Privacy Policy

1. Who We Are

NEXTON INTERACTIVE LIMITED trading as FC Tactix operates FC Tactix, a web platform for tactics boards, drills, sessions, team management, player development, exports, sharing, and club collaboration. This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you use the service, website, and related features (together, the "Service").

You should read this policy together with our Terms of Service and Cookie Policy.

2. Account Holders, Clubs, and Youth Players

The Service is intended for adults. You must be at least 18 years old to create or use an account directly.

Authorized coaches, clubs, academies, and other adult staff may use the Service to manage records about players, including youth players, where they have a lawful basis to do so and have given any notices or obtained any consents required by applicable law. Youth players are permitted as managed player records; they are not permitted as direct account holders at launch.

If we learn that someone under 18 created an account directly, we may suspend or remove that account. If you believe youth data has been uploaded without proper authority, contact us at contact@fctactix.com.

3. Personal Data We Collect

We collect different categories of data depending on how you use the Service:

• Account and profile data - name, email address, password hash, profile image, account identifiers, authentication records, and two-factor authentication status.
• Session and security data - session tokens, IP address, device or browser metadata, timestamps, and related authentication activity.
• Board, drill, session, and club data - tactics boards, annotations, animations, formations, drills, sessions, library items, club records, invitations, and activity history that you create or upload.
• Team and player records - player names, positions, squad assignments, jersey numbers, development plans, evaluations, observations, availability, injury status, evidence attachments, photos, and related notes entered by authorized adult users.
• Uploads and generated files - files such as player photos, plan evidence, shared exports, and privacy export files generated on request.
• Collaboration and sharing data - room presence, live collaboration metadata, share links, public library actions, and view counts for shared content.
• Billing data - subscription tier, status, billing cadence, subscription end dates, Polar customer, order, and subscription identifiers, and seat-related billing records for club plans. We do not store full payment card details.
• Support and communication data - support requests, feedback, account emails, launch-update requests, marketing preferences, consent records, unsubscribe or suppression records, and other communications you send to us.
• Operational diagnostics - error reports, route names, timestamps, browser and device metadata, and pseudonymous identifiers used to monitor reliability and security.
• Local browser storage - preferences, autosaves, formations, appearance settings, and cookie-consent choices stored in your browser as described in our Cookie Policy.

4. Sensitive Data and Health Information

Some workflows in the Service can contain sensitive personal data, especially injury, rehabilitation, availability, and other health-related notes about players. Even a simple injured or not injured flag can reveal health status.

We expect clubs, academies, and coaches to use these workflows only where they have lawful authority to collect and upload that data and where they have provided any required notices or obtained any required consents. Users should only record data that is relevant and necessary for the intended coaching or team management purpose.

5. How We Use Personal Data

• Provide, operate, maintain, and secure the Service.
• Authenticate users, manage sessions, and prevent abuse.
• Save, sync, display, export, and share the content you create.
• Enable club collaboration, sharing, presence, and approvals.
• Operate player development, team management, and reporting workflows.
• Process subscription checkout, billing, and seat management.
• Send transactional emails such as verification, password reset, billing, legal, security, and account notices.
• If you request launch updates or opt in to marketing, send product updates, launch announcements, and offers where permitted by applicable law.
• Maintain consent, unsubscribe, and suppression records for communications compliance.
• Provide board AI play generation when you actively use that feature.
• Monitor reliability, troubleshoot incidents, and improve the Service.
• Comply with legal obligations and respond to lawful requests.

If you join a waitlist, request launch updates, or opt in to marketing communications, we may send you launch announcements, product updates, offers, and related promotional messages about FC Tactix where permitted by applicable law. Marketing messages will include a way to unsubscribe.

We may still send non-promotional service communications needed to operate your account or the Service, including verification, billing, security, legal, and administrative notices.

6. Legal Bases for Processing

Depending on your location and the law that applies, we rely on one or more of the following bases:

• Contract performance - to create your account, deliver the Service, manage subscriptions, and provide requested features.
• Legitimate interests - to secure the Service, prevent abuse, maintain logs, diagnose errors, and improve performance and reliability.
• Consent - for optional analytics, marketing communications where required, and any other optional processing where consent is required.
• Legal obligation - where we must comply with laws, lawful requests, taxation, or other regulatory requirements.

For player, youth, and health-related records uploaded by clubs or coaches, the relevant organization or adult user is usually responsible for identifying the lawful basis for collecting and supplying that data to the Service.

7. Controller and Processor Roles

NEXTON INTERACTIVE LIMITED acts as a controller for data we need to run our business and the Service, such as account management, subscription records, service security, support, and compliance.

When clubs, academies, or coaches upload player records and other team data, they often decide what data is collected, why it is collected, and who it relates to. In those cases, they may act as controllers for that source data, and we typically act as a service provider or processor for that content while still acting as a controller for our own operational and legal needs.

8. AI Processing at Launch

At launch, the only live AI feature is board AI play generation on the tactics board. When you use it, we send the relevant prompt and board context to OpenAI. Depending on what you put on the board or in the prompt, this may include formations, positions, annotations, labels, player names, and other tactical context you choose to submit.

If your board uses club-approved grounding or reference content, that supporting context may also be included so the model can respond appropriately. Do not include unnecessary personal or sensitive data in AI prompts. AI output can be inaccurate or incomplete and should be reviewed by a human coach before use.

OpenAI's privacy information is available at openai.com/privacy.

9. Service Providers and Disclosures

We share personal data with service providers that help us run the Service. Current categories include:

• Neon - Managed PostgreSQL database hosting for account records, saved content, club data, and operational application data.
• Vercel - Application hosting, content delivery, blob storage used by some uploads and exports, and optional Vercel Analytics when you consent.
• OpenAI - Board AI processing when you use AI play generation on the tactics board.
• Liveblocks - Real-time collaboration infrastructure for shared board presence, room state, and live co-editing features.
• Sentry - Operational error monitoring and performance diagnostics used to detect and troubleshoot failures.
• Resend - Transactional and opt-in marketing email delivery for verification, password reset, account communications, launch updates, and product announcements.
• Polar - Subscription checkout, billing, customer portal, and related subscription records.
• Google OAuth - Optional social sign-in provider if you choose to authenticate with Google.

We may also disclose data if required by law, to enforce our terms, to protect users, or as part of a corporate transaction such as a merger, investment, or sale.

10. International Transfers

We are based in Kenya, but several of our infrastructure and service providers operate in the United States and other countries. As a result, personal data may be transferred to, stored in, or accessed from countries outside Kenya or outside your home jurisdiction.

Where cross-border transfer rules apply, we seek to rely on lawful transfer mechanisms and provider commitments that are appropriate for the relevant data flow.

11. Retention

We keep personal data for as long as reasonably necessary for the purposes described in this policy, including to provide the Service, maintain records, resolve disputes, and comply with legal obligations.

• Account and subscription records are generally kept while your account is active and for a reasonable period afterward for legal, billing, and security purposes.
• Player, team, club, board, drill, and session content is kept while the relevant workspace or account remains active, unless removed earlier.
• Session, diagnostic, and security logs are retained according to operational needs and provider settings.
• Uploaded files and generated exports may remain in active storage, temporary storage, caches, or backups for a limited period after associated records are deleted or replaced.

12. Your Rights

Depending on applicable law, you may have the following rights:

• Access - Ask whether we process your personal data and request a copy of relevant information.
• Correction - Ask us to correct inaccurate or incomplete personal data.
• Deletion - Ask us to delete personal data where the law gives you that right.
• Restriction or objection - Ask us to restrict certain processing, object to processing based on legitimate interests where applicable, or object to direct marketing at any time.
• Portability - Request a machine-readable export of data you provided to us where portability rights apply.
• Withdraw consent - Withdraw consent for optional processing, such as analytics choices, without affecting earlier lawful use.
• Complaint - Lodge a complaint with the Office of the Data Protection Commissioner in Kenya or another competent regulator where applicable.

Some requests can also be started from your profile tools, such as account export or account deletion where available.

13. U.S. State Privacy Rights Where Applicable

If a U.S. state privacy law applies to your relationship with us, you may have additional rights such as access, deletion, correction, portability, and appeal rights. We do not sell personal information, and we do not use personal information for cross-context behavioral advertising.

14. Public Sharing and Visibility

If you create a share link, the linked content can be accessed by anyone who has the URL. We do not include share-link pages in our sitemap and we apply noindex signals to those pages, but we cannot prevent recipients, search tools, screenshots, or third parties from redistributing or capturing content once it has been shared.

You are responsible for ensuring that anything you publish or share through the Service does not include confidential, personal, or sensitive data that you are not authorized to make available.

15. Security

We use measures designed to help protect the Service and the data stored in it, including HTTPS or TLS in transit, authentication safeguards, optional two-factor authentication, role-based access controls for club workflows, private-access file flows, and operational monitoring for security and reliability. No online service can guarantee absolute security.

16. Cookies and Local Storage

We use essential cookies for authentication and security, optional analytics when you consent, and browser storage for preferences and client-side functionality. See our Cookie Policy for details.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the Service, our providers, legal requirements, or our data practices. When we do, we will update the date at the top of this page and, where appropriate, provide additional notice.

18. Contact

For privacy questions, complaints, or rights requests, contact NEXTON INTERACTIVE LIMITED at contact@fctactix.com.

P.O BOX 632, 00618 - RUARAKA, NAIROBI, KENYA

If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner in Kenya or another regulator with authority over your complaint where applicable.