Privacy Policy

Depending on how you use the site, we may collect:

• Account data — email, name, and sign-in details, handled by our identity provider.
• Product usage — scenario decisions, scores, chat/interview transcripts, video-call transcripts (kept by our video-avatar provider unless you turn them off in your account) and video-call recordings (only if you turn them on; kept for up to 30 days), resume content (for the Resume Review tool), and feedback you submit.
• Payment data — handled directly by our payment processor; we never see or store your card details.
• Site analytics — pages visited, features used, session duration and session replay, depending on where you are and what you choose (see Analytics below).
• Contact data — if you take the free scorecard, sign up for updates, or we reach you as a business contact, we store your email, encrypted.

Scenarios, grading, critiques and mock interviews are AI-generated and AI-evaluated rather than scripted by a human reviewer. In practice:

• Text you type into scenarios, reports, chat-based games and the resume tool is sent to our AI provider to generate and grade a response.
• Live video interviews and simulations use a real-time video/audio AI provider — your camera and microphone stream to that provider for the length of the session only.
• We don't opt in to model training on your inputs where a provider offers the choice.

We don't sell your data. We use a small set of service providers, each handling only what their job needs:

• Identity and account sign-in
• Payment processing
• AI generation and grading, including the live video/audio interviews
• The in-app chat widget
• Product analytics
• Email delivery

Most are based in the United States, and where required we rely on their standard contractual safeguards for transfers out of the EEA/UK. If you want the specific companies behind any of these, ask us and we'll tell you.

We use three kinds of optional technology, and each one has its own on/off choice:

• Usage analytics — which pages and features get used, clicks, and where people get stuck, so we know what to fix. If you are signed in, this is linked to your account.
• Session replay (session recordings) — a reconstruction of on-screen activity (not a video or audio recording of you), used to see where the labs break. Everything you type and every form field is masked, as is anything we mark as sensitive.
• Ads — a small third-party ad script.

Where you are decides the default. To pick the right one we look up the country of your IP address on our own server, against a local database. We keep only the country code, in your browser for the current visit; the IP address itself is not stored or logged for this.

Everywhere, the same banner offers two equal choices, “Accept all” and “Reject all”, and stays at the bottom of the screen until you pick one. The site works the same either way. “Accept all” turns on usage analytics, session replay and ads. What runs before you choose depends on where you are:

• Most places, and whenever we can't tell where you are: nothing optional loads until you choose “Accept all”.
• The United States, Australia, New Zealand, Japan and Hong Kong: usage analytics and session replay (typed input masked) are on from the start, and the banner says so. “Reject all” turns them off straight away. If your browser sends a Global Privacy Control or Do Not Track signal, we treat that as opting out: both stay off unless you choose “Accept all”.
• Ads are always opt-in, everywhere. They never start unless you choose “Accept all” or turn them on below.
• Automated visitors (search-engine crawlers, scripts and automated browsers) are never recorded.

None of it is ever enabled on our Youth Cyber Safety pages, for anyone, whatever was chosen. We also keep a daily count of how the banner is answered (for example, how many people accepted or rejected, by country) with no IP address, account or device identifier attached.

You can change or withdraw any of these choices here at any time. Turning something off reloads the page so that it stops straight away:

We keep this to a minimum. We use:

• Sign-in cookies, required to keep you logged in.
• A short-lived attribution cookie, if you arrived from one of our emails.
• An anonymous counter that limits free plays on metered arcade games. It isn't derived from anything that identifies you.
• A record of your consent choices, stored in your own browser so we don't ask again, and the country code used to pick the right banner, kept only for the current visit. These stay in your browser; the only thing sent back is the anonymous daily count described under Analytics.

The analytics, session replay and ad scripts set their own cookies or browser storage, and only load when the choices above allow them.

Our Youth Cyber Safety section (ages 12–17) is educational content about staying safe online. Some of its interactive games send your typed messages to our AI provider to generate a response. Before either page will chat, we ask how old you are.

Under 13, we require a parent or guardian's permission — they receive an email explaining exactly what is involved and have to click to allow it. Until they do, the AI games stay blocked, and they can withdraw permission at any time from the same link. The only thing we store is their email address, encrypted, used solely to record and withdraw that permission — never for marketing. At 13 and over we show the disclosure instead.

Being straight about the limits: this proves someone received our email, not that they are a parent. Stronger checks exist, but they would mean collecting far more family data than these games justify. Age is self-declared. We never run analytics or session replay anywhere in this section, and we do not knowingly collect a name, email, or other directly-identifying information from a child. Parents or guardians with concerns can contact us directly and we will act promptly, including disabling access for a specific user if asked.

Activity data — how pages and features get used — is deleted after 180 days. Your account, and the results tied to what you've used, are kept while the account is active or as long as needed for the purpose you gave them for. Deleting your account removes them, along with your chat history.

Deleting your account also removes you from our mailing list, including any record created when you took the scorecard, signed up for updates, or were added as a business contact. You can also leave the list on its own at any time using the unsubscribe link in any email, without deleting your account.

You can access, correct, export, or delete your personal data at any time. Two of those are self-service on your Privacy & data page, with no need to ask us:

• Export — downloads everything tied to your account as a single file.
• Delete — permanently removes your account, the data tied to it, your chat history, and your mailing-list record. This can't be undone.

The same page also holds your usage-telemetry switch. For corrections, or anything the buttons don't cover, email us and we'll handle it directly, typically within a few business days. If you're in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

To unsubscribe from marketing email, use the unsubscribe link in any message we send, or email us directly.

Personal data is encrypted at rest, and we use industry-standard practices to protect it in transit and in use. No system is perfectly secure — if you believe you've found a vulnerability, please report it to security@playciso.com.

We'll update this page as the product changes and update the date at the top. Material changes that affect how we handle your data will be communicated by email where we have one on file.

PlayCISO is built and run independently. For anything on this page — access requests, deletion, questions, concerns — reach us at cyber.breach.space@gmail.com. A real person reads and replies to every message.