Privacy policy

Effective date: 10/1/2026

Last updated: 10/1/2026

This policy explains what personal information Data Tactical Group (“DTG”, “we”, “us”) holds about people who use the Data Tactical Group Service (the “Service”), why we hold it, who helps us process it, how long we keep it, and what you can ask us to do with it.

The Service delivers aggregate labor-market statistics about counties. Those statistics are not personal information about you. This policy is about the information we hold on the people who use the Service.

1. What we collect

DTG collects only the information it needs to operate accounts, provide support, measure use of the Service, and keep the Service secure.

Account details. Your email address and password (the password stored only as a one-way hash), your display name, the name you gave your organization at sign-up, your marketing email choice, and, if you turn it on, your two-factor authentication secret (encrypted). We also keep a one-way hash of your email address while your account is open and for a limited period after it closes, to apply our trial eligibility rules.

Session records. Each sign-in, including the IP address and browser or device description associated with it.

Usage records. For each data request, whether from the API, an export, or the web application, we record the time, who made it (your account, your organization, and the API key if one was used), the endpoint, whether it succeeded, how many rows and data values it returned (the data-value count is what your plan’s monthly allowance measures), how long it took, the counties read, and the data vintage used.

Product use. We count what people do in the Service: which screens are opened, which tables and exports are made, which questions are put to the support assistant, and API use. Each count carries your organization and plan and, for data requests, the industry and area codes asked for. It does not carry the content of your questions or any data you enter. We use these counts to understand how the Service is used and to improve it. We run this ourselves; no third party receives it, and only our staff see the counts.

Trial history. Whether and when you started a free trial.

Notifications. Account-related messages we send you in the Service or by email.

Audit events. Security and administrative actions, such as sign-ins, role changes, invitations, API key creation, and billing changes, together with the IP address and, for some actions, the browser description. Audit events name the people involved, including by email address.

Ownership-claim details. If someone claims ownership of an organization, we record the claimant’s name and email address as part of that claim.

Invitations. If a member invites you, we hold your email address and the invitation’s status, even if you never sign up.

Support. Messages you send us, the email address you give us when you write while signed out, the page you wrote from, and support chat transcripts.

Device and activity records. A one-way hash of each browser description you sign in from, so we can tell you about sign-ins from new devices, and when you were last active.

Content you add. Names you give to custom regions, API keys, and your organization, and your saved workspace settings.

Server logs. Our servers log each request, including its address, IP address, and browser description, and the recipient and subject of each email we send.

Payment card information. DTG does not store payment card numbers. Payment card information is collected and stored directly by Stripe, our payment processor.

What we do not collect. DTG does not collect individual-level employment, wage, résumé, applicant, or workforce records from customers or users through the Service.

DTG does not use this information for advertising or third-party behavioral tracking.

2. Why we use it

We use this information to provide the Service and your account, to sign you in and keep your account secure, to measure use against your plan, to bill your organization, to send you service messages, to decide trial eligibility, to prevent abuse and enforce our Terms of Service, and to keep records we need for security and accountability. We send marketing email only if you have agreed to it, and you can withdraw that agreement at any time using the link in any marketing email or by writing to us.

3. Who helps us

We use a small number of service providers to help us operate the Service. We authorize them to process personal information as necessary to provide the services they perform for us:

Provider	What they do
Stripe	Payment processing. Stripe holds card details and receives your organization’s name and its owner’s email address. When you enter a card, Stripe’s own script collects device information to prevent fraud.
Resend	Sending email (address verification, password reset, invitations, and account, billing, and support messages).
Cloudflare	Carries all traffic to our servers and decrypts it at its network edge; hosts our public website; and provides Turnstile, a bot check used on sign-up, password reset, invitation, and support forms, which receives your IP address.
Google	Company email, including the support mailbox that receives your questions and privacy requests. The support assistant on our public website: your question and the documentation pages it reads are sent to Google’s Gemini API to produce the answer; no account data is sent. Google keeps those inputs for abuse detection only, for 55 days, and does not use them to improve its products (Google’s Gemini API terms, last modified 2026-04-28, and its usage policies, updated 2026-06-09, as read on 2026-10-06).
iDrive	Encrypted offsite backup. iDrive stores only encrypted data; the encryption key is ours and iDrive cannot read the contents.

We host the Service’s application and databases on our own servers in Louisiana. Our public website is hosted by Cloudflare.

We do not sell personal information. We do not use it for advertising. We do not use third-party analytics, with one exception: our public website uses Cloudflare Web Analytics, which counts page visits and referring sites without cookies and without tracking individuals across sites.

We may disclose information if the law requires it, to protect the rights and safety of our users or the Service, or as part of a merger or sale of the business, in which case this policy continues to apply.

4. Cookies

We use only cookies that are strictly necessary for the Service to work: a session cookie that keeps you signed in; short-lived cookies used during two-factor sign-in, and one that remembers a device you choose to trust; cookies Stripe sets to prevent fraud when you enter a card; and any cookies our bot check (Cloudflare Turnstile) may set to prevent automated abuse. The web application also stores your workspace, cached account details, and reference lists in your browser’s local and session storage, and our public website stores one display preference there. We use no advertising, tracking, or analytics cookies.

5. How long we keep it

Information	How long
Sessions	Deleted when your account is closed.
Notifications	Deleted when your account is closed; otherwise kept for 90 days.
Product-use events	90 days, then deleted; we keep only aggregate counts, which do not identify a person.
Records of individual data requests	Kept for 13 full calendar months after the month of the request, then deleted. After that we keep only monthly totals for each account and organization: counts, not individual requests.
Audit events	24 months, deleted in the month after they reach that age. Audit records are append-only: they are not edited.
A one-way hash of your email address	Kept only as long as needed to apply our trial eligibility rules, then cleared.
Organization ownership-claim record (the claimant’s name and email address at the time of the claim)	Part of the organization’s records; deleted 24 months after the claim completes or is cancelled. Erasing your account does not remove it during that period.
Organization records	Kept after the organization closes, with no fixed end date, so an owner can reopen it.
Invitations	Never accepted: deleted 90 days after the invitation expires or is withdrawn. Accepted: deleted 90 days after acceptance.
Support tickets and messages	Those from your account: deleted when your account is closed. Those sent while signed out: deleted 24 months after the ticket closes. Chat transcripts attached to a ticket: 90 days after it closes. Unattached chat logs: 30 days.
Email correspondence with us, including privacy requests	Kept in our company email for as long as needed to handle the request and keep a record of it.
Device records	Deleted when your account is closed; otherwise deleted 365 days after the device was last seen.
Saved workspace settings	Deleted when your account is closed, or 90 days after you leave the organization they belong to.
Trial history	Kept for as long as your account record exists, to apply our trial rules.
The record of your acceptance of our Terms and this policy	Kept for as long as your account record exists.
Email verification and password-reset tokens	Deleted one day after they expire.
API key records and their monthly use totals	Kept with the organization’s records.
Server logs	90 days.
Backups	Encrypted backups are kept for up to 12 months, so deleted information may remain in a backup until it expires.

6. When you close your account

When your account is closed, we remove your name and email address from it at once, replacing them with a placeholder that carries neither. We keep a one-way hash of your email for the limited purpose and period described in Section 5. Your email address may also remain in records that belong to organizations and in our security records, as Section 5 describes: audit events, invitations sent to your address, ownership claims, support messages you sent while signed out, our email correspondence with you, and our payment processor’s billing records. Notifications already delivered to other members of your organization that name you, such as a request you made to join, stay until they are deleted at 90 days. Your sessions, notifications, saved workspace settings, device records, and the support tickets you opened while signed in are deleted at once. Records of your data requests stay only for the rest of their 13-month period, and monthly usage totals stay with your organization’s records; both are linked to an opaque identifier rather than to your name or email. Audit events are append-only and cannot be edited. Events recorded after your account closes use the placeholder; events recorded before it may still show your name or email address until they are deleted at 24 months.

Closing your own account closes any organization in which you are the only member, and cancels its subscription. Organizations with other members carry on without you. Organization records belong to the organization and are kept as Section 5 describes.

Support assistant. Our support assistant on the public site answers questions from our published documentation. It is provided through Google’s Gemini models: your question and the documentation pages it reads are sent to Google to produce the answer. It is not given your account data. It is labelled as an AI assistant at all times and can make mistakes; it offers to open a support ticket for anything it cannot answer.

7. Your requests

Access and portability. You can ask us for a copy of the personal information we hold about you. The copy includes a record of the actions DTG staff have taken on your account, showing what was done and when.

Erasure. You can ask us to erase your personal information. We will first confirm that you control the email address on the account. Erasure closes your account as Section 6 describes, and also deletes invitations sent to your address, support messages you sent while signed out, and any remaining saved workspace settings and device records. Erasure does not remove your organization’s records (such as its subscription and billing history), the organization ownership-claim record described in Section 5, or audit events, which cannot be edited and are deleted on their own schedule. Usage records and monthly totals that remain are linked to an opaque identifier rather than to your name or email.

Correction and marketing. You can correct your display name and change your marketing choice yourself, or ask us to.

Send any of these requests to support@datatactical.group. A person, not an automated system, handles them, and we answer within 30 days.

8. Security

We protect personal information with measures appropriate to it, including encrypted connections and encrypted offsite backups whose key only we hold. No system is perfectly secure; if a breach affects your personal information, we will tell you as the law requires.

9. Children

The Service is for professional use and is not directed to children. We do not knowingly collect personal information from minors.

10. Where information is held

The Service and the personal information it holds are hosted in Louisiana, in the United States. Our encrypted offsite backup and the service providers listed in Section 3 may store or process information in other locations, within the United States or elsewhere, as their services require.

11. Changes to this policy

If we make a material change to this policy, we will tell account holders by email or in the Service at least 30 days before it takes effect. The effective date at the top shows when it last changed.

12. Contact

Privacy questions and requests: support@datatactical.group

Deacon James, LLC, dba Data Tactical Group
2611 Indian Mound Blvd, Monroe, LA 71201