Privacy Policy

Tactical is an AI agent analytics service for e-commerce stores. This page describes what data we collect, why we collect it, where we store it, and how you (or visitors to your store) can exercise data-protection rights.

01What data we collect

Tactical stores no names, contact details or payment data about the people who visit a merchant's store. From each visitor session on a merchant's storefront, the snippet records:

• Page-view patterns (URLs visited, time on page, scroll depth)
• Mouse-movement heuristics (presence/absence only — never cursor coordinates)
• Navigation timing (interval between page loads — used to score "bot-like" cadence)
• User-agent string, hashed before storage
• Referrer domain (domain only, not the full URL)
• IP-derived metadata: country and "is this a datacenter?" flag — the IP itself is discarded after geolookup
• Cart and checkout events (event type only — no product pricing or payment data)

Depending on what the merchant installs, we also record:

• AI crawler visits (WooCommerce plugin, Cloudflare connection or server middleware): the crawler's name, the page URL, and whether the request came from the operator's published IP range. Only requests that match a known crawler are recorded; the IP address is checked and not stored.
• Orders (when the merchant's store sends us order webhooks): order ID, total, currency, the line items (product ID, SKU, name, quantity and price) and how the order was attributed. The buyer's IP address and browser user agent in the order are used once, to match the order to a storefront session, and are not stored. We never store the buyer's name, email, address or payment details. For an order attributed to an AI agent we also keep an evidence record, which the merchant can export: how the order was attributed, the matched session's pages, product views and detection signals, the agent's declared identity and the Tactical Gate decisions for the buyer's session, with no IP address, user agent or buyer details, kept and deleted with the order records.
• Tactical Gate decisions (when the merchant turns on Tactical Gate): the time, the page path (never the query string), the agent's name and category if it was identified, the rule that matched and the outcome, and a short one-way hash of the visitor's IP address and user agent, used to count distinct sessions and to sample. Every request a rule restricted is recorded; allowed requests, which include every request from a person, are recorded for about 1 in 100 sessions. Tactical Gate never restricts people, and restricts a search engine only when the merchant names it in a rule and confirms the SEO impact.
• Drop Watch windows (when the merchant sets one for a product release, at most 48 hours long): from 15 minutes before the release to its end, every add-to-cart and checkout attempt is recorded as a Tactical Gate decision, people's included, instead of about 1 in 100, and the visitor's classified browser session carries the same session hash, so the release report can tell whether an attempt came from a browser. Those decisions also keep the random session identifier from the storefront script's cookie, when the request carried it, to join the attempt to its browser session exactly. Drop Watch restricts nobody. The report the merchant receives holds counts and times only, with no session hash, session identifier, IP address or user agent.

On our own demonstration store (tactical-app.work/demo), a research experiment in September 2026 recorded full request headers, including IP addresses, for visits to that store only. Capture is switched off, and those records are deleted 30 days after capture.

From the merchant operating a Tactical account we additionally store: email address, a salted password hash, store name, store domain, plan tier, and (where applicable) a billing-provider customer ID.

If you join a beta waitlist on our site, we store your email address, platform, order-volume range, how often you run limited drops and, if you give it, your store address. We use them only to invite you, and delete them on request to [email protected].

02What we never collect

• Names, email addresses, phone numbers, postal addresses, or account identifiers of visitors or buyers
• Payment information, credit card numbers, or billing addresses (we never see them — checkout runs on Dodo Payments / Stripe / your storefront's processor, not Tactical)
• Visitor login credentials, session tokens, or cookies belonging to third parties
• Form inputs or any text typed by visitors
• Cross-site tracking identifiers, third-party advertising cookies, or fingerprints used for ad attribution
• Raw IP addresses. An IP address is used in memory for geolocation, crawler verification, order matching and the Gate's session hash, and is never stored (outside the demonstration-store experiment described above)

03How data is stored

Session analytics and account configuration live in Neon Postgres with these protections:

• Encryption at rest — AES-256 on the database storage layer
• Encryption in transit — TLS 1.3 on every connection between services
• Retention — a scheduled job runs daily at 3am UTC and deletes agent-session, product-view, Tactical Gate decision and classifier-comparison rows after 90 days, and AI crawler visits after 180 days. Order records are the merchant's business records: they are kept while the store is connected and deleted with the store's other data (section 06)
• Tenant isolation — every analytics row is scoped to a shop_id; row-level access is enforced at the application layer
• Access control — only the merchant who owns a store, authenticated via password + JWT (or Shopify OAuth), can view its analytics

04GDPR compliance

Tactical processes visitor session data under the legitimate interest legal basis (GDPR Article 6(1)(f)) for the purposes of bot detection, traffic classification, order attribution, enforcing the merchant's agent-traffic policy (Tactical Gate), and marketplace-referral signals on behalf of the merchant. We store no names or contact details about visitors or buyers. The Tactical Gate session hash is pseudonymous data derived from an IP address and user agent; it is kept for 90 days and cannot be looked up by name. For 30 minutes, keyed by the same hash, the Gate also keeps whether a session was classified as an automated agent, so a store's add-to-cart and checkout rules can use it. Data-subject requests about a merchant's visitors go to the merchant, who can forward them to [email protected]. Merchant account data can be managed directly from /dashboard/settings.

For Shopify merchants, we honour the GDPR webhooks (customers/data_request, customers/redact, shop/redact): all relevant data is purged within 30 days of a redact request.

A Data Processing Addendum (DPA) is available on request — email [email protected].

05Cookies & tracking

On a merchant's storefront, Tactical's snippet sets one first-party cookie, _tac_sid:

• Contains a random session identifier only (no PII, no merchant identifiers)
• Expires 30 minutes after the last page view
• Read by the merchant's own server (the WooCommerce plugin) to tell which browser session an add-to-cart or checkout request came from, for Drop Watch reports
• Not set on Shopify stores, where nothing on the server reads it
• Never shared with third parties or used for cross-site tracking
• Never used for advertising or attribution outside the merchant's own dashboard

On tactical-app.work itself, we set httpOnly authentication cookies for signed-in merchants (access token + refresh token), and a short-lived display cookie to surface a freshly-minted API key during onboarding. None of these are used for tracking; they're scoped to the auth session and operational requirements.

06Data deletion

When a merchant uninstalls our Shopify app, deletion starts automatically. For a WooCommerce or direct store, email [email protected] from the account's email address to delete the account or a single store; uninstalling the WooCommerce plugin removes it from the site but does not notify us. Once deletion starts:

• Account configuration (email, password hash, store metadata) is deleted within 24 hours
• All rows tied to the merchant's shop_id are deleted within 24 hours: session analytics, product views, AI crawler visits, order records, and the Tactical Gate policy and decision log
• OAuth access tokens are revoked immediately
• Active billing subscriptions are cancelled (no future charges)
• API keys are revoked immediately; the snippet stops functioning on receipt of a 401

Deleted data may persist in encrypted database backups for up to 30 days before being purged from the backup retention window. After that, no copy remains.

07Subprocessors

Tactical uses the following infrastructure providers to deliver the service:

• Neon — Postgres database hosting (account + analytics data). SOC 2 Type II.
• Upstash — Redis for the event queue and short-lived session state.
• Cloudflare — Edge ingestion and DDoS protection at the snippet endpoint.
• Railway — Application server hosting.
• Resend — Transactional email delivery (verification, password reset, agent alerts, beta waitlist confirmations).
• Dodo Payments — Subscription billing and customer portal.
• MaxMind — IP-to-country geolocation (used transiently, no stored linkage to visitor sessions).
• TypeSafe — a second classification model (Jev) that we are evaluating against our own rules. It receives a sample of sessions as a list of counts, timings and categories, with no IP address, user agent, URL, page content or identifier, and returns a verdict. The verdict is stored for comparison and changes nothing you see.

No behavioural data is sold to any third party. Tactical does not run advertising, retargeting, or affiliate networks on collected data.

08International transfers

Tactical's primary infrastructure region is the United States. Where data flows from the EU/UK to the US, transfers rely on Standard Contractual Clauses (SCCs) executed with each subprocessor. We minimise the data footprint (no PII in session analytics) to keep the transfer scope narrow.

09Changes to this policy

When we make material changes, we'll post the updated version here with a new "Last updated" date. For changes that meaningfully expand collection or sharing, we'll email account owners at least 14 days before the change takes effect.

10Contact

For privacy questions, deletion requests, or DPA execution: [email protected].