Who this policy covers
This policy applies to everyone who creates an account or uses TacAd (“the site”, “we”, “us”), a toolkit for individual serving police officers. It explains what we collect, why, how long we keep it, and the choices and rights you have over it.
You can contact us about privacy matters at dataquality@tacad.info.
Information we collect
|
Category |
What we collect |
When |
|---|---|---|
|
Account & identity |
Name, work email address, collar number, police force (derived from your email domain), username, password (stored as a one-way hash, never in readable form) |
When you register |
|
Two-factor authentication |
An authentication app secret and one-time backup codes |
After registration |
|
Lock Box (optional) |
A passcode (hashed) and personal notes/instructions you write for next of kin, encrypted; a release code you can share with someone you trust. Release codes only work if there has been no recent activity on your TacAd account. |
If you set up a Lock Box |
|
Location sharing (optional) |
A single GPS coordinate, automatically deleted after the sharing window you choose ends (up to 90 minutes maximum). This is not a live tracking feature. Location is not updated unless manually triggered by you. |
Only when you actively press “Share my location” |
|
Expenses (optional) |
Claim amount, date, category, description, and an uploaded receipt (image or PDF) |
If you log an expense claim |
|
Overtime & pay tools (optional) |
Contracted hours and, if you choose to enter it, your annual salary — used only to power your personal overtime calculator |
If you use these tools |
|
Referrals (optional) |
A referral code and the email address of anyone you invite who signs up through it |
If you refer a colleague |
|
Payment & subscription |
Handled entirely by Stripe — we only ever receive your subscription status (active, trialing, cancelled) from Stripe, never your card details |
If you subscribe |
|
Technical data |
IP address (held briefly, to prevent abuse like repeated failed logins — see “How we protect your data”), browser/device information standard to any web request |
Every visit |
We do not collect, and the site is not designed to hold, operational information, investigation details, intelligence, informant information, or any personal data about victims, witnesses or suspects. Tools where free text is entered carry an on-screen reminder not to include personal or operationally sensitive information.
How we use your information
- To create and secure your account, verify you hold a genuine police force email address, and sign you in
- To provide the features you choose to use — reference tools, Lock Box, location sharing, expenses, overtime calculations, referrals
- To process payments and manage your subscription, via Stripe
- To send you service emails: verifying your email address, confirming a password change, 2FA codes, and (if you share a Lock Box release code) a notification to our administrators as a safeguard
- To detect and prevent abuse — for example, rate-limiting repeated failed sign-ins or passcode attempts
- To keep the site running reliably and securely
We do not use your data for advertising, and we do not sell or rent your personal data to anyone.
Our legal basis for processing your data
Under UK GDPR, we rely on:
- Performance of a contract — account creation, authentication, and providing the features of the service you’ve signed up for
- Legitimate interests — fraud and abuse prevention (e.g. rate-limiting, lockouts), and keeping the site secure and running; we’ve weighed this against your rights and interests and consider it proportionate
- Consent — for anything genuinely optional and off by default, such as sharing your location with colleagues or entering a salary figure for the overtime calculator; you can withdraw this at any time by simply not using that feature, or by removing the data from your profile where that option exists
We do not process any special category data (such as health, religion or similar) as part of using TacAd, and we ask that you don’t include any in free-text fields either.
Who we share data with
We only share what’s needed to run the service:
- Stripe (payment processing) — if you subscribe, your payment details go directly to Stripe; we never see or store your card number. See Stripe’s privacy policy.
- Hosting Provider — our hosting provider stores the site’s database and files on our behalf and used to send account and notification emails. Based in the UK.
- Google — we use Google Fonts (page styling) on every page, Google reCAPTCHA on sign-in and sensitive actions (only where enabled), and an embedded Google Map if you use location sharing. Each of these causes your browser to contact Google directly; see Google’s privacy policy.
- Other officers in your force — only where a feature is explicitly designed to share something with them (e.g. an active location share), and only for as long as you choose.
We don’t share your data with anyone else, and we never sell it. If law enforcement or a court requires us to disclose information, we’ll only do so where we’re legally required to.
International transfers
Some of the providers we use (Stripe, Google) may process data outside the UK, including in the United States. Where this happens, they do so under recognised safeguards — such as the UK’s International Data Transfer Addendum or an adequacy decision — intended to give your data the same level of protection it would have in the UK.
How long we keep your data
|
Data |
Retention |
|---|---|
|
Account details |
For as long as your account is active, plus a limited period of 3 months afterwards in case you reactivate or for legal/accounting reasons You can delete your account fully from the profile page |
|
Location shares |
Automatically deleted once the sharing window ends (at most 90 minutes after sharing) |
|
Lock Box notes |
Kept until you delete them or close your account |
| Overtime records | Kept for 18 months after being marked as “Credited” or until you delete them |
|
Expenses & receipts | Kept until you delete them or close your account |
|
Failed login / rate-limiting records |
Held only briefly (minutes to hours) purely to enforce lockouts, then discarded |
|
Payment records |
Retained by Stripe per their own retention policy; we keep only your subscription status |
When you close your account, we deactivate it and remove or anonymise personal data we no longer have a reason to keep, other than what we’re required to retain by law.
How we protect your data
- Passwords, backup codes and your Lock Box passcode are hashed, never stored in a form that could be read back
- Your Lock Box notes and two-factor authentication secret are encrypted, so they can’t be read even from a raw copy of our database
- Receipts and other uploaded files are stored privately, under random filenames, and only ever served back to the account that owns them
- Two-factor authentication, account lockouts, and rate limiting all help prevent unauthorised access
- Payment card details never reach our systems at all — they go directly to Stripe
Cookies
We use strictly necessary cookies only — to keep you signed in, remember your session, and (briefly, during sign-in) to track an in-progress two-factor check. We don’t use advertising or tracking cookies, and we don’t run third-party analytics.
If reCAPTCHA or the embedded Google Map are used, Google may set its own cookies as part of that — this is covered by Google’s own policies, not ours.
Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Correct it if it’s inaccurate or incomplete
- Erase it, in certain circumstances
- Restrict or object to our processing of it
- Port your data to another service, where technically feasible
- Withdraw consent at any time, for anything we process on that basis (e.g. location sharing), without affecting anything processed before that
Most of this you can already do yourself from your profile page. For anything else, contact us at dataquality@tacad.info and we’ll respond within the timeframes required by law.
If you’re unhappy with how we’ve handled your data, you also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO).
Children’s privacy
TacAd is intended for serving police officers and is not directed at, or intended for use by, children. We don’t knowingly collect personal data from anyone under 18. Registration requires a verified police force email address, which in practice excludes children.
Changes to this policy
We may update this policy from time to time, for example as we add new features. We’ll update the “last updated” date at the top, and where a change is significant, we’ll let you know directly (e.g. by email) before it takes effect.
Contact us
If you have any questions about this policy or how we handle your data:
TacAd.info – dataquality@tacad.info
