This is a courtesy translation. The Portuguese version prevails.
Privacy
Your code, your prompts and your keys stay on your machine. The server stores only what's needed for the waitlist and the license.
| Data | Where it lives | Why |
|---|---|---|
| Waitlist email, source page and date of consent | Tactyn server | To tell you about the launch. Unsubscribe via the link in the email; no IP address is stored |
| Code, prompts, terminals and attachments | Only on your machine | Never sent to Tactyn |
| API keys | macOS Keychain | Never in the app's database or on the server |
| Account email | License server | Magic-link sign-in and sending receipts |
| Plan, status, period dates and Efí Pay ids | License server | To unlock Pro and reconcile billing |
| List of connected devices, with name and last use | License server | To show and end sessions at /conta |
| Currency, amount and billing country of each payment, and Stripe ids | License server | To reconcile billing for payments from outside Brazil |
| Payer and card details | Efí Pay, straight from your browser | To process the charge. Tactyn does not store your card, CPF (Brazilian tax ID), phone number, date of birth or address |
Anyone who leaves the list is marked as removed and gets no more emails. To have the record deleted entirely, ask at the contact email.
Processors
- Efí Pay: processes the payment. It receives the payer and card details straight from your browser; Tactyn does not store your card, CPF (Brazilian tax ID), phone number, date of birth or address.
- Stripe: processes payments from outside Brazil. It receives your email, name, billing address and card details on its own page; Tactyn's server never sees them.
- Google Ads: receives, once a month, the ad click identifier, the date and the amount of subscriptions that came from ads, with no email or name, and only if you accepted the ad notice.
- Resend: sends the emails (sign-in link, receipts and expiry notices). It receives your email address and the content of those transactional emails.
Checkout page
When you open the checkout page (/assinar) or the portal (/conta), your browser loads Efí Pay's payment script, which exchanges your card for a restricted-use code (a token). That script includes a ClearSale anti-fraud service, which collects a device identifier (fingerprint) and sets cookies. The Efí script may set anti-fraud cookies and short-lived cookies of its own. Outside Brazil, you pay on Stripe's page, which has its own privacy rules; the Tactyn site loads no Stripe script. The rest of the site uses no cookies and no third-party analytics.
Ad identifier
If you arrive from a Google ad, the address carries a click identifier (gclid). It is stored in your browser only if you accept the notice shown on the page; if you decline, nothing is stored and the notice does not come back for 12 months (clearing the site's data in your browser resets the choice). The purpose is to measure which ads lead to a subscription. The identifier is kept for 90 days and, if you subscribe within that time, it is stored with the subscription. Once a month we tell Google Ads which identifiers resulted in a subscription: we send the identifier, the date and the amount of the subscription, with no email or name. The identifier is deleted when you delete your account. No Google script is loaded on the site.
Your rights
You can export and delete your data from the portal at /conta. Financial records (payments, refunds and invoices) are kept for the period required by law and deleted afterward. For any request to access, correct or delete your data, write to [email protected]; we reply within 15 days.
Draft under legal review.