Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Legal & Compliance·33 in this wave

Approve: Legal & ComplianceTo do · blocker NEEDS MATTHEW: privacy-policy §6 publishes an admission against interestTo do · blocker Verify support@tactile-connect.com delivers end-to-endBlocked · blocker MATTHEW: eight legal documents marked DRAFT — NOT IN FORCE are published and now linked from marketingTo do · blocker Draft Terms of ServiceDone Draft Privacy PolicyTo do Draft Acceptable Use PolicyDone DMCA takedown policy + register agentTo do DSAR + account-deletion processTo do App Store privacy labels + Play Data SafetyTo do DECIDE: "no third-party data sales" pledge dropped from canonical S13To do Add IP-assignment and NDA agreements to S13's pre-launch checklistTo do Add product liability + workers' comp to S13's insurance planTo do Fix cap table misstatement: S13 says "no SAFEs" while one is actively being raisedTo do Decide: restore or drop the "no third-party data sales, ever" pledgeDone Resolve the data-retention contradiction between S13 and Pro analyticsDone Execute IP assignment and NDA agreementsTo do Appoint an Article 27 EU representativeTo do Execute SCCs with all seven sub-processorsTo do Publish the legal pack — /legal index + a page per documentDone Verify entity name "TacTile Connect, Inc." across docsDone Write support policyDone Audit business plan Section 13 for policy driftTo do Confirm marketing claims match capabilitiesTo do Confirm co-founder equity resolution note and trademark class 45 in S13To do Draft Cookie PolicyDone Draft DPA templateTo do Sign DPAs with sub-processorsTo do Draft refund policyDone Write incident-response planDone Stand up compliance mailboxesDone Publish sub-processor list pageTo do Resolve retention conflict: S13's 90-day blanket vs indefinite Pro analytics retentionTo do

Wave

Legal & Compliance

v1.0 legal + compliance docs and processes — agent-drafted, Matthew signs off. Entity: TacTile Connect, Inc.

TacTile › Launch TacTile › Foundations › Legal & Compliance

11/33 done22 open4 open blockers

Selected taskclear

Publish sub-processor list page

To doOwner · Vivt_6e18b390

[prep] Public sub-processor list referenced by the DPA.

Waiting on 2 · 2 still openDraft Privacy Policy Draft DPA template

Unlocks 1Approve: Legal & Compliance

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Publish sub-processor list page** · to do

[prep] Public sub-processor list referenced by the DPA.

Where it sits: TacTile › Launch TacTile › Foundations › Legal & Compliance

## Waiting on 2

- Draft Privacy Policy — to do
- Draft DPA template — to do

2 of those are still open. If one genuinely blocks this, say so and stop rather than working around it.

## Unlocks 1

- Approve: Legal & Compliance

## The brief on file

Viv — publish the public sub-processor list page referenced by the DPA.

--- DRAFTED, NOT PUBLISHED 2026-07-27 (Viv) · docs/legal/sub-processors.md · commit 7a103f11 ---
Left TODO because the task says PUBLISH and this is a repo doc, not a live page — and because the list needs verifying before it goes public.

DRAFTED: Supabase, Stripe, Cloudflare, AWS, Resend, Sentry and Anthropic, each with what it processes and where it operates, plus the transfer basis (SCCs / UK Addendum) and a change-notification commitment. Apple and Google are explicitly called out as NOT sub-processors — they act as independent controllers for app distribution and social sign-in.

TWO VERIFICATION STEPS BEFORE PUBLISHING (both inline in the doc):
1. The list came from the repo's own description of the stack, NOT a billing audit. An omission here is a compliance failure that also undermines the DPA that references it. Best cross-check available is the 1Password TacTile vault via docs/secrets/INDEX.md, which enumerates every service holding a credential. Specifically confirm either way: any analytics or session-replay tool, support-desk software, CI or crash reporting beyond Sentry, and anything behind the marketing site.
2. The Anthropic row is tier-sensitive. Per ADR-0001 only the Tier-2 customer-facing path belongs on a sub-processor list; Tier-1 internal tooling never touches customer data, and staging has no Console key at all ("disabled-in-staging"). Confirm no Tier-1 path processes customer personal data.

Also: this page asserts every vendor DPA is executed. That's t_4bea1d04 and is not done — don't publish the assertion before it's true.

TO CLOSE: verify the list, then publish it as a real page (marketing site or tactile.to/sub-processors) so the DPA can reference a URL rather than a repo file.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Legal & Compliance

Publish sub-processor list page