IncidentRoom Privacy Policy

Who is responsible

Beacon North Technologies Ltd., a Nova Scotia company, is responsible for the personal information described here. The person accountable for privacy at Beacon North is our Director. You can reach them at support@beaconnorth.ca with "Privacy" in the subject line.

What we collect, and from whom

Buyers. When your organization buys a pack, we collect the facilitator's first and last name, the organization's name and the organization email address you type on the purchase form. Your card details, billing address and optional GST/HST number are entered on a page run by Stripe, our payment processor. We never see or store card numbers. From Stripe we receive confirmation of the payment, the amounts, the tax charged, the currency used, the email address entered at checkout, and Stripe's reference numbers for the payment and the customer.

Facilitators and other signed-in users. Name, email address, a password (stored only as a one-way hash, never readable by anyone), and a record of each sign-in: the time, the IP address, and the country and city worked out from that IP address. We also keep a record of the actions you take in the platform.

Participants. People join an exercise with a code and a display name. No account or email address is required to take part. When a participant joins, we store the IP address of their connection and the country and city worked out from it. During the exercise the platform records which role made which decision and when, together with the display name of the participant in that role. The display name a participant types appears on that participant's certificate.

People who contact us. If you use the custom exercise request form or the IncidentPlan interview booking form, we collect your name, organization, work email and message. A copy of each booking request is emailed to our sales team through our email delivery service. If you email support@beaconnorth.ca or sales@beaconnorth.ca we keep the correspondence.

Documents you share with us. If you choose to share documents for a custom exercise, such as an incident response plan, we use them only to author your exercise and keep them on servers in Canada.

IncidentPlan. If your organization uses IncidentPlan, the plan you write, including any names and contact details you choose to enter, is kept inside your organization's account on our servers in Canada and is not sent to any artificial intelligence service.

Technical information. We use your IP address to limit abuse, for example repeated wrong join codes or repeated checkout attempts. When a participant joins an exercise, we work out the country and city of their connection from their IP address using a lookup file on our own servers, store them with the participant's place in the exercise, and show the country to the facilitator running the exercise; no outside service is involved. IP addresses also appear in our server logs. We do not use analytics or advertising trackers. We set only the cookies the service needs to work: the sign-in cookie, a cookie that remembers a device you have verified with a second factor, short-lived cookies used during sign-in and when accepting terms, and a signed cookie that identifies a participant who has joined with a code. None of them is used for tracking or advertising.

What we do not do

We do not sell, rent or trade personal information. We do not use tracking cookies or advertising. We do not build profiles of participants beyond their results in the exercises they joined. The platform does not send your information to any artificial intelligence service. Beacon North has an internal drafting tool that can call an outside AI service to help write exercise content; it is not connected in production, and if we ever use such a tool with information you have shared with us, we will update this policy before doing so. The platform produces team results: the score belongs to the team, not to any one person. The exercise records do show the display name of the participant who held each role, as described below.

Why we use it

We use personal information to deliver what you bought: create your organization, grant and track credits, run exercises, and produce the after-action report, evidence record and certificates. We use it to bill you and keep tax records, to send the emails the service needs (account ready, password links, purchase confirmations), to keep the platform secure, to answer your questions, and to meet legal obligations. We send no marketing email unless you ask for it.

Exercise records and documents

Each exercise produces session records, scores, an after-action report, an evidence record and participant certificates. The evidence record, the certificates and the insurance export show each participant's display name next to their role. These records are produced for your organization and belong to it. They are visible to every facilitator and the exercise lead in your organization, and to Beacon North staff for support and administration. If your organization is linked to a partner organization in IncidentRoom, that partner can see your exercise reports. Each participant can open a summary of their exercise through a private link for 30 days. We never publish these records and we do not share them with anyone else.

Where your information is kept

The platform and its database run on servers in Canada. Backups are also kept in Canada. Two service providers handle specific tasks outside the platform. Stripe processes payments and may process data outside Canada under its own privacy policy. Our email delivery service sends the platform's emails and processes the recipient address and message content in the United States. We use no other processors.

Who can see it

Your organization's facilitators and exercise lead can see your organization's exercises and documents, and a linked partner organization can see your exercise reports. Beacon North staff can see what they need for platform administration, billing and support. Changes to credits require a written reason and are logged. Most other administrative changes to accounts are logged; creating a user account and disabling one are not yet logged. Our service providers see only what their task requires: Stripe for payments, the email delivery service for sending email, and our hosting provider for running the servers. We disclose personal information to no one else unless the law requires it.

How long we keep it

Account and exercise records are kept for as long as your organization has an account. When an organization is removed, its exercises, reports and the accounts that belong only to it are deleted from the live platform. Some records are kept after that: sign-in records (email address, time, IP address and the country and city worked out from it), messages sent through the custom exercise request form or the interview booking form, and accounts that also belong to another organization, which are detached from the removed organization rather than deleted. Before each update to the platform we take a copy of the database and keep the ten most recent copies, so a deleted record can remain in one of those copies until ten further updates have been made. Purchase and tax records are kept for at least six years after the end of the year they relate to, as Canadian tax law requires. Contact form messages and support correspondence are kept until you ask us to delete them.

Your choices and rights

You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it. An organization can ask us to close its account and remove its records. Email support@beaconnorth.ca with "Privacy" in the subject line. We will confirm your identity, respond within 30 days, and tell you if anything cannot be deleted because the law requires us to keep it. Participants can also ask through their organization's facilitator, and we will help. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada.

Security

Connections to the platform are encrypted. Passwords are stored as one-way hashes. Access is limited by role, and administrative changes are logged as described above. A copy of the database is taken before every update to the platform. Access to production systems is limited to named Beacon North staff. No system is perfectly secure. If a breach of security creates a real risk of significant harm to you, we will notify the affected organizations and the Office of the Privacy Commissioner of Canada as PIPEDA requires.

Children

IncidentRoom is a service for organizations and is not directed at individuals under 18. We do not knowingly collect personal information from them.

Changes to this policy

The version and effective date appear at the top. If we make a change that matters to you, we will tell facilitators by email before it takes effect.

Contact

Beacon North Technologies Ltd., Nova Scotia, Canada. Privacy questions and requests: support@beaconnorth.ca, with "Privacy" in the subject line. Sales questions: sales@beaconnorth.ca.