Privacy Policy

Depending on how you use the site, we may collect:

• Account data — email, name, and sign-in details, handled by our identity provider.
• Product usage — scenario decisions, scores, chat/interview transcripts, resume content (for the Resume Review tool), and feedback you submit.
• Payment data — handled directly by our payment processor; we never see or store your card details.
• Site analytics — pages visited and session duration (see Analytics below).
• Contact data — if you take the free scorecard, sign up for updates, or we reach you as a business contact, we store your email, encrypted.

Scenarios, grading, critiques and mock interviews are AI-generated and AI-evaluated rather than scripted by a human reviewer. In practice:

• Text you type into scenarios, reports, chat-based games and the resume tool is sent to our AI provider to generate and grade a response.
• Live video interviews and simulations use a real-time video/audio AI provider — your camera and microphone stream to that provider for the length of the session only.
• We don't opt in to model training on your inputs where a provider offers the choice.

We don't sell your data. We use a small set of service providers, each handling only what their job needs:

• Identity and account sign-in
• Payment processing
• AI generation and grading, including the live video/audio interviews
• The in-app chat widget
• Product analytics
• Email delivery

Most are based in the United States, and where required we rely on their standard contractual safeguards for transfers out of the EEA/UK. If you want the specific companies behind any of these, ask us and we'll tell you.

Our analytics includes session replay — a reconstruction of on-screen activity, not a video or audio recording of you — used to see how the product is actually used and fix what's broken. We also run a small ad script and an AI-search answers widget.

None of it loads until you accept. On your first visit we show a consent banner with an explicit “Reject non-essential” option. Reject and none of it loads. It is also never enabled on our Youth Cyber Safety pages, for anyone, whatever was chosen on the banner.

You can change your answer here at any time:

We keep this to a minimum. We use:

• Sign-in cookies, required to keep you logged in.
• A short-lived attribution cookie, if you arrived from one of our emails.
• An anonymous counter that limits free plays on metered arcade games. It isn't derived from anything that identifies you.
• A record of your consent choice and of any notice you've dismissed, stored in your own browser so we don't ask again. Neither is sent to us.

The analytics and ad scripts set their own cookies, and only load if you accept.

Our Youth Cyber Safety section (ages 12–17) is educational content about staying safe online. Some of its interactive games send your typed messages to our AI provider to generate a response. Before either page will chat, we ask how old you are.

Under 13, we require a parent or guardian's permission — they receive an email explaining exactly what is involved and have to click to allow it. Until they do, the AI games stay blocked, and they can withdraw permission at any time from the same link. The only thing we store is their email address, encrypted, used solely to record and withdraw that permission — never for marketing. At 13 and over we show the disclosure instead.

Being straight about the limits: this proves someone received our email, not that they are a parent. Stronger checks exist, but they would mean collecting far more family data than these games justify. Age is self-declared. We never run analytics or session replay anywhere in this section, and we do not knowingly collect a name, email, or other directly-identifying information from a child. Parents or guardians with concerns can contact us directly and we will act promptly, including disabling access for a specific user if asked.

Activity data — how pages and features get used — is deleted after 180 days. Your account, and the results tied to what you've used, are kept while the account is active or as long as needed for the purpose you gave them for. Deleting your account removes them, along with your chat history.

Deleting your account also removes you from our mailing list, including any record created when you took the scorecard, signed up for updates, or were added as a business contact. You can also leave the list on its own at any time using the unsubscribe link in any email, without deleting your account.

You can access, correct, export, or delete your personal data at any time. Two of those are self-service on your Privacy & data page, with no need to ask us:

• Export — downloads everything tied to your account as a single file.
• Delete — permanently removes your account, the data tied to it, your chat history, and your mailing-list record. This can't be undone.

The same page also holds your usage-telemetry switch. For corrections, or anything the buttons don't cover, email us and we'll handle it directly, typically within a few business days. If you're in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

To unsubscribe from marketing email, use the unsubscribe link in any message we send, or email us directly.

Personal data is encrypted at rest, and we use industry-standard practices to protect it in transit and in use. No system is perfectly secure — if you believe you've found a vulnerability, please report it to security@playciso.com.

We'll update this page as the product changes and update the date at the top. Material changes that affect how we handle your data will be communicated by email where we have one on file.

PlayCISO is built and run independently. For anything on this page — access requests, deletion, questions, concerns — reach us at cyber.breach.space@gmail.com. A real person reads and replies to every message.