Privacy Policy

Last updated: September 2026

This page explains what data we collect when you use TACTIX (tactixmap.com), how we use it, and what rights you have.

Data controller

TACTIX is developed and operated by OraxAI. For privacy questions, contact support@tactixmap.com.

What data do we collect?

Account information: your username, email address, and password. Your password is never stored as plain text; it is hashed using a one-way, irreversible method (scrypt), so no one—including us—can see the original password.
Google sign-in: if you choose to sign in with Google, we receive only your name and email address from Google.
Map content: cells, titles, numeric/value fields, notes, tables, and files you upload (such as images, PDFs, video, and audio).
Optional AI audio processing: only when you explicitly start the feature, the selected meeting audio is transcribed and analyzed to prepare editable summaries, decisions, people, dates, and task drafts.
Sharing preferences: the users with whom you share a map or branch.
Payment information: if you upgrade to Plus, your card details are never stored on TACTIX servers. Payments are processed directly by Stripe and are subject to Stripe's privacy policy.
Technical data: one cookie used to keep you signed in (see our Cookie Policy).
Security records: sign-in attempts and changes to accounts, maps, files and published maps, with the time, your username and your IP address. They are used to protect accounts and to investigate incidents. They do not contain the content of your maps or files.
Phone notifications: only if you turn them on, the push address your browser creates for this device and a device name such as "iPhone · Safari". If you connect a business system such as OraxAI, we keep the connection name and a short delivery log (event type, time, number of devices reached). The text of the notifications is not stored.
AI features (Plus): when you use "Ask the map" or "Create with AI", the map or branch you ask about (box labels, notes, tasks, owners, dates) or your written request is sent to the AI provider to produce the answer. Answers and suggestions change nothing until you approve them. We count your monthly AI use to apply the plan limit.
Improving the AI (optional, off by default): only if you turn on "Help improve the AI", the AI results you accept, apply or reject are kept to train TACTIX's own map AI, after names, usernames, email addresses and phone numbers are removed. You can turn this off at any time; deleting your account deletes these samples.
Usage statistics: counts of actions inside the app, such as signing in, creating or sharing a map. They are stored on our own servers under a random identifier instead of your name, contain no map content, names or email addresses, and are never sent to analytics or advertising companies.

Why do we use this data?

We use collected data only to provide the service: to authenticate your account, store your maps, operate sharing and task-tracking features, process payments, show reminders for upcoming or overdue requests, and—only at your request—prepare drafts from meeting audio. AI-generated task drafts are never finalized without your explicit approval.

Who receives your data?

We do not sell your data or share it with third parties for advertising. The exceptions are:

Users with whom you explicitly share a map or branch can see only the area you authorize.
Search engines, only when you publish a map in the example maps list and an admin approves it. That published copy (title, description, cell labels, notes, and task titles) gets its own public page.
Our hosting provider, which stores the service and its data on our behalf.
The sign-in provider you choose (Google, Microsoft, Apple, Facebook, LinkedIn, GitHub or Discord), only when you use it to sign in.
Our email delivery provider, only to send the emails you trigger or the reminders you have set up.
When enabled, a separate backup storage provider that holds copies of our backups so data can be recovered after a failure.
For video calls, your browser may contact a Google STUN server to find a network route; the call's audio and video are not sent to Google.
Stripe, for payment processing.
When you use the AI features: by default Flopist AI, which runs on infrastructure operated by us; if it is unavailable, Anthropic (Claude) or OpenAI as a backup. If you enter your own OpenAI or Anthropic API key in Account settings, requests go only to that provider under your own account and its terms. Your key is stored encrypted and is never shown again.
If you turn on phone notifications, the push service of your browser or phone (Google for Chrome and Android, Apple for Safari and iPhone, Mozilla for Firefox, Microsoft for Edge on Windows) delivers them. The notification content is encrypted for your device and cannot be read by the push service.
If you connect OraxAI, OraxAI sends the alerts you receive; TactixMap only passes them to your devices.
OpenAI, only when you explicitly ask TACTIX to transcribe or analyze a meeting recording. The audio, transcript, and relevant map-cell names are sent only as needed to provide that feature and are subject to OpenAI's privacy policy.
Authorized public authorities when required by law, such as under a court order.

Public example maps

Maps stay private unless you choose otherwise. A read-only share link is not indexed. If you publish a map in the example maps list and an admin approves it, the title, description, cell labels, notes, and task titles from that published copy become publicly visible and may appear in search results. Files, photos, tables, assignee names, and private messages are never included. Withdrawing the publication removes the public page and the sitemap entry.

How long do we retain your data?

Your account and map data are retained until you delete your account. Deleted maps are first moved to the trash, where you can delete them permanently.

When you delete your account, your account, maps, files, mailbox, notifications, the calendar events you organized and their meeting minutes, your gallery comments and likes, and your published example maps are removed immediately from the live service. You are also removed from other people's events together with your notes.
Backups: deleted data remains in backups for at most 90 days and is then removed from them as older backups expire.
Payment records are kept for the period required by tax and accounting law, and publishing-consent records are kept as proof of the permission that was given.
Security records are kept for as long as needed to protect the service and meet legal obligations.
Usage statistics are deleted automatically after 13 months.
AI training samples are kept until you delete your account or ask us to delete them. Monthly AI usage counts are kept with your account.
Phone notification devices and connections are kept until you remove them or delete your account; a device the push service reports as gone is removed automatically.

Your rights

Subject to applicable data-protection law, including the GDPR and Turkey's Law No. 6698 (KVKK), you have the right to access, correct, delete and receive a portable copy of your data, and to object to how it is processed.

You can exercise two of these rights yourself at any time in Account settings → Your data: Download my data gives you everything in your account in one machine-readable archive, and Delete my account permanently deletes it. For any other request, or if you cannot sign in, contact support@tactixmap.com. You also have the right to lodge a complaint with your data-protection authority.

Changes

We may update this policy from time to time. For material changes, we will update the date shown on this page.