2.1 Scope

This Privacy Policy explains how Twenty Ten Visions LLC, doing business as TAVALYX, handles personal information in connection with the current informational website and the services TAVALYX may later activate.

The current public site does not offer live account enrollment, paid membership, payment processing, or Grade My Ticket uploads.

The launch-update list described below is separate from those services. Collection and email delivery become available only when separately enabled; this policy does not itself open the list or activate a product.

2.2 How the current informational site handles data

The current public site uses:

• Render hosts and serves the website. Ordinary web requests can include an IP address, browser and request information, timestamps, and related host or security logs.
• Google Workspace receives and sends company email, including support and privacy correspondence.
• Cloudflare manages the tavalyx.com domain and DNS. The current TAVALYX web records use DNS only, so website traffic does not currently pass through Cloudflare's proxy.
• This site stores your selected Light or Dark display choice in your browser. Selecting System removes that saved choice.

The current public site does not intentionally add advertising tracking or a third-party analytics collection service, and it does not transmit analytics events.

2.3 Information you choose to provide

If you email TAVALYX, we and our email provider may process your email address, message, attachments, and related correspondence so we can respond, investigate the request, provide support, and keep necessary records.

Do not send sportsbook usernames, sportsbook passwords, authentication tokens, unnecessary account or balance information, full payment-card numbers, or card security codes.

2.3a Launch-update signup and confirmation

When the launch list is available, signup asks only for your email address and agreement to receive launch updates about the NBA-first TAVALYX Founder Beta and Grade My Ticket. A submission remains pending until you explicitly confirm the address. Opening an email link alone does not confirm it.

The confirmation email displays its exact expiration time. The link lasts 48 hours from when we reserve the first attempt to send it through our email provider; waiting in our queue before that reservation does not use this period. A retry does not extend the expiration. We do not automatically resend expired confirmations or re-enroll an address.

Confirmation joins the launch list and triggers one welcome email. Later launch updates require separate approval. Signup does not create a product account, start a trial or membership, reserve a Founder or Beta position, grant Grade credits, collect payment information, or activate product access.

Launch-list records include your email address, consent and notice version, signup and confirmation times, confirmation and unsubscribe security records, delivery attempts and outcomes, and unsubscribe, bounce or complaint records. They let us verify consent, avoid duplicate sends and honor opt-outs.

The launch-list application does not retain your IP address, browser profile, device fingerprint or visitor identifier. It records only the fixed public-site signup source and non-identifying totals. Hosting and email providers may process request and delivery information needed to operate their services.

2.4 Planned account and service information

If account and membership services are activated, the applicable privacy notice may cover account and contact information, limited eligibility and verification records, accepted terms and consent, product preferences, service history, Grade history, limited subscription and billing details, support communications, security events, and information you voluntarily provide.

As part of limiting data collection, TAVALYX does not keep raw dates of birth or hashes derived from them as ordinary product records.

2.5 Payment information

Payments are not currently collected through the informational public site.

When payment services are activated, the configured payment provider will handle card processing. TAVALYX is not intended to store full payment-card numbers or card security codes.

TAVALYX may receive limited payment details that the payment provider is permitted to share, such as transaction identifiers, payment status, card brand, last four digits, billing country or postal information, tax information, receipts, and related processor records. TAVALYX may use these details to administer the service, confirm and correct billing, and keep necessary records.

2.6 Grade My Ticket image handling

Grade My Ticket uploads are not currently live.

Under the planned Grade My Ticket policy, raw screenshots or photos are temporary inputs used to extract the ticket details that the customer must confirm.

Raw images are deleted as soon as reasonably possible after successful processing when no longer needed for retry. Technical retry retention will not exceed 24 hours unless a separately authorized legal or support hold applies.

TAVALYX may keep confirmed ticket details; records showing where submitted or corrected information came from; Grade results; dates and times of evidence and verification checks; Grade-credit records; billing records; and audit information reasonably necessary to provide and support the service.

A line or price shown in a screenshot is customer-provided reference information. It does not prove that the line or price is currently available from a sportsbook.

2.7 How information is used

TAVALYX may use information to deliver and secure the website and services, honor display choices, and respond to correspondence and support requests.

When accounts and paid services are available, TAVALYX may also use information to create and secure accounts; manage trials, memberships, purchases, Grade credits, and service history; provide requested decision-support services; and send necessary notices.

TAVALYX may also use information to investigate errors, fraud, abuse, or security incidents; improve usability and reliability; comply with applicable obligations; and protect customers, TAVALYX, and others.

2.8 Service providers and disclosures

For the launch list, the release design uses Render for website and application hosting, Supabase PostgreSQL for restricted database processing, and Mailgun for email delivery and delivery-event handling. The selected Supabase region is US East, the proposed Render application region is Virginia, and the approved Mailgun region is US. These choices involve United States processing; they are not a promise that every provider record or support operation stays in a single location.

Mailgun may hold delivery, event and suppression records separately from TAVALYX's database. Removing a local database record does not remove a provider record. Provider retention, suppression and applicable deletion requests require separate handling.

Service providers may process information needed to perform hosting, email, authentication, database, payment, monitoring, analytics, security, support, or similar functions as those services are enabled.

TAVALYX may also disclose information when reasonably necessary to comply with law or enforceable legal process, protect rights or safety, investigate incidents or fraud, enforce agreements, or respond to claims.

If TAVALYX or its assets are involved in an acquisition, financing, reorganization, bankruptcy, or sale, relevant information may be transferred subject to applicable law.

Selling personal data is not part of the planned Founder Beta business model. Any future advertising or materially different data-sharing practice requires an updated notice and applicable controls before launch.

2.9 Retention

TAVALYX retains information only as reasonably necessary for the purpose for which it was collected, including service delivery, responding to requests, account history, security, billing, dispute resolution, and applicable recordkeeping obligations.

Retention periods may differ by data type. Information should be deleted or de-identified when no longer reasonably needed, subject to applicable requirements.

Grade raw images follow the shorter Grade-specific retention rule above.

For the launch list, pending unconfirmed personal records are removed or de-identified 30 days after abandonment or confirmation expiration, subject to narrowly necessary linked operational records. Expiration does not mean immediate deletion.

Confirmed subscriber records are retained while you remain opted in and the launch-list purpose continues. When that purpose permanently ends, unnecessary personal launch-list records are removed or de-identified within 90 days.

If you unsubscribe, bounce or complain, we keep the minimum record needed to prevent silent marketing reactivation while TAVALYX continues sending marketing email. A new signup does not silently remove that restriction. When marketing email for this purpose permanently ends, the remaining suppression record is removed within 90 days unless a legitimate legal, security, fraud, dispute or other approved hold requires retention.

Necessary personal or linked delivery events, processing receipts, queued-send records and delivery evidence are retained for 90 days. After that, unnecessary data is removed or de-identified; active opt-out requirements and narrowly necessary integrity or audit evidence are preserved.

Non-identifying aggregate metrics are kept for up to 24 months without adding customer-identifying dimensions. Sending-budget reservation records are kept for 30 days; cleanup never removes a reservation still needed to enforce the rolling sending limit.

Private recipient restrictions used for a controlled email test are personal data even when stored as derived codes. They are removed from private configuration after the test is reviewed and public collection is separately approved, or when the test is abandoned.

Restricted operators carry out retention and privacy-request handling. Legitimate legal, security, fraud or dispute holds, active suppression needs and narrowly necessary linked integrity records can limit removal. We review those exceptions and coordinate relevant provider records rather than promising that local cleanup erases every copy.

2.10 Security

TAVALYX uses administrative, technical, and organizational safeguards designed to protect personal information.

No system or email transmission can guarantee absolute security.

2.11 Privacy choices and rights

Depending on where you live and applicable law, you may have rights to access, correct, delete, or obtain a copy of certain personal information, or to opt out of certain processing.

Submit privacy questions and data-rights requests to privacy@tavalyx.com. We verify control proportionately and do not require unnecessary identity documents. Marketing suppression is handled promptly when requested. Restricted operators search, export or dispose of records as appropriate, coordinate relevant provider records, and explain any legitimate retention limits. We do not put raw addresses, confirmation capabilities or provider message bodies into general operational logs.

2.12 Communications

Launch-list email includes sender information and a no-login unsubscribe link. Opening that link shows the unsubscribe action; merely opening or previewing it does not change your choice. Completing the action suppresses later marketing and queued sends, although an email already handed to the provider cannot be recalled.

These emails have no advertising pixels, open tracking or click tracking. Unsubscribing does not activate or cancel a product membership. Keeping a minimal suppression record is necessary to honor your opt-out.

Necessary account, security, billing, trial, or service notices may still be sent where needed to operate an active service relationship.

2.13 Children and future account eligibility

The informational public site does not currently enroll customers into accounts or paid services.

Future account services will be limited to customers who meet the age and product-availability requirements adopted and displayed before activation.

TAVALYX does not knowingly seek personal information from children through the current informational site. If you believe a child has provided personal information, contact privacy@tavalyx.com.

2.14 Changes and contact

TAVALYX may update this Privacy Policy as services, vendors, legal obligations, or privacy practices change. Material changes will be communicated where required.

Privacy questions and requests may be sent to privacy@tavalyx.com.

Contact TAVALYX