Privacy Policy and Notice at Collection

Who We Are and How to Contact Us

Building Heroes operates this tabletop exercise service. Contact us through Contact Us or email admin@buildingheros.com. You can submit privacy requests without creating an account. For an organization's exercise content, the organization directs its use and controls authorized access; we also maintain account, billing and support records to operate our business.

Notice at Collection: Information, Purposes and Retention

We collect the following categories from you, your organization, your use of the service and our service providers. We do not sell personal information or share it for cross-context behavioral advertising. We do not use sensitive personal information to infer personal characteristics or train external AI models on your customer content.

Do not enter passwords, payment-card details, medical information, children's information or other sensitive personal details in exercise or support text. Use fictional life details. The service is intended for business users, not children under 16. We do not collect card numbers in this application.

How We Use Information and Send Email

We use information to provide exercises, authenticate users, manage licenses and payments, investigate bugs, answer questions, assess feature requests, protect the service and honor privacy requests. Account, security, password-reset, personal invitation and license-expiration/renewal messages are service communications. Replies to your questions, bug reports or feature requests relate to the request you initiated.

Optional feature announcements and solicitations for improvement feedback are separate. We send these only when you opt in. The optional signup box is unchecked by default, and acknowledging this notice does not subscribe you. Change this choice in the customer portal or use the unsubscribe link in an optional email, without signing in. We honor optional-email opt-outs promptly, no later than 10 business days. We do not condition privacy rights or account access on optional outreach consent. Optional commercial emails identify Building Heroes and include a valid business mailing address and unsubscribe method. Phone numbers are currently stored as contact details; automatic SMS is not enabled.

Limited Disclosure to Service Providers

Render processes hosting and database data. Stripe processes checkout/payment information you provide, together with necessary customer, order, quantity and amount references; its own policies apply to its records. Microsoft 365, or another configured email transport, processes recipient addresses and the contents of requested emails. Participant invitations include the participant name, role, organization, exercise name and a unique access link. Support emails contain your conversation response and a private reply link. We may disclose information as legally required or reasonably necessary to prevent fraud, investigate incidents or protect rights. We do not disclose your data to unrelated advertisers or other businesses for their marketing.

Optional AI Assistance

Library exercises do not send content to a cloud AI provider. A Facilitator can enable purchased OpenAI assistance for a specific incident after agreeing to share selected business and exercise context. This includes business descriptions, role aliases, service functions/objectives, proposed actions and recent shared activity. Names, emails, phone numbers, URLs and recognizable credential patterns are redacted on a best-effort basis. Private participant messages, personal profile details, credentials and access tokens are excluded. Requests ask for provider response storage to be disabled; this does not guarantee zero provider retention. Provider API policies apply. Do not enter secrets or sensitive identifying information. A local model may also be configured. Facilitators review suggestions before applying them. See AI incident terms.

Security, Cookies and Choices

Essential cookies and browser storage support sign-in, participant seats and training progress. We do not use advertising trackers. Access controls separate organizations. MFA and Microsoft SSO support account security. Anyone holding a participant, display or private support-conversation link may access the information authorized by that link; share links only with intended recipients. No system eliminates every risk.

Access, Correction and Deletion of Personal Information

You may request access to or a copy of your personal information, correction of inaccurate information and deletion of personal information we hold about you. Where applicable under California law, these include rights to know categories and specific information, sources, purposes and recipient categories; delete; correct; opt out of sale/sharing; limit certain sensitive-information uses; and receive equal service without retaliation for exercising privacy rights. We do not sell/share for targeted advertising or make the restricted sensitive-information uses, so there is no such activity to opt out of; Global Privacy Control signals do not trigger advertising disclosures here.

Use Request deletion, Request access, Request correction, the form below or our contact email. No account or payment is required. Authorized agents may submit requests; we may need evidence of authority and verification from you. We verify identity and scope using information reasonably related to the request, without asking for unnecessary sensitive information. A participant's request may require coordination with their organization; that coordination is not an automatic denial of individual rights.

We acknowledge access, correction and deletion requests within 10 business days and aim to provide a substantive response within 45 calendar days of receipt, including time spent verifying identity. Where legally permitted and necessary, we may extend by up to 45 additional days, explaining the reason within the initial response period. If we cannot verify or fulfill all or part of a request, we explain the reason and any applicable exception. We retain a limited request/response log for at least 24 months for privacy compliance, not marketing.

What Removal Does and What May Remain

Verified account removal deletes live account access, participant profiles and contacts, services, scenarios, exercise history and reports. Personal contact and conversation content in linked support cases is removed or de-identified. Individual removals and corrections are evaluated for the requested information, including retained exercise evidence; deleting a roster profile alone may not erase historical reports. Limited accounting, fraud-prevention, legal or privacy-fulfillment records may remain where permitted or required. Provider records are subject to their policies. Infrastructure backups may persist until overwritten under the provider's backup lifecycle; they are not used to resume ordinary processing of deleted data. Export anything you need before account removal. License expiry alone does not delete data.

Policy Changes

We update the effective date and version when this notice changes. Material changes to collection or use will be communicated where required before new uses begin. We will not treat privacy acknowledgment as consent to unrelated marketing. Previous privacy notice.

Request Data Removal

Identify the organization and information concerned. Do not include passwords or sensitive identifiers. We will verify the request before deleting information.