Privacy Policy

1. Information We Collect

We collect the following categories of personal information:

• Account details: name, email address, password (securely hashed, never stored in plain text), and date of birth
• Guardian information (minors only): parent/guardian name and email, collected only when the account holder is under 18
• Chess activity: assessment results, puzzle and drill progress, game history, and study plan data
• Payment information: handled entirely by our payment processor, Denovo — we never see or store your card details
• Technical data: IP address, browser/device information, and cookie identifiers (see our Cookie Policy)
• Consent records: a timestamped log of each consent you give us (Terms & Privacy acceptance, guardian consent, cookie banner)

2. Why We Collect It

We process your personal information to:

• Create and manage your account, and authenticate you securely
• Generate your chess skill assessments, study plans, and progress tracking
• Process payments and manage subscriptions via Denovo
• Verify your age and, where you are a minor, confirm guardian consent before account creation
• Comply with our legal obligations, including record-keeping required by POPIA
• Respond to support requests and improve our service

3. Lawful Basis for Processing

Under POPIA, we only process your personal information where we have a lawful basis to do so: your consent (e.g. the Terms & Privacy checkbox at signup, guardian consent for minors, or the cookie banner), the necessity of processing to perform our contract with you (providing the service you signed up for), or to comply with a legal obligation.

4. Sharing With Denovo (Our Payment Processor)

When you subscribe to a paid plan, your payment is processed by Denovo, our third-party payment processor. We share only what is necessary to process your payment (such as your email address and purchase details) — Denovo handles your card details directly and we never see or store them. Denovo processes this information under its own privacy and security practices as an independent operator.

5. Cross-Border Processing

Tactical Path serves a global audience from a South African base. Your personal information may be transferred to, stored, and processed in countries outside South Africa — including wherever our hosting and payment-processing infrastructure operates — which may have different data protection laws from South Africa. Where we transfer your information across borders, we take reasonable steps to ensure it continues to receive a level of protection consistent with POPIA.

6. Data Retention

We retain your personal information for as long as your account is active, and for a reasonable period afterward to meet legal, accounting, and dispute-resolution requirements. Consent records are kept for as long as your account exists plus a reasonable period thereafter, so we can demonstrate compliance. You may request deletion of your account and associated data at any time (see your rights below).

7. Children & Guardian Consent

If you are under 18, a parent or guardian must provide consent before your account is created. We record the guardian's name, email, and the time consent was given as part of our compliance records. A guardian may contact us at any time to review or withdraw this consent, which will result in account deactivation.

8. Your Rights Under POPIA

As a data subject under the Protection of Personal Information Act, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or outdated information
• Request deletion of your personal information, subject to our legal retention obligations
• Object to processing of your information in certain circumstances
• Withdraw consent at any time, without affecting processing already carried out
• Lodge a complaint with South Africa's Information Regulator if you believe we have not complied with POPIA

To exercise any of these rights, contact us using the details in Section 11 below.

9. Security

We use reasonable technical and organizational measures — including encrypted password storage and secure, HTTP-only session cookies — to protect your personal information against loss, unauthorized access, and disclosure. No method of transmission or storage is ever 100% secure.

10. Cookies

We use a small number of cookies to keep you signed in and remember your preferences. Full details, including how to control them, are in our Cookie Policy.

11. Contact & Our Information Officer

For any question about this Privacy Policy, to exercise your POPIA rights, or to reach our Information Officer, please email privacy@app.tacticalpath.co.za.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by a new policy version, and every consent we record references the version in effect at the time. Continued use of Tactical Path after an update constitutes acceptance of the revised policy.