Privacy policy
This policy explains what personal data TactiCam processes, why, and what your rights are. It applies to the TactiCam application and website. It complies with the Swiss Federal Act on Data Protection (FADP) and, for data subjects in the EU, with the GDPR.
1. Data controller
TactiCam is a service operated by Holographisme Sàrl, Rue Jean-Violette 4, 1205 Geneva, Switzerland (business ID: CHE-130.055.058).
Contact: support@tacticam.app.
2. Data we process
- Account : first name, last name, email address, display name, password (hashed), role and squad number.
- Sporting content : videos and clips filmed, annotations, comments, player tags, attendance at matches.
- Team data : club name, squad, logo.
- Technical data : connection logs, session cookie, internal usage statistics (with no third-party advertising tracker). Your IP address is never stored in clear text : only an irreversible fingerprint is kept, and the country is derived from a directory installed on our own server — the address itself never leaves it.
3. Purposes and legal bases
- Providing the service (filming, video analysis, team management, notifications) — performance of the contract (our terms).
- Security, fraud prevention and proper operation — legitimate interest.
- Image rights of people filmed — consent (see section 4).
4. Videos, image rights and minors
We perform no facial recognition and no biometric processing. Any video analysis detects shapes and movement for tactical support, without identifying a person by their face.
If you no longer wish to appear in a video, send the request to your club: it decides what happens to its recordings, and we carry out its instructions. In practice:
- You are the only person on screen — the clip can simply be deleted.
- Other people are filmed at the same time — the usual case on a pitch. Deleting the clip would also erase your teammates' work. We do not offer blurring. The club then decides between deleting the sequence, trimming it, or keeping it; in case of disagreement, the decision and its justification are theirs, as data controller.
- In every case, your name can be removed from the tags, mentions and comments attached to the video, even if the footage is kept.
How to make the request. It can be made directly in the app, from Profile › Settings › "Request removal of a video I appear in", or in writing to support@tacticam.app. The request is recorded, passed to the team managers and club administrators, and the decision is communicated to you, whether or not it is granted.
Scope of deletion. When the club grants the request, the video is deleted from the server et and from the profiles of all players who kept it under section 8; if it is a panorama, its raw angles are deleted with it. The author of the decision, its date and its reason are kept, so that the handling of the request can be evidenced.
5. Hosting and data location
All data, including videos, is hosted in Switzerland, at Infomaniak Network SA (Geneva). No data is sold or passed to third parties for commercial purposes.
The provision of the service requires the assistance of processors for the collection of subscriptions, the sending of service emails, the protection of forms against automated submissions, the establishment of the remote connection and availability monitoring. None of them has access to sports content. They are listed in the following section.
6. Processors
- Infomaniak Network SA — Switzerland. Hosting of data and videos, email delivery, video-conferencing service for review sessions (kMeet).
- Sendinblue SAS (Brevo) — France (European Union). Sending of service emails: account creation, password, address confirmation, notifications and messages from TactiCam. Data disclosed: the recipient's email address and name, the content of the message. If this service is unavailable, emails are routed through Infomaniak.
- Stripe Payments Europe Ltd — Ireland. Subscription payments. Data provided: email address and billing information. Card data is collected directly by Stripe and does not pass through our systems.
- Intuition Machines, Inc. (hCaptcha) — United States. Protection of forms and account creation against automated submissions. Data processed: technical signals emitted by the browser, not linked to the account or to team content. This service is only called when a form is submitted; simply browsing the site does not activate it.
- Metered, Inc. — United States. Signalling relay used to establish the link between the remote and the camera when the direct connection fails. Data processed: control instructions and device network addresses, for the duration of the session. Images and videos viewed from the remote pass through our servers in Switzerland and therefore fall under the hosting described in section 5.
- UptimeRobot — European Union. Periodic availability checks of the service. Data processed: a check address and the email address receiving the alerts, excluding any user data.
- OpenStreetMap Foundation (Nominatim) — United Kingdom. Address suggestions when creating a match. Data disclosed: the text entered in the address field, at the time it is entered. This service is only called from that form; no account, team or video data is passed to it.
Each processor is bound by a data processing agreement and acts only on our documented instructions. The list may change; any substantial modification is flagged on this page.
7. Transfers outside Switzerland
Two processors are established in the United States. In accordance with articles 16 and 17 FADP, each of these transfers carries an appropriate safeguard:
- Intuition Machines, Inc. is certified under the Swiss-U.S. Data Privacy Framework, recognised by the Federal Council as providing adequate protection.
- Metered, Inc. is bound by the standard contractual clauses within the meaning of art. 16 para. 2 let. d FADP, incorporated into its data processing agreement.
Processors established in the European Union and in the United Kingdom benefit from the adequacy recognition granted by the Federal Council and require no additional safeguard.
8. Retention period
Data is not kept longer than the purpose pursued requires.
- Account and content — for as long as the account and the team are active.
- Inactive account — email warning after two years without login, deletion three months later. Logging in again stops the process.
- Deleted clip — seven days in the bin, restorable, then permanent deletion.
- Deleted clip in which a player is tagged — it remains accessible to that player alone, on their profile, beyond the seven days: deletion decided by the team does not deprive the person named in it of their recording. It is no longer accessible to other members, no longer counts towards the team's storage, and remains hosted at TactiCam, with no download option. The club may end this at any time through a full deletion (section 4).
- Security check reports — 90 days after the last signal recorded for the account concerned (section 12).
- Accounting records — ten years, in accordance with art. 958f of the Swiss Code of Obligations.
9. Account deletion
Whether requested or following prolonged inactivity, deleting an account leaves two things in place, for the following reasons:
- your comments remain visible, with your identity reduced to a first name and last initial (for example "Alex M."): removing them would make conversations others took part in unintelligible;
- les videos you recorded remain the property of the team. They belong to the club that produced them and not to the account that made the recording — otherwise a coach leaving would take a whole season of collective work with them.
If you appear in a video and no longer wish to, the procedure is described in section 4.
10. Your rights
You have the rights of access, de rectification, d'erasure, d'objection, de restriction, de portability, and the right to withdraw your consent at any time. To exercise them: support@tacticam.app.
You may also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland, or with your supervisory authority in the EU.
11. Data security
Encrypted connections (HTTPS/HSTS), hashed passwords, data access restricted per team, no biometric processing. Videos are only accessible after authentication or through an explicitly generated share link; they are never exposed in direct access. Cross-site request forgery (CSRF) protection and browser security headers are enabled. An anti-bot check protects account creation and public forms. Despite our measures, no system is infallible.
12. Service security
In order to detect accounts created or used abusively, an automated check is carried out every day on data already collected for the provision of the service: the domain of the email address, the account creation date, team membership, clips and invitations created, pages viewed and an irreversible fingerprint of the IP address. No data is collected for this purpose alone.
This check produces only a report, which is reviewed by a TactiCam administrator. It does not constitute an automated individual decision within the meaning of art. 21 FADP and art. 22 GDPR: no account is restricted, suspended or deleted on the basis of its result alone.
This processing is based on TactiCam's legitimate interest in ensuring the security of the service and preventing abuse (art. 31 para. 1 FADP; art. 6(1)(f) GDPR). The data concerned is not disclosed to any third party. The retention period for reports is set out in section 8.
13. Cookies
We use a session cookie strictly necessary for login. No advertising cookie and no third-party tracker.
Origin cookie. On your first visit, we keep in a cookie named “tc_origine” the page you arrived on, the site or campaign you came from, and the date. If you create an account, this information is stored with it: it tells us which pages and which ads bring new clubs. The cookie lasts 90 days, stays on our site and is never passed to a third party. Our other visit measurements (how far a page is read, buttons tapped) are anonymous totals, not linked to any person.
14. Changes
This policy may change; the date of the last update appears at the top of the page.