Terms of Use — Crisarium

Version 1.0 · effective from October 5, 2026

These Terms govern the use of Crisarium and the purchase of plans for organizations. By playing the free game, creating an account or buying a plan, you confirm that you have read and accept these Terms, the Privacy Policy and, when you buy a plan, the Data Processing Agreement and the Refund Policy.

1. Who we are

Crisarium is a brand of Segurança em Jogo LTDA, Brazilian company number (CNPJ) 58.907.118/0001-88, Rua Paes Leme, 215, Conj. 1713, Pinheiros, São Paulo - SP, CEP 05424-150, Brazil ("Segurança em Jogo", "we", "us"). Contact: info@crisarium.com. Privacy: privacidade@segurancaemjogo.com.br.

2. What Crisarium is

Crisarium is a training service for leaders: a cyber crisis simulation exercise, delivered on an online platform, in which participants make, round by round, the business decisions a fictional incident demands, and receive at the end a reading of the decisions they made.

The service comes in two forms:

• Free game: one individual game per email address, with on-screen results and a certificate of participation.
• Plans for organizations: group exercises for up to 5 or up to 10 participants, with an administrator dashboard, individual and group reports, estimated financial impact, remediation modules and, optionally, a comparison with the organization's crisis plan ("adherence").

What Crisarium is not. Crisarium is training. It is not legal, regulatory, financial or security advice; it is not an audit; it does not certify compliance with any standard; and it does not replace the organization's crisis plan, lawyers or specialists. The scenarios, companies, figures and messages are fictional. The regulatory deadlines and obligations used in the scenarios are simplified for training purposes and do not replace local advice.

Results and estimates. Scores, percentages, financial impact and adherence are estimates produced by the exercise's fixed rules, on assumptions stated in the report. They are meant for discussion and learning, not for business, accounting or legal decisions.

3. Who may use it

Crisarium is intended for professionals aged 18 or over. Whoever buys a plan represents that they have authority to act for and bind the purchasing organization. Plans are bought by organizations, for use in their professional activity; the relationship is business-to-business, not a consumer relationship, and the Brazilian Consumer Protection Code does not apply.

4. Free game

• One game per email address. Creating additional accounts to play again violates these Terms.
• The certificate attests participation in the simulation, not competence. Name and company are as you entered them.
• The free game is provided as is, with no guarantee of availability, and may be changed or discontinued.

5. Plans for organizations

5.1 Purchase. The organization buys on the "Buy" page, choosing a plan (single or annual) and a participant tier. Prices are those in the price list published on the order date and are not negotiable. The accepted order, together with these Terms, the Data Processing Agreement and the Refund Policy, forms the contract between the parties.

5.2 Payment and activation.

• Payment is in advance: bank slip (boleto) or Pix for customers in Brazil; card or bank transfer for customers abroad, as stated on the invoice.
• We issue a Brazilian service tax invoice (nota fiscal) for the gross amount. Taxes withheld at source by the customer, where the law requires, are shown on the nota fiscal.
• The plan is activated within 2 business days after payment is confirmed. The designated administrator receives the access invitation.

5.3 What each plan includes.

• Single: 1 exercise, in the purchased tier.
• Annual: 4 exercises, in the purchased tier.
• The plan is valid for 12 months from activation. Exercises not started within that period expire, with no refund, except as provided in the Refund Policy.
• An exercise is used when the session starts (the first round opens). Scheduling does not use it; canceling before the start returns the exercise to the plan.
• A closed session can be repeated once, without using an exercise, with the same scenario and the same jurisdiction.
• Additional exercises and tier changes follow the published price list.

5.4 Renewal. Plans do not renew automatically. We will notify the administrator 30 days before the end of the term; renewal is a new order.

6. The organization's responsibilities

The purchasing organization:

• designates the account administrators and keeps their details up to date;
• is the controller of participants' data, decides whom to invite and ensures a legal basis for the processing, under the Data Processing Agreement;
• announces the session internally before the invitations go out, so participants recognize the emails as legitimate;
• does not use the reports as the sole basis for decisions on hiring, promotion, compensation or dismissal of any person;
• uploads to the adherence feature only documents it has the right to use, and understands that the file is read by an artificial intelligence model and then discarded;
• does not enter sensitive personal data or unnecessary trade secrets in free-text fields;
• does not share outside the organization the session materials that show its name (injects, screens and reports), which carry a simulation watermark precisely so they are not mistaken for real facts.

7. Acceptable use

You may not:

• try to discover the scoring matrix, the impact values or any other content not displayed, by reverse engineering, automation, multiple accounts or any other means;
• share personal links or credentials, or play on someone else's behalf;
• test the platform's security without authorization. Vulnerabilities must be reported through the channel listed at crisarium.com/.well-known/security.txt;
• use the platform for unlawful purposes, to send malicious content or to impersonate another person or organization;
• copy, resell or commercially exploit scenarios, texts, report templates or the platform.

We may suspend access that violates these Terms, notifying the organization.

8. Intellectual property

The platform, scenarios, rubric, texts, images, remediation modules and the Crisarium brand belong to Segurança em Jogo. The contract grants the organization a non-exclusive, non-transferable right of use for the term of the plan.

The organization keeps all rights to its crisis plan, its data and its name and logo, and authorizes us to use them only to provide the service. The organization may use the generated reports freely, internally. We will not use the organization's name as a commercial reference without written authorization.

Suggestions for improvement may be built into the product with no obligation to pay.

9. Personal data and confidentiality

Personal data is processed under the Privacy Policy and, for plans for organizations, the Data Processing Agreement. Each party will keep the other party's confidential information confidential, including after the contract ends.

10. Availability and support

We use reasonable efforts to keep the platform available, with no guarantee of uninterrupted operation. Scheduled maintenance is done, whenever possible, outside business hours in Brasília time.

Support at info@crisarium.com, with a response within 24 hours on business days. If a failure on our side prevents a session, we reschedule it without using an exercise or apply the Refund Policy.

11. Limitation of liability

To the extent permitted by law:

• our total liability for any cause related to the contract is limited to the amount paid by the organization in the 12 months before the event;
• we are not liable for lost profits, lost business or indirect damages, nor for decisions the organization or third parties make based on the results of the exercise;
• these limitations do not apply to willful misconduct, gross negligence or obligations the law does not allow to be limited.

12. Suspension and termination

• The organization may terminate the contract at any time, with the effects set out in the Refund Policy.
• We may terminate the contract for a material breach of these Terms not cured within 10 days after notice.
• When the contract ends, data follows the retention periods in the Data Processing Agreement. The administrator can export the reports until deletion.

13. Changes

We may update these Terms. Material changes will be notified by email to administrators 30 days in advance. For plans in force, the version accepted at purchase remains in effect until the end of the plan term, unless the law requires a change.

14. General provisions

• Notices: by email, to the registered addresses.
• Assignment: the organization may not assign the contract without our written consent.
• Sanctions: we do not serve organizations or persons subject to applicable international sanctions.
• Language: if versions differ, the Portuguese version prevails.
• Governing law and venue: Brazilian law; the courts of the Judicial District of São Paulo - SP, waiving any other.

Version 1.0 · effective from October 5, 2026.