Privacy Notice

1. Who operates this service

TacticByte is operated by solo founder Tuhin Dutta, based in West Bengal, India. You may reach our data protection contact directly at [email protected].

2. What data this public website collects

On this public demo website, we do not require user accounts, logins, or match video uploads. When you contact us or register interest for the early-access pilot, we may collect:

• Your contact email address
• Your role in football (e.g., Coach, Analyst, Club Staff)
• Country / region
• Optional club or organization name and your specific tactical questions
• Consent timestamp and privacy notice version agreed to

3. Purpose of data processing

We process your submitted contact details solely to evaluate pilot eligibility, respond to direct enquiries, and coordinate agreed football discovery discussions. We do not sell, rent, or trade contact information to third parties.

4. Local execution & match footage privacy

The TacticByte tactical analysis engine operates locally on private loopback servers during pilots. Customer match recordings remain strictly private and are never uploaded to public cloud models or exposed to unconsented web services.

5. Safeguarding policy regarding youth footage

We strictly prohibit collecting or publishing match recordings or identifying information of minors (under 18) on this website. Any future academy pilot involving youth players requires explicit written authorization from the club and guardians, with strict role-based access and bounded retention.

6. Your rights (Access, correction, deletion)

You have the right to request a copy of the contact information we hold about you, request corrections, or request immediate deletion at any time. To exercise these rights, email [email protected] with the subject "Privacy Deletion Request". We honor deletion requests within 5 business days.

7. Mailbox verification & token security

Marketing communication requires verified mailbox ownership via double opt-in. When requested, a cryptographically secure 32-byte single-use verification token is generated server-side and sent directly to your inbox with a 24-hour expiration. Only the SHA-256 cryptographic digest of the token is stored, and tokens are invalidated upon consumption, unsubscribe, or expiration.

8. Suppression list, opt-out, and erasure records

When you unsubscribe from communications, your email address is recorded in our operational suppression list so our delivery pipeline honours your opt-out and disallows further tactical briefings across all token lifecycles. Plaintext records in the active leads database have marketing consent revoked and status transitioned to unsubscribed.

When you exercise your right to erasure (GDPR or deletion request), all personal contact details, notes, and plaintext addresses are permanently erased from both active leads and the suppression list. To prevent accidental future re-enrolment or re-import of previously erased addresses, we retain a pseudonymous SHA-256 cryptographic digest of the email address. Because unsalted digests of known email address formats may be vulnerable to dictionary guessing, these records are treated as pseudonymous compliance identifiers held strictly for suppression matching, not anonymous or irreversible data.

9. Public registration simulation & browser local storage (localStorage)

The early-access intake form on this public website operates as an illustrative client-side demonstration. When you test the form, demonstration entries are stored solely in your own browser's localStorage under the key tacticbyte_leads and are not transmitted to a remote server or monitored for replies.

You can inspect or delete this demonstration data at any time by clearing your browser's site data in settings, using the "Clear local simulation data" control on the form, or opening your browser developer console and running localStorage.removeItem('tacticbyte_leads'). For actual design partner pilot enquiries, please contact [email protected] directly.