Privacy Policy — Crisarium
Version 1.3 · effective from October 5, 2026
This policy explains how Segurança em Jogo LTDA processes personal data in Crisarium, the cyber crisis simulator for leaders. It covers the website, the free game, the certificate and, once available, the paid plans. Passages marked (paid plans) apply when those features launch.
1. Who we are and how to reach us
Crisarium is a brand of Segurança em Jogo LTDA, the Brazilian company responsible for processing your data.
| Item | Details |
|---|---|
| Legal name | Segurança em Jogo LTDA |
| Brazilian company number (CNPJ) | 58.907.118/0001-88 |
| Address | Rua Paes Leme, 215, Conj. 1713, Pinheiros, São Paulo - SP, Brazil, CEP 05424-150 |
| Product brand | Crisarium — crisarium.com |
| Data Protection Officer (Encarregado) | Paulo R. Barbosa |
| Privacy contact | privacidade@segurancaemjogo.com.br |
The privacy contact handles requests from data subjects, questions about this policy and communications from authorities. It is managed by the Data Protection Officer.
2. Who this policy applies to
We are the controller of the data of people who visit the website, play the free game, receive the certificate, buy a plan or administer an organization's account. In these cases we decide how and why the data is processed, and this policy describes it.
(paid plans) When an organization subscribes to Crisarium and invites its executives to an exercise, the organization is the controller and we act as its processor, handling the data on its behalf and under its instructions. This applies to:
- the participant list (name, email and role);
- participants' decisions, rationales and response times;
- individual and group reports;
- the crisis management plan uploaded to measure adherence;
- the financial calibration data provided by the organization.
In that case, processing is governed by the Data Processing Agreement signed with the organization, published at crisarium.com/dpa. Before the first round, each participant sees a screen explaining what is recorded, who will have access and for how long. Requests about this data should preferably go to the organization that sent the invitation. If they reach us, we will forward them and help with the response.
3. Data we process, why, and on what legal basis
We collect only what each activity needs. We do not process sensitive personal data and we do not ask for identity documents.
| Activity | Data | Purpose | Legal basis — LGPD (Brazil) | Legal basis — GDPR (EU) |
|---|---|---|---|---|
| Playing the free game | Chosen role, decisions, response times, language, technical game identifier | Run the simulation and calculate the result | Performance of a contract (Art. 7, V) | Art. 6(1)(b) |
| Sign-up on the results screen | Name, job title, company and email | Deliver the result, issue the certificate and create your account | Performance of a contract (Art. 7, V) | Art. 6(1)(b) |
| Business contact | Name, job title, company and email | Present the paid plans to professionals who completed the simulation | Legitimate interest (Art. 7, IX, and Art. 10) | Only with consent — Art. 6(1)(a) |
| Email updates | Send Crisarium content and news | Consent (Art. 7, I), optional and revocable | Art. 6(1)(a) | |
| Player account | Email, game history and certificates | Provide access through a link sent to your email, with no password | Performance of a contract (Art. 7, V) | Art. 6(1)(b) |
| (paid plans) Administrator account | Name, email, organization, credentials and second factor | Manage the account, licenses and sessions | Performance of a contract (Art. 7, V) | Art. 6(1)(b) |
| (paid plans) Payment and billing | Legal name, company or tax number, billing address, finance contact | Charge, issue invoices and meet tax obligations | Performance of a contract and legal obligation (Art. 7, II and V) | Art. 6(1)(b) and (c) |
| Security and abuse prevention | IP address converted into an irreversible code, access logs, irreversible code of the email | Limit attempts, block bots, enforce one free game per email and protect the platform | Legitimate interest (Art. 7, IX) and legal obligation (Brazilian Internet Act, Art. 15) | Art. 6(1)(f) and (c) |
| Support and data subject requests | Request and correspondence data | Respond to you and comply with the law | Legal obligation and regular exercise of rights (Art. 7, II and VI) | Art. 6(1)(c) and (f) |
| Product improvement | Aggregated usage data, such as completion rate per round | Understand where the simulation can improve | Legitimate interest (Art. 7, IX) | Art. 6(1)(f) |
Sign-up and business contact. Sign-up is needed to deliver the result and the certificate. It is not consent to receive marketing. You can object to business contact at any time, through the unsubscribe link or the privacy contact. For people in the European Union, we only send business contact by email with prior consent.
Crisis management plan (paid plans). The document uploaded by the organization is used only to extract the rules that measure adherence. Once the administrator validates those rules, the original file is deleted and only the validated structure remains: who acts, what they must do, when and in what order.
4. Certificate and public verification page
The certificate of participation carries a verification code. Anyone with that code can open a public page showing only name, company, scenario, role played and date. Job title, email and result never appear on that page, and the certificate contains no score.
- Name and company are the ones you entered at sign-up, and the certificate says so.
- The verification page is not indexed by search engines.
- You can ask us to unpublish it at any time through the privacy contact. The page is removed and the code then returns "not found".
Sharing on LinkedIn. If you use the share button, LinkedIn receives the link to the verification page and builds the preview from it. What happens to your post after that is governed by LinkedIn's privacy policy, as an independent controller.
5. Artificial intelligence, scoring and automated decisions
AI narrates; it does not assess. The characters playing the roles not taken by people are artificial intelligence, and the screen says so. The AI writes their lines and chooses among the options available to those roles. It does not score anyone.
Scoring is deterministic. Each decision moves four meters (financial, regulatory and legal, reputational and operational) according to a fixed matrix, defined before the game and identical for everyone. The same path always produces the same result.
What the result shows.
- Free game: up to three strengths and whether response deadlines were met. No grade or ranking is shown.
- (paid plans) Individual report: how much of the best possible outcome for their own role the person achieved, given the decisions available at each moment. A decision is judged on what was known at the time, never on what came to light later.
- (paid plans) Group report: the organization's result across four separate dimensions, disagreements between functions, response times and absences.
Your rights over this result. The individual report is a professional profile calculated automatically. You may ask for clear information about the criteria used and for a review of the result (LGPD, Art. 20; GDPR, Arts. 15 and 22). We will explain the logic and the factors that weighed in your decisions. The exact values of the matrix are a trade secret and are not disclosed, as the LGPD itself allows (Art. 20, §1).
Use of the report by the organization (paid plans). Crisarium is a training tool and a test of the crisis plan. The Terms of Use forbid the organization from using the report as the sole basis for decisions on hiring, promotion, pay or dismissal.
Rule extraction from the crisis plan (paid plans). A language model reads the uploaded document and proposes rules. No rule is used until the organization's administrator has reviewed and validated it.
Model training. None of your data or your organization's data is used to train artificial intelligence models, ours or anyone else's.
6. Who we share data with
We do not sell personal data. We share it only with the suppliers that make the service possible, under contract and with data protection obligations, and only what each function needs.
| Supplier | Company country | Function | Where data is stored |
|---|---|---|---|
| Supabase Inc. | USA | Database and authentication | São Paulo, Brazil |
| Vercel Inc. | USA | Application hosting and delivery | Processing in São Paulo; global delivery network |
| Anthropic PBC | USA | AI characters and (paid plans) rule extraction from the crisis plan | USA — not used for training |
| Hostinger International Ltd. | Cyprus (European Union) | Corporate email, privacy contact and delivery of access links, invitations and notices | Brazil |
| Contabilizei | Brazil | (paid plans) Accounting, tax invoicing and collection by boleto and Pix (Cobre PJ) | Brazil |
| Stripe Brasil Soluções de Pagamento – Instituição de Pagamento Ltda. | Brazil | (paid plans) Card payments from customers abroad | Brazil and USA |
(paid plans) We will not have access to your card details.
This policy keeps the supplier list up to date. We will notify paid-plan customers before adding a new supplier that processes their data.
We may also share data when required by law, court order or a request from a competent authority, or to defend rights in judicial, administrative or arbitration proceedings. If the company is sold or reorganized, data may be transferred to the successor, which will remain bound by this policy.
7. International transfers
Crisarium's database is in Brazil, in São Paulo. Some suppliers listed above are foreign companies and may process data outside Brazil, mainly in the United States.
- From Brazil to other countries: for European Union countries, we rely on the adequacy decision issued by Brazil's data protection authority, ANPD (Resolution CD/ANPD No. 32/2026); for other countries, such as the United States, we use the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024) or another mechanism under Art. 33 of the LGPD.
- From the European Union to Brazil: Brazil holds an adequacy decision from the European Commission, and the ANPD has recognized the European Union in return (Resolution CD/ANPD No. 32/2026). Data of people in the EU stored in Brazil is covered by that decision.
- (paid plans) Organizations that require storage in the European Union can request this option on the annual plan, once available.
You can ask the privacy contact which mechanism applies to each transfer.
8. How long we keep data
We keep each item only as long as its purpose requires or the law demands. After that, it is deleted or anonymized.
| Data | Retention |
|---|---|
| Sign-up, free games, player account and certificate | 24 months after last activity, or earlier at your request |
| Business contact | Until you object, within the 24-month inactivity limit |
| Email updates | Until you withdraw consent |
| Application access logs | 6 months (Brazilian Internet Act, Art. 15) |
| IP converted into an irreversible code, to limit attempts | 24 hours |
| Irreversible code of the email, for the one-free-game-per-email rule | 24 months after the game |
| (paid plans) Crisis management plan, original file | Deleted after the administrator validates the rules |
| (paid plans) Session data: participants, decisions, reports, validated rules | As set by the organization; default of 12 months after the contract ends |
| (paid plans) Billing data and invoices | 5 years, under tax law |
| Backups | Up to 90 days, encrypted; deletions made in the database take effect in backups when they expire |
When you ask for deletion, we keep only the irreversible code of your email, to prevent reuse of the free game, and whatever the law requires us to keep.
9. How we protect data
We apply technical and organizational measures proportionate to the risk of each type of data. The main ones are:
- Passwordless access for players and participants: single-use, short-lived link sent to your email.
- Mandatory second factor for administrators and for our internal access.
- Separation between organizations inside the database itself, with an automated test that tries to read another organization's data on every change.
- Our internal access does not reach customer content: crisis plans and individual answers are accessed only at the organization's formal request, and the access is logged.
- Data minimization: the original crisis plan is deleted after validation; IP addresses are kept only as irreversible codes.
- Uploaded files: we accept text formats only, checked by their content. Files are never executed or opened by people: each one is converted to text and discarded right away, never stored or made available for download.
- Audit logs of administrative access, exports and deletions.
- Our own incident response plan, tested in practice. If an incident may cause relevant risk or harm, we will notify you and the competent authorities within the legal deadlines.
Security researchers can report vulnerabilities through the channel listed at crisarium.com/.well-known/security.txt.
10. Your rights
At any time and free of charge, you can:
- confirm whether we process your data and access it;
- correct incomplete, inaccurate or outdated data;
- request anonymization, blocking or deletion of data that is unnecessary or processed unlawfully;
- receive your data in a structured format (portability);
- delete your account and your data, subject to the legal periods in section 8;
- find out who we share your data with;
- withdraw your consent to email updates;
- object to processing based on legitimate interest, including business contact;
- request a review and explanation of a result calculated automatically (section 5);
- lodge a complaint with Brazil's National Data Protection Authority (ANPD) or, if you are in the European Union, with the data protection authority of your country.
How to make a request. Email privacidade@segurancaemjogo.com.br from the address you registered with. If the request comes from a different address, we may ask for a simple identity confirmation. Account deletion will also be available in the player area.
Response time. We respond within 15 days. For people in the European Union, the maximum is one month, as set by the GDPR.
(paid plans) If you took part in an exercise at an organization's invitation, that organization is the controller of that data (section 2). We will forward your request to it.
11. Cookies, communications and minimum age
Cookies. We use only essential cookies and local storage: to keep your session, remember your language and protect against abuse. We do not use advertising cookies or third-party analytics. If that changes, we will ask for your consent first.
Communications. We send emails the service needs, such as access links, invitations and round notices. These emails never ask for a password or payment details. On paid plans, a genuine invitation can be checked on Crisarium's invitation verification page, without clicking the link you received. Marketing emails always include an unsubscribe option.
Minimum age. Crisarium is intended for professionals and must not be used by anyone under 18. If we identify data belonging to a minor, it will be deleted.
12. Changes to this policy
We may update this policy when the service or the law changes. The current version and the date of the last update are always shown on this page. We will announce relevant changes by email or on the platform before they take effect. The current version is published at crisarium.com/privacy.
This is a translation of the Portuguese version, published at crisarium.com/privacidade. If the two differ, the Portuguese version prevails.
Version 1.3 · effective from October 5, 2026.