add product liability + workers' comp to S13's insurance planTo do Fix cap table misstatement: S13 says "no SAFEs" while one is actively being raisedTo do Decide: restore or drop the "no third-party data sales, ever" pledgeDone Resolve the data-retention contradiction between S13 and Pro analyticsDone Execute IP assignment and NDA agreementsTo do Appoint an Article 27 EU representativeTo do Execute SCCs with all seven sub-processorsTo do Publish the legal pack — /legal index + a page per documentDone Verify entity name "TacTile Connect, Inc." across docsDone Write support policyDone Audit business plan Section 13 for policy driftTo do Confirm marketing claims match capabilitiesTo do Confirm co-founder equity resolution note and trademark class 45 in S13To do Draft Cookie PolicyDone Draft DPA templateTo do Sign DPAs with sub-processorsTo do Draft refund policyDone Write incident-response planDone Stand up compliance mailboxesDone Publish sub-processor list pageTo do Resolve retention conflict: S13's 90-day blanket vs indefinite Pro analytics retentionTo do

Wave

Legal & Compliance

v1.0 legal + compliance docs and processes — agent-drafted, Matthew signs off. Entity: TacTile Connect, Inc.

TacTile › Launch TacTile › Foundations › Legal & Compliance

11/33 done22 open4 open blockers

Selected taskclear

Draft Privacy Policy

To doOwner · Vivt_470cd95e

[prep] Data categories, retention, GDPR/CCPA rights, sub-processors, contacts.

Waiting on 1 · all clearVerify entity name "TacTile Connect, Inc." across docs

Unlocks 8Draft Cookie Policy Draft DPA template Publish sub-processor list page DSAR + account-deletion process App Store privacy labels + Play Data Safety Audit business plan Section 13 for policy drift Confirm marketing claims match capabilities Approve: Legal & Compliance

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Draft Privacy Policy** · to do

[prep] Data categories, retention, GDPR/CCPA rights, sub-processors, contacts.

Where it sits: TacTile › Launch TacTile › Foundations › Legal & Compliance

## Waiting on 1

- Verify entity name "TacTile Connect, Inc." across docs — done

## Unlocks 8

- Draft Cookie Policy
- Draft DPA template
- Publish sub-processor list page
- DSAR + account-deletion process
- App Store privacy labels + Play Data Safety
- Audit business plan Section 13 for policy drift
- Confirm marketing claims match capabilities
- Approve: Legal & Compliance

## The brief on file

[2026-10-08 · Viv] STAYS OPEN. Skeptic pass: 'superseded' is not met. (1) Nothing is on main: origin/main 4f2c1d6b docs/legal/privacy-policy.md still carries BLOCKING CONFLICT markers (L107, L149); the rewrite exists only as draft PR #672 (CONFLICTING, DO NOT MERGE). (2) The retention call is not made: t_58981363 is todo/owner me, A / A+ / B still unanswered. (3) Premise now stale: this task says nothing is written to the visitor's device, but packages/destination-analytics/src/index.ts:91-114 sets sessionStorage tactile_de_sid on every hosted destination page, all plans. The no-banner paragraph needs a legal call on that. (4) #672 still lacks the 18+ minimum, a no-banner paragraph and the pseudonymised-is-personal-data line. Close after #672 merges with those added.

Viv — UNBLOCKED 2026-07-28. Both decisions this was waiting on are now made. Finish the Privacy Policy.

DECISION 1 — DATA SALES: TacTile never sells or shares personal data, stated flatly. The old "no third-party data sales, ever" pledge is restored; the CCPA opt-out framing is dropped. So: NO "Do Not Sell or Share My Personal Information" link is needed — there is nothing to opt out of.

DECISION 2 — RETENTION: two periods, and they must be stated in SEPARATE sentences or they read as a contradiction.
  • Scan and interaction logs — 90 days
  • Audit records (billing, deletions, auth changes, admin actions) — 24 months, on a legitimate-interest basis (security, fraud prevention, defending legal claims)
Say plainly why they differ: one is behavioural data about visitors, the other is security and billing evidence that protects both parties. Regulators expect them to differ.

ALSO NOW SETTLED — NO COOKIE BANNER, and the policy should say why rather than being silent about it. Verified in code 2026-07-28: the public scan path writes nothing to the visitor's device; visitors are identified by a server-side salted hash of IP + user agent (events.ts:120-131); the analytics feature uses no localStorage or sessionStorage. The only two cookies in the web app are the Supabase auth session and a device-trust security token, both strictly necessary and exempt under ePrivacy Art. 5(3). Full evidence is on task t_a062b929.

THE ONE DISTINCTION THAT MUST BE DRAWN CLEARLY: the above describes TacTile's own practice. If a customer enables a third-party integration (Google Analytics, Meta, Segment, Zapier), that provider's cookies and data handling apply and the CUSTOMER becomes the controller for that flow. Matthew's framing: "If they wanna do a Google integration, Google can take on the weight of privacy problems." Give this its own short section — it is the difference between an honest policy and an overclaim.

STILL REQUIRED BEFORE PUBLISHING — do not omit these, they are EU-release obligations: the Article 27 EU representative and the separate UK representative must be named with contact details (tracked as t_b15be9a1, still open — leave a clearly marked placeholder rather than inventing one). Also state the lawful basis for the visitor hash: it is pseudonymised, not anonymised, so it IS personal data and needs a basis (legitimate interest) even though it needs no consent.

Entity throughout: TacTile Connect, Inc. Age minimum 18+, which deliberately sidesteps GDPR Art. 8.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Legal & Compliance

Draft Privacy Policy