Privacy Policy

Última atualização: 30 de setembro de 2026 (versão 1)

Lounge House Ltd ("we", "us", "our") operates Tacteros, a browser-based football manager game accessible at tacteros.com. This Privacy Policy explains how we collect, use, and protect personal data when you use the service.

The agreement governing use of Tacteros is set out in our Terms of Service.

1. Who we are

Lounge House Ltd is the data controller for personal data processed through Tacteros. Lounge House Ltd is registered with the Information Commissioner’s Office (ICO), registration reference ZC232801.

• Company: Lounge House Ltd
• Companies House registration: 17193445
• Registered office: 9 Chapel Place, 2nd Floor, London, EC2A 3DQ, United Kingdom
• Contact for privacy matters: Email

2. What data we collect

Provided by you when you register and play:

• Email address — for account access and recovery
• Password — stored only in hashed form; we never see your plaintext password
• Team name — chosen by you during setup

Generated by your use of the service:

• Gameplay data — matches played, players acquired, buildings upgraded, in-game actions and transaction history within the game
• Support requests — messages and any attachments you send through the in-game support system
• Account metadata — account creation date, last login
• Device and connection data — IP address, browser type, operating system, approximate location derived from IP
• Technical error details — error type, stack trace and page path used to diagnose failures. Error monitoring does not record session replays, performance traces or full payment details.
• Notification data — in-game notification facts, your per-channel preferences, delivery attempts and status, and the destinations needed to open the relevant game screen
• Telegram channel data — the linked Telegram account and chat identifiers, link status, relevant timestamps, locale, reachability, your Telegram notification preferences including Game announcements, and your separate Special offers consent

Collected via analytics, only after you accept analytics cookies:

• Page views and navigation within the app
• Authentication events (sign-up, login, logout)
• Browser and analytics session identifiers used to associate consented visits and events
• Confirmed, fulfilled purchases and supported confirmed refunds — an opaque transaction identifier, purchased items, item revenue and currency, and separately stated tax where available. This optional measurement applies to consenting buyers, including existing accounts and visits without campaign labels.
• Aggregated event data about how you interact with game features
• First-touch campaign data — the time of the first eligible visit, campaign source, medium, name, content and search-term labels, and a broad referring-source category. We do not keep the referring URL or advertising click identifiers in this record. Campaign labels must not contain personal information.

If you enable Analytics before registering, we carry this first-touch campaign record through email confirmation and link it to your Tacteros account. We use that link with subsequent game activity and confirmed, fulfilled purchases to measure which campaigns bring players to the game and generate revenue. Opening checkout or an unconfirmed payment notification does not count as a purchase. Later visits and login do not replace your first-touch record, and enabling Analytics later does not reconstruct an earlier visit.

We do not collect special category data (race, ethnicity, health, religion, sexual orientation, biometric or genetic data, etc.). Payments are processed by Xsolla, a regulated third-party payment provider and the merchant of record for your purchase; Xsolla's own privacy policy applies to the payment transaction, and we do not store your full payment details.

3. Why we process this data, and our legal basis

Purpose	Legal basis under UK GDPR
Provide the game service: create your account, save progress, run matches, deliver in-game features	Performance of a contract — Article 6(1)(b)
Account security: password hashing, brute-force protection, abuse detection	Legitimate interests — Article 6(1)(f). Our interest is keeping the service and your account secure.
Customer support: responding to your support requests	Legitimate interests — Article 6(1)(f). Our interest is providing service and resolving issues.
Technical error monitoring (Sentry)	Legitimate interests — Article 6(1)(f). Our interest is diagnosing failures and keeping the Service reliable.
Analytics and product improvement, including confirmed purchase and refund measurement across acquisition channels (Firebase Analytics / Google Analytics 4)	Consent — Article 6(1)(a). Only after you accept analytics cookies.
Campaign attribution: linking the first eligible campaign to your account, game activity and confirmed, fulfilled purchases to measure campaign revenue	Consent — Article 6(1)(a). Only after you enable Analytics; this optional purpose stops when you withdraw that choice.
Marketing measurement (Meta Pixel and X Pixel, when configured)	Consent — Article 6(1)(a). Only after you enable Marketing in Cookie settings.
Deliver transactional game notifications and non-promotional game or service announcements, including through Telegram when you connect it	Performance of a contract — Article 6(1)(b)
Send Tacteros news and special offers by email or Special offers through Telegram	Consent — Article 6(1)(a). Each channel requires a separate opt-in.
Legal compliance: accounting records, responses to legal requests	Legal obligation — Article 6(1)(c)

Analytics and Marketing cookie choices can be changed at any time through Cookie settings. Game announcements are non-promotional game and service information controlled by your Telegram notification preference. Special offers require separate Telegram direct-marketing consent. Email and Telegram direct-marketing consent is separate: you can turn either channel off in Profile at any time. Disconnecting Telegram or sending the bot /stop also withdraws Telegram marketing consent. Refusing or withdrawing marketing consent does not affect access to the game.

4. Who we share data with

We do not sell your data. We share data only with the following categories of recipients:

Service providers acting on our instructions (data processors):

• Google LLC — Firebase Authentication, Firebase Analytics, Google Analytics 4. Servers in the United States, safeguarded by Standard Contractual Clauses and the EU-US Data Privacy Framework.
• Cloudflare, Inc. — content delivery, DDoS protection, email routing, and storage of support-ticket attachments. Multiple regions, Standard Contractual Clauses apply.
• Postmark (ActiveCampaign, LLC) — delivery of transactional emails, including account, purchase, and support notifications. United States, safeguarded by Standard Contractual Clauses and the EU-US Data Privacy Framework.
• SendPulse — synchronisation of the email marketing list when you explicitly opt in or withdraw email marketing consent. Tacteros remains the authoritative record of your choice if provider synchronisation is delayed.
• Sentry — browser error monitoring used to diagnose failures. Performance tracing and session replay are not enabled, and the applications are configured not to send default personal identifiers.
• Telegram — delivery of the game notifications and non-promotional Game announcements you configure and, only after a separate opt-in, Special offers. Telegram processes the account and chat identifiers needed for delivery under its own terms and privacy policy.
• Server infrastructure providers — hosting, backup, and security infrastructure, located in the EU or UK.

Independent controller for payments:

Xsolla — processes your payment and acts as merchant of record for purchases made through the Service. Xsolla determines how it handles your payment data under its own privacy policy.

Meta and X may receive marketing-measurement data only where the corresponding pixel is configured and you have enabled Marketing in Cookie settings. These integrations are not active on every deployment.

Campaign-to-purchase linkage is held within Tacteros. With your Analytics consent, we also send Google Analytics confirmed, fulfilled purchase events and supported confirmed refund events. This applies whether or not your visit has campaign labels, including if you already have a Tacteros account. These events may include browser and analytics session identifiers, an opaque transaction identifier, item revenue, currency, public item information and separately stated tax where available. Other consented analytics events may include sanitized campaign labels, broad source categories and game-event information. We do not send your email, Tacteros account or club identifier, confirmation or authentication tokens, private URLs, payment credentials or provider order identifiers to Google Analytics. Enabling Analytics does not enable Marketing or send purchase conversions to Meta or X. Purchases without Analytics consent remain in our financial records and are not sent to Google Analytics.

Legal disclosures: We may disclose personal data when required by law, court order, or to protect our rights, our property, or the safety of users.

5. International transfers

Some of our service providers are located outside the UK and the European Economic Area, primarily in the United States. Where we transfer personal data outside the UK or EEA, we rely on:

• The UK Government's adequacy decisions, or
• Standard Contractual Clauses approved by the UK Information Commissioner's Office, together with appropriate supplementary measures where required.

You can request a copy of the safeguards in place by contacting Email.

6. How long we keep your data

• Active account data: for as long as your account remains active.
• First-touch campaign data in browser storage: eligible for registration for less than 24 hours, and cleared when read after expiry or when you reject Analytics or log out. A submitted registration snapshot is held until email confirmation or the existing 30-minute pending registration expires; resending a code does not extend that expiry. After confirmation, the account-linked campaign record is kept until you withdraw Analytics consent or your account is erased. Removing this optional record removes its link to purchases; financial records still follow their separate legal retention period.
• Optional purchase and refund analytics records held by Tacteros — browser and analytics session identifiers, queued events and delivery records — are deleted from active storage when your Analytics withdrawal is processed or your account is erased. We do not retain these identifiers after deletion solely to report later refunds. Financial records have a separate purpose and retention period.
• Account deletion: personal data is erased fourteen days after you request deletion, unless you cancel the request within that period.
• Support tickets: retained for 24 months from the ticket's closure, then deleted in full, including any attachments.
• Analytics data (Firebase / GA4): our event-data retention setting is 2 months and our user-data retention setting is 14 months. The user-data setting also applies to key-event data. Reset on new activity is enabled, so each new event from a user resets the 14-month retention period for that user’s identifier. These settings do not govern standard aggregated reports.
• Financial records (purchases): retained for 6 years to comply with the UK Companies Act 2006 and tax legislation, including after account deletion.
• Security and audit logs: up to 90 days, except where investigation of an ongoing security incident requires longer retention.
• Notification, channel-link, delivery, and preference records: while your account or linked channel remains active and afterwards only as needed for service integrity, security, or legal obligations. We have not set a shorter fixed retention period for these records.
• Marketing consent, withdrawal, audit, and suppression records: retained as reasonably necessary to demonstrate and respect your choice, including after withdrawal. We have not set a fixed deletion period for these records.

7. Your rights

Under UK GDPR you have the following rights in relation to your personal data:

• Access — a copy of the personal data we hold about you.
• Rectification — correction of inaccurate or incomplete data.
• Erasure — deletion of your personal data (“right to be forgotten”). You can request this at any time from your account's “Danger zone” settings. From the date of your request you have fourteen days to cancel; if you do not, your personal data is permanently erased and cannot be recovered. Your club is not deleted — it remains in the league under a new name, no longer connected to you, and continues to play (see our Rules of Play). Financial records are kept for six years regardless, as described in Section 6.
• Restriction — pausing processing of your data in certain circumstances.
• Portability — receiving your data in a structured, commonly-used, machine-readable format.
• Objection — to processing based on legitimate interests.
• Withdraw consent — for any processing that relies on consent, at any time, with effect for the future. Direct marketing can be withdrawn in Profile without deleting your account; Telegram marketing also stops when you disconnect Telegram or send the bot /stop.

To exercise any of these rights other than erasure, email Email from the email address associated with your account. We respond within one month, and may extend this by up to two further months for complex requests, in which case we will tell you the reason for the extension.

Withdrawing Analytics in Cookie settings immediately stops optional analytics on that browser and clears its campaign data. For a signed-in account, Tacteros also requests removal of the account-linked campaign record and optional purchase and refund analytics records, and stops further dispatch when that request is processed. If the connection or session is unavailable, that request is retried on your next authenticated connection; another open device updates when it next reconnects or reloads. Withdrawal does not delete financial records required by law or automatically erase events already received by an analytics provider. An analytics request already in flight may reach Google before withdrawal is processed. After we erase the identifiers used for measurement, a later refund may not be reflected against an earlier purchase in Google Analytics; some refunds also cannot be reported where the payment provider supplies insufficient detail. Analytics reports may therefore differ from our financial records. You can request erasure of provider-held personal data through the contact above, subject to applicable retention and legal obligations. Erasure does not guarantee a correction of previously aggregated revenue reports.

8. Cookies and similar technologies

We use necessary browser storage to provide the Service. Optional analytics and marketing storage is disabled until you choose to enable it through the cookie consent banner or Cookie settings.

Necessary — always active, no consent required:

• Authentication session, kept while you are logged in.
• Your cookie consent preference, so we do not show the banner repeatedly.

Analytics — optional:

• _ga, _ga_* — Google Analytics 4 and Firebase Analytics. Used to measure visits, game use and confirmed purchases and supported refunds, and to improve the game. Maximum lifetime 24 months.
• First-touch campaign storage and registration milestone markers — used only after Analytics consent to carry an eligible visit through registration and avoid duplicate conversion events. Registration markers expire after 24 hours; campaign retention is described in Section 6.

Marketing — optional and only active when configured:

• Meta Pixel and X Pixel storage, if the corresponding marketing-measurement integration is configured.

Reject all leaves Necessary storage active and keeps Analytics and Marketing disabled. You can reopen Cookie settings at any time to view or change your choices. Cookie choices do not subscribe or unsubscribe you from Tacteros news and special offers by email; that is a separate optional preference in your Profile.

9. Children

Tacteros is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact Email and we will delete it.

10. Automated decision-making

We do not make any decisions that produce legal or similarly significant effects about you using automated processing alone. Gameplay outcomes — match results, scout suggestions, training progressions and similar — are produced by game algorithms, but they are part of the game experience and have no legal or other significant non-gameplay consequences for you.

11. Security

We protect your data using measures including TLS encryption in transit, hashed password storage, access controls, value-minimised operational logging, and regular review of our security posture. Telegram linking uses a temporary, opaque token that expires and can be used only once; the token does not contain your account ID. No system is perfectly secure. If a personal data breach occurs that is likely to affect your rights and freedoms, we will notify you and the UK Information Commissioner's Office within the timescales required by law.

12. Complaints

If you are unhappy with how we process your personal data, you have the right to complain to the UK Information Commissioner's Office:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Postal: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom

We would appreciate the opportunity to address your concerns first — please contact us at Email before approaching the regulator.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent change. Material changes will be notified through the service, or by email where appropriate.