Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Legal & Compliance·33 in this wave

Approve: Legal & ComplianceTo do · blocker NEEDS MATTHEW: privacy-policy §6 publishes an admission against interestBlocked · blocker Verify support@tactile-connect.com delivers end-to-endTo do · blocker MATTHEW: eight legal documents marked DRAFT — NOT IN FORCE are published and now linked from marketingTo do · blocker Draft Terms of ServiceDone Draft Privacy PolicyTo do Draft Acceptable Use PolicyDone DMCA takedown policy + register agentTo do DSAR + account-deletion processTo do App Store privacy labels + Play Data SafetyTo do DECIDE: "no third-party data sales" pledge dropped from canonical S13To do Add IP-assignment and NDA agreements to S13's pre-launch checklistTo do Add product liability + workers' comp to S13's insurance planTo do Fix cap table misstatement: S13 says "no SAFEs" while one is actively being raisedTo do Decide: restore or drop the "no third-party data sales, ever" pledgeDone Resolve the data-retention contradiction between S13 and Pro analyticsDone Execute IP assignment and NDA agreementsTo do Appoint an Article 27 EU representativeTo do Execute SCCs with all seven sub-processorsTo do Publish the legal pack — /legal index + a page per documentDone Verify entity name "TacTile Connect, Inc." across docsTo do Write support policyDone Audit business plan Section 13 for policy driftTo do Confirm marketing claims match capabilitiesTo do Confirm co-founder equity resolution note and trademark class 45 in S13To do Draft Cookie PolicyDone Draft DPA templateTo do Sign DPAs with sub-processorsTo do Draft refund policyDone Write incident-response planDone Stand up compliance mailboxesDone Publish sub-processor list pageTo do Resolve retention conflict: S13's 90-day blanket vs indefinite Pro analytics retentionTo do

Wave

Legal & Compliance

v1.0 legal + compliance docs and processes — agent-drafted, Matthew signs off. Entity: TacTile Connect, Inc.

TacTile › Launch TacTile › Foundations › Legal & Compliance

10/33 done23 open4 open blockers

Selected taskclear

Draft Acceptable Use Policy

DoneOwner · Vivt_89b55b80

[prep] Prohibited content/use for user-published destinations; removal rights.

Waiting on 1 · 1 still openVerify entity name "TacTile Connect, Inc." across docs

Unlocks 2DMCA takedown policy + register agent Approve: Legal & Compliance

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Draft Acceptable Use Policy** · done

[prep] Prohibited content/use for user-published destinations; removal rights.

Where it sits: TacTile › Launch TacTile › Foundations › Legal & Compliance

## Waiting on 1

- Verify entity name "TacTile Connect, Inc." across docs — to do

1 of those is still open. If one genuinely blocks this, say so and stop rather than working around it.

## Unlocks 2

- DMCA takedown policy + register agent
- Approve: Legal & Compliance

## The brief on file

Viv — draft the Acceptable Use Policy covering prohibited content/use for user-published destinations and removal rights.

--- DRAFTED 2026-07-27 (Viv) · docs/legal/acceptable-use-policy.md · commit 4d4ff0fd ---
Full draft. DRAFT status until you sign off.

Written around the thing that makes TacTile different from ordinary SaaS: a tag is a physical object in a public place and the person scanning it cannot preview what's behind it. §3 covers that specifically — only place tags where you have the right to, and never overlay another party's tag, sign or payment code. QR-overlay payment fraud is a real-world scam and is drafted as immediate termination.

Prohibited content is grouped by kind (illegal/exploitative, harm to people, deception/fraud, regulated goods, adult, IP) with CSAM as explicit zero-tolerance including NCMEC reporting. Enforcement is a graduated ladder — warn, disable the destination, suspend, terminate, report — with a named list of what skips straight to immediate action: CSAM, credible threats, active phishing/malware, overlay fraud. Appeals go to a human within 30 days. §7 states we don't pre-screen, which keeps us out of publisher territory.

ONE JUDGEMENT CALL FOR YOU: adult content is prohibited outright rather than age-gated, because a tag can be placed anywhere including around minors. That is stricter than most platforms draw it. If you want a lawful-adult-content carve-out it needs age verification — a product feature, not a policy edit.

DEPENDENCY: references abuse@tactile.to throughout. That mailbox does not exist yet (t_4c1ea7df). A policy naming a dead mailbox is worse than one naming none — stand it up before publishing.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Legal & Compliance

Draft Acceptable Use Policy