Customer-Facing Legal Policies / Terms of Service

TacSafe

Customer-Facing Legal Policies

Version 2026.09.20 | Effective September 20, 2026

Terms, Privacy, AUP, Cookie, AI/Safety, Security, and Subprocessor notices

Tactically Safe LLC — https://tacsafe.app

Package Contents

Effective: September 20, 2026 | Version: 2026.09.20

1. Terms of Service

2. Privacy Policy

3. Acceptable Use Policy

4. Cookie Notice

5. AI and Safety Features Addendum

6. Security and Data Handling Statement

7. Subprocessor List

Terms of Service

Effective: September 20, 2026 | Version: 2026.09.20

These Terms of Service ("Terms") govern access to and use of TacSafe, a business software service provided by Tactically Safe LLC ("TacSafe," "we," "us," or "our").

Safety-critical noticeTacSafe is an assistive software tool. It does not replace a competent person, qualified safety professional, employer safety program, site inspection, manufacturer instructions, safety data sheet, project-specific requirements, or compliance with applicable law. AI-assisted outputs may be incomplete or incorrect and require human review.

1. Agreement and eligibility

By creating an account, accepting an Order Form, clicking to accept these Terms, or using TacSafe, you agree to these Terms on behalf of yourself and, if applicable, the organization you represent ("Customer"). You represent that you have authority to bind Customer.

The Service is intended for business and workplace use by persons at least 18 years old. It is not directed to children.

2. Relationship to signed agreements

If Customer and TacSafe sign a SaaS Subscription Agreement, Order Form, Data Processing Addendum, or other written agreement covering the Service, that signed agreement controls to the extent of a conflict with these Terms.

3. Accounts and administrators

Customer is responsible for account credentials, authorized users, role assignments, company administrators, and activity occurring under its accounts. Customer will promptly disable access for users who no longer require it and will notify TacSafe of suspected unauthorized access.

Company administrators may access, manage, export, correct, or delete information within the Customer workspace as permitted by the Service. End users should direct workplace-record questions to their employer or organization administrator when Customer controls the relevant data.

4. Subscription, fees, and taxes

Paid subscriptions, seat counts, project limits, modules, usage limits, fees, billing frequency, and subscription term are stated in the applicable Order Form or checkout page. Unless stated otherwise, fees are non-refundable except as expressly provided in the governing agreement.

Customer is responsible for applicable sales, use, excise, value-added, and similar taxes, excluding taxes based on TacSafe net income. TacSafe may suspend paid access for undisputed overdue amounts after reasonable notice.

5. Customer Content

"Customer Content" means information, documents, photographs, project manuals, safety records, credential records, incident information, evaluations, safety data sheets, comments, and other content submitted to the Service by or for Customer.

Customer retains ownership of Customer Content. Customer grants TacSafe a limited, non-exclusive right to host, copy, process, transmit, display, and otherwise use Customer Content only as necessary to provide, secure, support, improve the functionality of, and comply with law in connection with the Service.

Customer represents that it has the rights, permissions, notices, and lawful basis necessary to submit Customer Content and instruct TacSafe to process it.

6. Workplace and personnel information

Customer is responsible for determining what workplace, employee, contractor, credential, evaluation, incident, photograph, and project information may lawfully be entered into the Service and for providing legally required notices to its personnel.

Unless separately agreed in writing, Customer will not use the Service to store Social Security numbers, full financial account numbers, payment card data, protected health information subject to HIPAA, biometric templates used for identification, classified information, or other data requiring specialized regulated handling.

7. AI-assisted and automated features

The Service may provide AI-assisted document extraction, image or hazard analysis, search, classification, summaries, recommendations, or other generated output ("AI Output"). AI Output is probabilistic and may be incomplete, outdated, misleading, or incorrect.

Customer must independently review AI Output before relying on it. Customer remains responsible for workplace conditions, inspections, safety decisions, training, corrective actions, regulatory compliance, personnel decisions, and the accuracy of records it maintains.

Customer may not use AI Output as the sole basis for hiring, firing, discipline, compensation, eligibility, assignment, medical, or other legally significant employment decisions.

References to OSHA standards, safety guidance, or project requirements are provided for informational assistance only. TacSafe does not provide legal advice and does not guarantee that use of the Service will establish compliance with OSHA or any other law or standard.

8. Emergency and high-risk use

The Service is not an emergency monitoring, dispatch, medical, rescue, fire, life-safety, or guaranteed hazard-detection system. Do not rely on TacSafe to identify every hazard or to notify emergency responders. Use appropriate emergency procedures and qualified personnel.

9. Acceptable use

Customer and users must comply with the Acceptable Use Policy. TacSafe may investigate suspected abuse and may suspend access when reasonably necessary to protect users, the Service, third parties, or legal compliance.

10. Third-party services

The Service may interoperate with hosting, identity, storage, payment, communications, analytics, AI, and other service providers. Third-party services are governed by their own terms when Customer separately contracts with them. TacSafe remains responsible for its contractual obligations relating to subprocessors it engages to provide the Service.

11. Intellectual property

TacSafe and its licensors own the Service, software, interfaces, documentation, trademarks, and related intellectual property, excluding Customer Content. Subject to these Terms, TacSafe grants Customer a limited, non-exclusive, non-transferable right during the subscription term to access and use the Service for its internal business operations.

If Customer provides feedback or suggestions, Customer grants TacSafe a perpetual, worldwide, royalty-free right to use that feedback without identifying Customer or disclosing Customer Confidential Information.

12. Confidentiality

Each party will protect the other party's non-public business, technical, and security information using at least reasonable care and will use such information only for the purposes of the relationship. Confidentiality obligations do not apply to information that is public through no breach, already lawfully known, independently developed, or lawfully received from a third party.

13. Privacy and data protection

TacSafe processes personal information as described in the Privacy Policy and, where applicable, the Data Processing Addendum. For organization-managed workspaces, Customer generally determines the purposes and means of processing Customer Content and TacSafe acts as Customer's service provider or processor for that content.

14. Suspension and termination

TacSafe may suspend access for a material security threat, unlawful use, violation of these Terms or the Acceptable Use Policy, nonpayment, or as required by law. Where practical, TacSafe will provide notice and an opportunity to cure.

Upon cancellation or termination, the Customer workspace may be placed in a restricted archive for 30 days. During that period, Customer may request export assistance subject to the applicable plan and technical availability. After the 30-day archive period, Customer Content is scheduled for permanent deletion from production and primary storage, subject to legal holds and routine disaster-recovery backup expiration.

15. Beta and preview features

Beta, preview, experimental, or early-access features may be changed, suspended, or discontinued at any time and may contain defects. Unless otherwise agreed, beta features are provided without service-level commitments and are subject to the Beta Evaluation Agreement when presented.

16. Warranty disclaimer

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICE, AI OUTPUT, DOCUMENTATION, AND BETA FEATURES ARE PROVIDED "AS IS" AND "AS AVAILABLE." TACSAFE DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY, AND ANY WARRANTY THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR IDENTIFY ALL SAFETY HAZARDS.

17. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA, GOODWILL, OR BUSINESS INTERRUPTION, EVEN IF ADVISED OF THE POSSIBILITY.

EXCEPT FOR PAYMENT OBLIGATIONS, A PARTY'S FRAUD OR WILLFUL MISCONDUCT, OR LIABILITY THAT CANNOT LEGALLY BE LIMITED, EACH PARTY'S AGGREGATE LIABILITY ARISING OUT OF THE SERVICE WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER FOR THE SERVICE DURING THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY. A SIGNED SAAS SUBSCRIPTION AGREEMENT MAY PROVIDE DIFFERENT CAPS.

18. Indemnity

Customer will defend and indemnify TacSafe from third-party claims arising from Customer Content, Customer's unlawful use of the Service, or Customer's violation of third-party rights, except to the extent caused by TacSafe. Any broader or reciprocal indemnities are governed by an applicable signed SaaS Subscription Agreement.

19. Changes to the Service or Terms

TacSafe may update the Service and these Terms. Material changes to these Terms will be posted with an updated effective date and, when required, notice will be provided through the Service or by email. Changes will not retroactively reduce rights under an existing signed agreement.

20. Governing law and disputes

These Terms are governed by the laws of the State of Nebraska, without regard to conflict-of-law rules. Unless a signed agreement states otherwise, the parties consent to exclusive jurisdiction and venue in the state and federal courts located in Lancaster County, Nebraska.

20A. Nebraska entity, consumer protection, and electronic records

Tactically Safe LLC is a limited liability company organized under the laws of the State of Nebraska. These Terms are intended for business and workplace users. Nothing in these Terms is intended to waive non-waivable rights under the Nebraska Consumer Protection Act (Neb. Rev. Stat. §§ 59-1601 et seq.) or other mandatory Nebraska law to the extent such law applies.

Electronic signatures, click-to-accept records, and electronic records related to account creation and legal acceptance are intended to have the same legal effect as paper records under the Nebraska Uniform Electronic Transactions Act (Neb. Rev. Stat. §§ 86-612 et seq.) and applicable federal law, including the Electronic Signatures in Global and National Commerce Act.

21. Contact

Customer service: customer-service@tacsafe.app or +1 (308) 870-7020. Legal notices: Legal@tacsafe.app. Website: https://tacsafe.app.

Privacy Policy

Effective: September 20, 2026 | Version: 2026.09.20

This Privacy Policy explains how Tactically Safe LLC collects, uses, discloses, and retains personal information in connection with TacSafe, https://tacsafe.app, and related business services.

Organization-managed accountsIf your employer or another organization provides your TacSafe account, that organization generally controls the workplace records and Customer Content in its workspace. Privacy requests concerning those records may need to be directed to the organization administrator.

1. Scope and roles

This Policy applies to information TacSafe handles as a business or controller for its own website, account administration, sales, support, security, and billing activities, and to information processed as a service provider or processor on behalf of Customers.

Where Customer determines why and how workplace records are processed, Customer is responsible for its own privacy notices and legal basis, and TacSafe processes that information under Customer instructions and the applicable agreement.

2. Information we collect

Category

Examples

Account and identity

Name, business email, organization, role, login identifiers, authentication and MFA information.

Workspace and personnel records

Credentials, training or evaluation records, employee or contractor profile information, incidents, comments, project assignments, photographs, and files submitted by Customer.

Safety and project content

Hazard-assessment images, project manuals, safety documents, SDS files, forms, reports, and related metadata.

Device and usage

IP address, browser or device type, timestamps, session and security logs, feature usage, diagnostic events.

Commercial and support

Subscription and billing status, transaction metadata, support communications, product feedback.

Cookies and similar technologies

Session identifiers and, if enabled, analytics or preference information.

3. How we use information

• Provide, operate, authenticate, secure, maintain, and support the Service.
• Process Customer instructions, including document processing, search, storage, AI-assisted analysis, reporting, and collaboration features.
• Administer subscriptions, payments, account limits, and customer support.
• Detect, investigate, prevent, and respond to security incidents, fraud, abuse, and violations of our policies.
• Maintain logs, backups, service reliability, and business records.
• Improve product functionality and usability using operational information and feedback, subject to contractual restrictions on Customer Content.
• Comply with law, enforce agreements, and protect legal rights.

4. AI processing

Some TacSafe features may use automated or AI-assisted processing to extract data, classify documents, search information, summarize content, or analyze images. AI Output may be inaccurate and is designed for human review. TacSafe does not intend AI-assisted features to make final employment, disciplinary, eligibility, medical, legal, or safety decisions for Customers.

If TacSafe uses a third-party AI provider to process Customer Content, the provider will be treated as a subprocessor where required and will be identified in the applicable Subprocessor List before production Customer Content is routed to that provider.

5. How we disclose information

• Service providers and subprocessors that provide hosting, database, authentication, storage, email, payments, security, support, analytics, or AI functionality under contractual restrictions.
• Customer administrators and authorized users within the Customer workspace, according to Customer-configured roles and permissions.
• Professional advisers, auditors, insurers, financing sources, or transaction participants subject to confidentiality obligations.
• Government authorities or other parties when required by law, legal process, or reasonably necessary to protect rights, safety, and security.
• A successor or acquiring entity in a merger, acquisition, financing, reorganization, or sale of all or part of the business, subject to applicable law.

TacSafe does not sell personal information for money. TacSafe does not use Customer workspace content for cross-context behavioral advertising.

6. Data retention

TacSafe retains information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, maintain security, and enforce agreements. Account and Customer Content retention is also governed by Customer instructions and the applicable contract.

When a Customer subscription is cancelled or terminated, the workspace may be placed in a restricted archive for 30 days and then scheduled for permanent deletion from production and primary storage, subject to legal holds and routine backup expiration. Certain billing, security, audit, and transaction records may be retained longer when required for legitimate business or legal purposes.

7. Security

TacSafe uses administrative, technical, and organizational safeguards designed to protect information, including access controls, tenant isolation controls, encryption in transit, provider-supported encryption at rest, private object storage, logging, least-privilege practices, and security testing. No method of transmission or storage is completely secure, and TacSafe does not guarantee absolute security.

8. Your privacy rights

Depending on where you live and the law that applies, you may have rights to request access, correction, deletion, portability, or information about processing; to opt out of certain sales, sharing, targeted advertising, or profiling; to limit certain uses of sensitive data; or to appeal a denied request. These rights may be subject to exceptions and verification requirements.

To submit a privacy request concerning information controlled by TacSafe, contact customer-service@tacsafe.app or call +1 (308) 870-7020. If your request concerns workplace records controlled by your employer or another Customer, we may direct the request to that Customer.

TacSafe will not discriminate against a person for exercising applicable privacy rights. Where legally required, TacSafe will recognize applicable browser-based opt-out preference signals for processing within its control.

9. California and other U.S. state disclosures

Applicable U.S. state privacy laws may require additional disclosures regarding categories of personal information, purposes of processing, recipients, retention, and consumer rights. The categories and purposes described in this Policy are intended to provide those disclosures where applicable. TacSafe does not knowingly sell personal information or share Customer workspace content for cross-context behavioral advertising.

9A. Nebraska Data Privacy Act disclosures

Tactically Safe LLC is organized under the laws of the State of Nebraska. Where the Nebraska Data Privacy Act (Neb. Rev. Stat. §§ 87-1101 to 87-1130) ("NDPA") applies to TacSafe as a controller with respect to personal data of Nebraska residents that TacSafe processes for its own business purposes (for example, website inquiries, account administration, sales, support, billing, and security), Nebraska residents may have rights to: (a) confirm whether TacSafe is processing their personal data and access that data; (b) correct inaccuracies; (c) delete personal data provided by or obtained about the consumer; (d) obtain a copy of personal data the consumer previously provided in a portable format; (e) opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer; and (f) appeal a refusal to take action on a request.

TacSafe does not knowingly sell personal data and does not share Customer workspace content for cross-context behavioral advertising. Where TacSafe processes Customer Content as a processor or service provider on behalf of a Customer organization, the Customer generally determines the purposes and means of that processing, and privacy requests concerning those workplace records should be directed to the Customer administrator. TacSafe will provide reasonable assistance to Customer controllers responding to verified NDPA requests as required by Applicable Data Protection Law and the Data Processing Addendum.

To exercise NDPA rights with respect to information controlled by TacSafe, email customer-service@tacsafe.app or call +1 (308) 870-7020 with the subject line "Nebraska Privacy Request." TacSafe will verify requests as permitted by law and will not discriminate against a consumer for exercising NDPA rights. The Nebraska Attorney General has exclusive authority to enforce the NDPA.

Applicability of the NDPA depends on statutory thresholds and exceptions (including small-business and certain excluded information categories). This section is a disclosure and does not expand TacSafe's obligations beyond applicable law.

10. Cookies

TacSafe uses cookies and similar technologies as described in the Cookie Notice. Essential technologies support authentication, security, preferences, and core functionality. Non-essential analytics or marketing technologies, if enabled, will be subject to applicable notice and consent requirements.

11. Children

TacSafe is a business service not directed to children under 18, and we do not knowingly collect personal information from children through self-directed use of the Service.

12. International users

If personal data is transferred across national borders, TacSafe will use contractual or other lawful transfer mechanisms when required by applicable law. Enterprise Customers may request a Data Processing Addendum addressing applicable international-transfer requirements.

13. Changes to this Policy

We may update this Policy to reflect changes in the Service, law, or our practices. The effective date above shows the latest revision. Material changes will be communicated when required by law or contract.

14. Contact

Customer service: customer-service@tacsafe.app or +1 (308) 870-7020. Privacy and Security reports: Security@tacsafe.app.

Acceptable Use Policy

Effective: September 20, 2026 | Version: 2026.09.20

This Acceptable Use Policy applies to all users of TacSafe. Customer is responsible for its users and for configuring access appropriately.

1. Prohibited conduct

• Use the Service for unlawful, fraudulent, deceptive, abusive, harassing, discriminatory, or infringing activity.
• Upload malware, malicious code, illegal content, or content that Customer does not have authority to process.
• Attempt to bypass authentication, authorization, rate limits, tenant isolation, security controls, or access restrictions.
• Probe, scan, or test the vulnerability of the Service without written authorization, except through an approved vulnerability-disclosure or testing program.
• Interfere with availability or integrity through denial-of-service activity, excessive automated requests, scraping that materially burdens the Service, or destructive actions.
• Share credentials among users or use another person's account without authorization.
• Use the Service to make a solely automated employment, disciplinary, termination, compensation, medical, or legal decision about a person.
• Use AI hazard analysis or other TacSafe output as the sole safety control for a workplace, as an emergency alerting system, or as a substitute for a legally required competent person or qualified professional.
• Upload regulated data that TacSafe has not agreed in writing to process, including payment card data, protected health information subject to HIPAA, biometric templates for identification, or classified information.
• Reverse engineer, copy, resell, sublicense, or create derivative commercial services from the Service except as expressly permitted by law or a written agreement.

2. Enforcement

TacSafe may investigate suspected violations and may limit, suspend, or terminate access when reasonably necessary to protect the Service, Customer, other users, third parties, or legal compliance. When practical, TacSafe will notify Customer and allow a reasonable cure period for remediable violations.

3. Reporting abuse

Report suspected abuse or security concerns to Security@tacsafe.app.

Cookie Notice

Effective: September 20, 2026 | Version: 2026.09.20

This Cookie Notice explains how Tactically Safe LLC uses cookies and similar technologies on https://tacsafe.app and within TacSafe.

1. Essential technologies

TacSafe may use session cookies, local storage, or similar technologies that are necessary for sign-in, authentication, security, fraud prevention, user preferences, load balancing, and core application functionality. Disabling these technologies may prevent the Service from working correctly.

2. Analytics and optional technologies

TacSafe may use analytics technologies to understand aggregate usage, performance, and errors. If non-essential analytics, advertising, or marketing technologies are enabled, TacSafe will provide any consent mechanism required by applicable law and will maintain the production cookie inventory used by the consent interface.

3. Your choices

You can use browser controls to delete or block cookies. Where legally required, TacSafe will provide in-product or website controls for non-essential cookies and applicable opt-out preference signals.

4. Changes and contact

This Notice may be updated as technologies change. Questions may be sent to customer-service@tacsafe.app or +1 (308) 870-7020.

AI and Safety Features Addendum

Effective: September 20, 2026 | Version: 2026.09.20

This Addendum applies to AI-assisted document processing, image or hazard analysis, search, retrieval, classification, summarization, and other machine-generated features within TacSafe.

Human review requiredAI-assisted safety output is advisory. Customer must use qualified human judgment and applicable workplace procedures before acting on or recording an AI-generated finding.

1. Intended use

AI features are designed to assist trained personnel with organizing information, identifying items for review, and surfacing potentially relevant safety information. They are not designed to replace legally required inspections, competent persons, professional judgment, manufacturer instructions, emergency systems, or regulatory analysis.

2. Known limitations

• Images may omit context, depth, measurements, conditions outside the frame, or hazards that are hidden or visually ambiguous.
• Generated classifications, citations, summaries, and recommendations may be incomplete or incorrect.
• Regulatory materials, project documents, and source content may change after they are indexed or uploaded.
• A result showing no identified hazard does not mean the workplace is safe or compliant.
• A cited standard or project requirement may not apply to the specific facts of a workplace.

3. Customer responsibilities

• Review AI Output before presenting it as a final safety finding, corrective action, compliance determination, personnel record, or official report.
• Maintain required inspections, training, competent-person oversight, and safety programs independently of the Service.
• Validate current OSHA standards, project requirements, manufacturer instructions, and safety data sheets from authoritative sources when the information is material.
• Do not use AI Output as the sole basis for personnel or legally significant decisions.
• Provide adequate image quality, context, and source documents when using AI-assisted features.

4. Regulatory references

TacSafe may surface OSHA regulations, guidance, project requirements, or other safety materials. These references are informational and do not constitute legal advice, an OSHA interpretation, a compliance certification, or a guarantee that a regulator will agree with the output.

5. Model and provider changes

TacSafe may change models, retrieval systems, evaluation methods, and providers to improve reliability, security, cost, or performance. Material changes affecting Customer data processing will be handled in accordance with the applicable agreement and Data Processing Addendum.

6. No emergency reliance

AI features are not continuously monitoring the workplace and are not emergency or life-safety systems. Customer must use established emergency procedures and appropriate professional judgment.

Security and Data Handling Statement

Effective: September 20, 2026 | Version: 2026.09.20

TacSafe maintains a security program designed for a multi-tenant business SaaS environment. This statement describes current security practices at a high level and does not represent a certification or guarantee of absolute security.

Control area

Current approach

Identity and access

Role-based access, organization scoping, least privilege, administrator controls, and MFA support/requirements for privileged access where configured.

Database isolation

Tenant-aware authorization and row-level access controls are used to restrict organization data access.

Object storage

Customer files are stored in private object storage and delivered through controlled access paths rather than public buckets.

Encryption

TLS is used for data in transit; infrastructure providers supply encryption at rest for managed database and object-storage services.

Secrets

Production credentials are stored outside source code and access is restricted. Engineering agents are not granted autonomous production authority.

Change management

Application changes are tested and reviewed before controlled promotion. Production promotion remains a human-authorized action.

Logging and monitoring

Security, authentication, system, and operational events are logged as appropriate for detection, support, and investigation.

Backups and recovery

Managed infrastructure backup and recovery mechanisms are used according to provider capabilities and service requirements.

Vendor management

Critical service providers are selected and reviewed based on service, security, data-processing, and contractual requirements.

Incident response

TacSafe maintains procedures to investigate, contain, remediate, document, and notify affected Customers of confirmed security incidents as required by contract and law.

Responsible disclosure

Report suspected security vulnerabilities to Security@tacsafe.app. Do not access data belonging to others, degrade the Service, or conduct destructive testing. TacSafe may provide written authorization and test boundaries for approved security research.

Subprocessor List

Effective: September 20, 2026 | Version: 2026.09.20

This list identifies material third-party providers that may process Customer Personal Data to provide TacSafe. Actual processing depends on the enabled features and production configuration.

Provider

Purpose

Data involved

Notes

Vercel

Web application hosting and delivery

Application requests, diagnostics, deployment/runtime metadata

Production web application hosting.

Supabase

Database, authentication, managed backend services

Account data, workspace records, authentication metadata

Production tenant/data store.

Cloudflare R2

Private object storage

Uploaded files, documents, images, generated files

Private bucket/access-controlled delivery.

Stripe

Subscription billing and payment processing

Billing contact and transaction metadata; payment-card data handled by Stripe

If paid billing is enabled.

Postmark

Transactional email delivery

Recipient email, template content, delivery metadata

If production email delivery uses Postmark.

OpenAI

AI-assisted processing for enabled features

Only content necessary for the requested AI feature

Enabled AI features only.

Subprocessor changes. Where required by the applicable DPA, TacSafe will provide notice of a new material subprocessor and a reasonable opportunity to raise a data-protection objection.