ChaosTrack Privacy Policy

1. Introduction

ChaosTrack, Inc. ("ChaosTrack," "we," "us") provides an AI-powered cybersecurity preparedness and tabletop exercise platform. This Privacy Policy explains how we handle personal information when you visit chaostrack.com (the "Site"), when you correspond with us, and when you or your organization use the ChaosTrack platform (the "Platform").

"Personal Information" means information that identifies, relates to, or could reasonably be linked with an identified or identifiable individual. It includes what other laws call "personal data," "personally identifiable information," and "sensitive personal information."

Use of the Platform is also governed by our Master Services Agreement and End User License Agreement. Capitalized terms not defined here have the meaning given in those documents.

2. Our Role: Controller and Processor

Our obligations depend on whose information we are handling and why. This distinction matters, so we state it plainly.

2.1 Where we act as a controller (or "business")

We decide the purposes and means of processing for:

• Information collected from visitors to the Site
• Business contact information collected from prospects, customers, partners, and investors
• Account registration and billing information for our customers' personnel
• Correspondence you send us

For this information, ChaosTrack is the controller, and this Privacy Policy describes our practices.

2.2 Where we act as a processor (or "service provider")

When a customer organization uses the Platform, it submits content — incident response plans, policies, organizational information, exercise records, and information about exercise participants. For Personal Information contained in that content, the customer organization is the controller and ChaosTrack is the processor. We process it only on that customer's documented instructions, as set out in Section 8 of our Master Services Agreement.

If you are an employee, contractor, or exercise participant of an organization that uses ChaosTrack and you wish to exercise privacy rights over information your employer submitted, please contact your employer directly. We will refer such requests to the relevant customer and support them in responding.

3. Data Protection Officer

ChaosTrack has appointed a Data Protection Officer, who may be contacted about any matter relating to this Privacy Policy or our handling of Personal Information:

4. Personal Information We Collect

4.1 Information you provide

• Contact and profile data: name, business email address, telephone number, employer, job title, and country.
• Account data: username, credentials, role and permission settings, and account preferences.
• Billing data: billing contact, billing address, purchase order references, and payment records. We do not store full payment card numbers.
• Correspondence: the content of messages, form submissions, support requests, and survey responses you send us.

4.2 Information collected automatically

• Device and connection data: IP address, browser type and version, operating system, device identifiers, and approximate location derived from IP address.
• Usage data: pages viewed, referring URL, links clicked, session duration, feature usage, and diagnostic logs.
• Cookies and similar technologies: as described in Section 6.

4.3 Information from third parties

We may receive business contact information from analytics providers, marketing data vendors, event partners, and referral sources, and we may supplement information we already hold.

4.4 Information we do not seek

We do not intentionally collect government identification numbers, financial account numbers, biometric information, health information, precise geolocation, or information revealing racial or ethnic origin, religious beliefs, political opinions, trade union membership, sexual orientation, or criminal history. Our agreements prohibit customers from submitting these categories to the Platform without our prior written agreement.

5. How and Why We Use Personal Information

We do not use Personal Information for automated decision-making that produces legal or similarly significant effects.

6. Cookies and Tracking Technologies

We use cookies, pixels, and similar technologies on the Site. These fall into three groups:

• Strictly necessary — required to operate the Site and to sign in securely. These cannot be disabled.
• Functional — remember your preferences and settings.
• Analytics and advertising — help us understand how the Site is used and measure the effectiveness of our marketing.

You can manage cookies through the cookie banner on the Site and through your browser settings. Disabling cookies may affect Site functionality.

Opt-out preference signals. Our Site recognizes and honors the Global Privacy Control (GPC) signal. If your browser or extension sends a GPC signal, we treat it as a valid request to opt out of any sharing of Personal Information for cross-context behavioral advertising for that browser.

7. Artificial Intelligence Processing

The Platform uses generative artificial intelligence to produce exercise scenarios, reports, and related content.

7.1 Where AI processing happens. We use Amazon Bedrock, operated by Amazon Web Services, Inc., as our AI infrastructure. Content submitted to the Platform may be transmitted to Amazon Bedrock to generate output.

7.2 What this means for your data. Under our arrangements with our AI infrastructure provider:

• Prompts and model outputs are not stored beyond what is necessary to return a response
• Prompts and model outputs are not disclosed to the providers of the underlying foundation models
• Prompts and model outputs are not used to train or improve any foundation model

7.3 Our own commitment. ChaosTrack does not use customer content, exercise records, or generated deliverables to train, retrain, or fine-tune any machine learning model, except in aggregated and de-identified form that cannot reasonably be associated with any customer or individual.

7.4 Platform retention is separate. The commitments in Section 7.2 concern the AI service. ChaosTrack separately stores exercise records, transcripts, and reports within the Platform in order to provide the service. That retention is governed by Section 11 and by our Master Services Agreement.

8. How We Share Personal Information

We do not sell Personal Information.

8.1 Service providers and subprocessors. We share Personal Information with vendors who process it on our behalf under written contracts that restrict their use of it. Our principal subprocessors are:

A current and complete list of subprocessors is available on request from dpo@chaostrack.com. Customers may request advance notice of changes to this list as described in Section 8.5 of our Master Services Agreement.

8.2 Professional advisers. We share information with our lawyers, accountants, auditors, and insurers where necessary.

8.3 Legal and safety. We may disclose Personal Information where required by law, regulation, court order, or legal process; to establish, exercise, or defend legal claims; to investigate suspected fraud, abuse, or security incidents; or to protect the rights, property, or safety of any person.

8.4 Corporate transactions. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, Personal Information may be transferred as part of that transaction, subject to this Privacy Policy.

8.5 Advertising and analytics. Our use of analytics and advertising cookies may constitute "sharing" of Personal Information for cross-context behavioral advertising under certain U.S. state privacy laws. We do not receive money for this. You can opt out as described in Sections 6 and 10.

9. International Transfers

ChaosTrack is based in the United States, and the Site and Platform are hosted and operated in the United States. If you are located outside the United States, your Personal Information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

Where we transfer Personal Information from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures where required. You may request a copy of the relevant safeguards from dpo@chaostrack.com.

10. Your Privacy Rights

10.1 Rights available to everyone. Regardless of where you live, you may ask us to:

• Access the Personal Information we hold about you and receive a copy
• Correct information that is inaccurate or incomplete
• Delete your Personal Information
• Port your information to another provider in a machine-readable format
• Opt out of marketing communications at any time

10.2 United States state privacy rights. If you are a resident of California, Colorado, Connecticut, Virginia, or another state with comprehensive privacy legislation, you have the right to know what Personal Information we collect and how we use and disclose it, to access and delete it, to correct it, to opt out of sale and of sharing for cross-context behavioral advertising, to opt out of profiling in furtherance of decisions producing legal or similarly significant effects, and to be free from discrimination for exercising these rights.

We do not sell Personal Information, and we do not knowingly process the Personal Information of anyone under 16 for sale or sharing.

10.3 Do Not Sell or Share My Personal Information. To opt out of sharing for cross-context behavioral advertising, use the "Do Not Sell or Share My Personal Information" link on the Site, adjust your preferences in the cookie banner, or send a GPC signal from your browser. You may also email dpo@chaostrack.com.

10.4 Authorized agents. You may use an authorized agent to submit a request. We may ask the agent for proof of authorization and may ask you to verify your identity directly.

10.5 EEA, UK, and Swiss rights. If you are located in the European Economic Area, the United Kingdom, or Switzerland, you additionally have the right to restrict processing, to object to processing carried out on the basis of our legitimate interests or for direct marketing, and to withdraw consent at any time without affecting the lawfulness of prior processing. You have the right to lodge a complaint with your supervisory authority; a list of EEA authorities is available from the European Data Protection Board, and UK residents may complain to the Information Commissioner's Office.

10.6 Legal bases (EEA, UK, and Switzerland). We process Personal Information on the following bases:

• Contractual necessity — to provide the Platform and perform our agreements
• Legitimate interests — to secure, improve, and market our products, to correspond with you, and to protect our legal rights, where those interests are not overridden by your rights
• Consent — for certain cookies and marketing communications, which you may withdraw at any time
• Legal obligation — to comply with applicable law

10.7 How to exercise your rights. Email dpo@chaostrack.com or use the request form on the Site. We will acknowledge your request within 10 business days and respond within 45 days, extending by a further 45 days where reasonably necessary and telling you why. We do not charge a fee unless your request is manifestly unfounded or excessive. We may need to verify your identity before acting.

If your request concerns information a customer organization submitted to the Platform, see Section 2.2.

11. Retention

We retain Personal Information for as long as necessary for the purposes described in this Privacy Policy, and thereafter as required to comply with legal obligations, resolve disputes, and enforce our agreements. In determining retention periods we consider the volume, nature, and sensitivity of the information, the potential for harm from unauthorized use or disclosure, and whether we can achieve our purposes by other means.

• Account information is retained for the duration of the account and for a reasonable period afterwards.
• Customer content on the Platform is retained as described in the Master Services Agreement, which provides a 30-day export window following termination, after which it is deleted.
• Business contact and marketing information is retained until you opt out or the information becomes stale.
• Records of privacy requests are retained for 24 months to demonstrate compliance.

We may retain aggregated or de-identified information indefinitely, provided it cannot reasonably be associated with an individual.

12. Security

We maintain administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, disclosure, alteration, and destruction. These include encryption in transit and at rest, access controls and authentication, logging and monitoring, vendor due diligence, and personnel confidentiality obligations.

No method of transmitting or storing information is completely secure. Please help protect your account by choosing a strong password, enabling available authentication controls, and notifying us at security@chaostrack.com if you believe your account has been compromised.

13. Children

The Site and Platform are intended for business use and are not directed to children. We do not knowingly collect Personal Information from anyone under 13 years of age. If you believe a child has provided us with Personal Information, contact dpo@chaostrack.com and we will delete it promptly.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the revised version on the Site with a new Effective Date, and where changes are material, we will provide additional notice, such as by email or an in-product notification. Prior versions are available on request. Your continued use of the Site or Platform after the Effective Date indicates acceptance of the updated Privacy Policy.

15. Contact Us

Master Services Agreement · End User License Agreement