LegalLast updated: 11 October 2026

Privacy

How Tactico Technologies handles data across Pathways, Vertral Spatial Engine, Momentum, and Tactico Account.

Tactico Technologies (“Tactico”, “we”, “our”, or “us”) respects your privacy. This Privacy Policy describes how we collect, use, disclose, and otherwise process personal data relating to you when you use our websites, applications, software, and services, including Pathways, Vertral Spatial Engine, Momentum, and Tactico Account (collectively, the “Services”).

This Privacy Policy does not apply to personal data that our business customers process in deployments they operate, such as Momentum Cloud or Momentum Enterprise deployments. That processing is governed by our agreements with those customers, and those customers are responsible for it. This Privacy Policy also does not apply to third-party services that you connect to or access through the Services, which are governed by their own privacy policies.

1. Personal data we collect

We collect personal data relating to you (“Personal Data”) as follows:

Personal Data you provide:

Account Information: When you create or sign in to an account, we collect information associated with your account, including your name, email address, account identifiers, and authentication credentials (collectively, “Account Information”). If you sign in using a third-party identity provider, we receive Account Information from that provider in accordance with your settings with that provider.
Profile Image: If you choose to upload a profile image, we collect and store that image.
Request Information: If you join a waitlist or request access to a Service, we collect your email address, the type of request, and the date and time of your request and consent.
Communication Information: If you communicate with us, we collect your name, contact information, and the contents of the messages you send.

Personal Data we receive from your use of the Services:

Log Data: Information that your browser or device automatically sends when you use the Services, such as your Internet Protocol address, browser type and settings, and the date and time of your request.
Security Information: Information used to protect the Services against fraud, abuse, and unauthorized access, such as browser and network signals and pseudonymized identifiers used to limit repeated requests.
Cookies and Similar Technologies: As described in Section 7.

Data processed on your device:

Certain Services process data locally on your device (“Local Data”). This includes route inputs and device location processed by Pathways, and conversations, goals, memory, checkpoints, project files, and usage records processed by Momentum on your device. The Services do not transmit Local Data to us, and we do not collect it, unless you choose to provide it to us. Third-party services that you connect to the Services, such as AI agents and model providers, may process your data under their own policies.

2. How we use Personal Data

We use Personal Data for the following purposes:

to provide, maintain, and operate the Services, including to authenticate you and manage your account;
to communicate with you, including to respond to your requests and send information you have asked to receive;
to prevent fraud, abuse, and illegal activity, and to protect the security of our systems and the Services;
to comply with legal obligations and enforce our terms and policies; and
to protect the rights, privacy, safety, or property of our users, Tactico, or third parties.

We do not sell Personal Data, and we do not use Personal Data for targeted advertising.

3. Disclosure of Personal Data

We may disclose Personal Data in the following circumstances:

Service providers: To vendors who perform services on our behalf, including hosting, content delivery, authentication, storage, security, and communication services. These providers process Personal Data only as instructed by us and as needed to perform their services.
Identity providers: To the third-party identity provider you choose to use for sign-in, as necessary to authenticate you.
Legal requirements: Where required by law, or where we believe in good faith that disclosure is necessary to comply with legal process, protect the safety or rights of any person, or detect and prevent fraud, abuse, or security issues.
Business transfers: In connection with a merger, acquisition, reorganization, or sale of all or part of our assets, subject to appropriate confidentiality obligations.
With your direction: When you instruct or consent to the disclosure.

4. International transfers

Personal Data may be transferred to, stored in, and processed in jurisdictions other than the one in which you reside, including South Korea and Singapore, and other locations where our service providers operate. Where we transfer Personal Data, we take reasonable steps to ensure that it receives appropriate protection in accordance with this Privacy Policy and applicable law.

5. Retention

We retain Personal Data only for as long as necessary to provide the Services and for the other purposes described in this Privacy Policy, including to resolve disputes, protect safety and security, and comply with legal obligations. Retention periods depend on the nature of the data and the purposes for which it is processed. For example:

Account Information and Profile Images are retained for as long as your account remains active. Removing a Profile Image deletes the stored image, and we delete Account Information following a verified account deletion request, subject to backup cycles and any legal obligation to retain it.
Request Information is retained until the relevant request has been fulfilled or you ask us to delete it.
Log Data and Security Information are retained for limited periods as needed for security and operational purposes, after which they are deleted or aggregated.

Local Data remains on your device and is retained until you delete it or remove the relevant application or browser data.

6. Your rights

Your rights depend on the law applicable to our processing of your Personal Data and are subject to the conditions, limitations, and exceptions in that law. The following provisions apply to the extent the relevant law applies to you and our processing. Nothing in this Privacy Policy limits your statutory rights.

6.1 Hong Kong: Personal Data (Privacy) Ordinance

Under the Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”), you may request confirmation of whether we hold Personal Data about you, obtain a copy of that data, and request correction of inaccurate data. You may also request that we cease using your Personal Data for direct marketing, without charge, and lodge a complaint with the Office of the Privacy Commissioner for Personal Data (“PCPD”).

Data access and correction requests are handled within the periods prescribed by the PDPO, generally 40 calendar days after receipt, subject to statutory exceptions. If we cannot comply within that period, we will provide the notice required by the PDPO. Any fee for complying with a data access request will be limited to what the PDPO permits.

6.2 European Economic Area and United Kingdom: GDPR

Where the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) or the UK GDPR applies, you may have the following rights:

to receive information about our processing and access your Personal Data;
to rectify inaccurate or incomplete Personal Data;
to request erasure of Personal Data and restriction of processing;
to receive Personal Data you have provided in a structured, commonly used, machine-readable format and transmit it to another controller, where the conditions for data portability are met;
to object to processing based on legitimate interests or a public-interest task, and to object at any time to processing for direct marketing;
to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and
not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects, subject to the exceptions and safeguards provided by law.

You may lodge a complaint with a competent supervisory authority, including the authority in the EEA country of your habitual residence, place of work, or the alleged infringement, or the UK Information Commissioner’s Office (“ICO”), as applicable. Requests are addressed without undue delay and generally within one month, subject to the applicable rules on verification and permitted extensions. Where an extension is permitted, we will notify you within the applicable initial period and explain the reason.

6.3 Switzerland: Federal Act on Data Protection

Where the Swiss Federal Act on Data Protection (“FADP”) applies, you may request information about our processing of your Personal Data, correction of inaccurate data, and deletion or restriction of processing where the applicable legal conditions are met. You may also request delivery or transmission of data under the applicable portability provisions and human review of an automated individual decision where required by law. You may contact the Federal Data Protection and Information Commissioner (“FDPIC”) about concerns regarding our processing.

6.4 California: CCPA and CPRA

If you are a California resident and our processing is subject to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (“CCPA”), you may have the following rights:

to know and access the categories and specific pieces of personal information collected about you, the categories of sources, the purposes of collection, and the categories of recipients;
to request deletion of personal information, subject to statutory exceptions;
to correct inaccurate personal information;
to opt out of the sale of personal information or sharing for cross-context behavioral advertising;
to limit the use and disclosure of sensitive personal information where it is used beyond the purposes permitted by the CCPA; and
not to be unlawfully discriminated against for exercising your privacy rights.

The information described in Section 1 includes identifiers and contact information, internet or network activity information, profile images, and authentication credentials, which may be sensitive personal information where defined by the CCPA. Sections 1 through 5 describe the sources, purposes, recipients, and retention of that information.

We do not sell personal information or share it for cross-context behavioral advertising. Where applicable, an opt-out preference signal such as Global Privacy Control may be used to exercise a right to opt out of sale or sharing. Our current processing does not include those activities.

You may submit requests through the contact method below or use an authorized agent as permitted by law. Requests to know, delete, or correct are generally answered within 45 calendar days after receipt, with an additional 45 days where permitted and with the required notice. Other requests are handled within the periods prescribed by the CCPA.

6.5 Other United States privacy laws

Residents of other US states may have rights under applicable state privacy laws, including the Colorado Privacy Act and Virginia Consumer Data Protection Act. Depending on the applicable law, these may include confirmation and access, correction, deletion, portability, and opting out of targeted advertising, sale of personal data, or certain profiling that produces legal or similarly significant effects. These rights are subject to the scope and exceptions of the relevant law.

If we decline a request and applicable law provides a right of appeal, you may appeal by contacting us using the method below and identifying the decision you wish to appeal. We will respond within the period required by that law and provide any required information about further complaint rights, including to your state Attorney General.

6.6 Exercising your rights

To exercise a right or request deletion of your account, email contact@tactico.cc, identifying the request and the account or information concerned. Where permitted, you may appoint an authorized representative. We may request information reasonably necessary to verify your identity or the representative’s authority. We do not require identity verification for opt-out requests where applicable law prohibits it.

We will address requests within the time required by applicable law. If an exception, permitted extension, or refusal applies, we will provide the explanation or notice required by that law. You may also request that we stop communications you have asked to receive. These rights concern Personal Data we process; Local Data stored only on your device must be managed on that device, and requests concerning independent third-party processing should be directed to the relevant provider.

7. Cookies and similar technologies

We use cookies and similar technologies, such as local storage, to operate the Services. These include strictly necessary cookies used to sign you in and keep your session secure, and local storage used to remember your preferences, such as your language selection and settings within Pathways. We do not use advertising cookies or third-party analytics cookies. You can control cookies and local storage through your browser settings, but disabling them may affect the functioning of the Services.

8. Security

We implement commercially reasonable technical, administrative, and organizational measures designed to protect Personal Data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, no internet or email transmission is ever fully secure or error-free. You are responsible for keeping your account credentials secure.

9. Children

The Services are not directed to children under the age of 13, and we do not knowingly collect Personal Data from children under 13. If you believe that a child under 13 has provided Personal Data to us, please contact us at contact@tactico.cc, and we will take steps to delete it.

10. Third-party services and supplemental notices

The Services may contain links to or integrations with third-party websites and services that we do not operate. Those third parties have their own terms and privacy policies, and you should review them before providing Personal Data to them. Certain Services may be accompanied by supplemental privacy notices, such as the Tactico Account privacy notice, which should be read together with this Privacy Policy.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date on this page and, where required by law, provide additional notice.

12. How to contact us

Tactico Technologies is responsible for the processing of Personal Data described in this Privacy Policy. If you have any questions or concerns about this Privacy Policy, please contact us at contact@tactico.cc.

This Privacy Policy may be provided in more than one language. If there is any conflict or inconsistency between language versions, the English version shall prevail. See also our Terms of use.