Crisis Cloud AI Privacy Notice

Version: 2026-09-14
Effective date: 14 September 2026

This notice explains how Crisis Solutions Ltd uses personal information in connection with Crisis Cloud AI, including trial applications, trials, paid subscriptions, websites, payment and billing administration, support and platform security.

1. Who we are

Crisis Solutions Ltd provides the Crisis Cloud AI service.

For personal information that we use for our own purposes, the controller is:

Crisis Solutions Ltd
Company number: 03981161
Registered office: Ashwell House, High Street, Longborough GL56 0QE, United Kingdom
Privacy email: info@crisis-solutions.com
ICO registration number: Z7986621

This notice applies to trial applicants, customer administrators, billing contacts, facilitators, participants, prospective customers and other people whose information is used in connection with Crisis Cloud AI.

2. Information we collect

Trial, registration and customer information

We may collect:

organisation name;
applicant’s or customer contact’s name and business email address;
country or region;
intended use of the service;
requested organisation name and hostname;
selected service, plan and billing frequency;
acceptance of applicable terms and this notice;
accepted document URLs, version numbers and timestamps; and
application, verification, conversion and provisioning status.

Subscription, payment and billing information

We may collect:

billing contact and business name;
billing address and country;
VAT or other tax identification number;
selected plan, price, currency and renewal period;
invoices, credits, transaction history and payment status;
subscription start, renewal, cancellation and end dates;
Stripe customer, subscription, invoice and payment identifiers; and
accounting and reconciliation records.

Payment providers process payment credentials. Crisis Solutions does not normally receive or store complete card numbers, card security codes or full bank-account credentials.

Account and service information

We may collect:

WordPress user and site identifiers;
username, role and organisation membership;
login and account-management activity;
facilitator and participant details;
service communications and support requests;
quota, feature and AI usage;
service start, expiry, suspension and retention dates; and
audit records of administrative actions.

Security and technical information

We may process:

IP and network information;
browser and device information;
timestamps;
verification and security tokens;
rate-limit and anti-abuse results;
login and access logs;
suspected abuse or security events; and
diagnostic information.

Raw security information and secret values are not intended to be exposed through customer-facing administration tools.

Cloudflare Turnstile may run browser checks and generate a token that our server validates with Cloudflare. It uses browser and behavioural signals to help distinguish legitimate users from automated activity.

Customer Content

A trial or paid customer site may contain:

fictional or real names supplied by the Customer;
exercise scenarios and injects;
messages, comments and simulated communications;
uploaded documents and media;
AI prompts and generated output; and
information entered by facilitators and participants.

Customers should minimise personal information and use fictional or anonymised exercise information wherever possible. Special-category, criminal-offence or other sensitive personal information should not be uploaded unless this has been specifically agreed and appropriate safeguards are in place.

3. Why we use personal information

Purpose	Typical lawful basis
Receiving and assessing a trial or service request	Steps requested before entering into a contract
Verifying an applicant and provisioning a trial	Contract or pre-contractual steps
Providing and administering a paid subscription	Contract
Creating and administering user accounts	Contract
Sending verification, access, billing and service-lifecycle communications	Contract
Processing payments and managing renewals, failed payments and cancellations	Contract and legitimate interests
Maintaining invoices, tax and accounting records	Legal obligation
Reconciling payments and preventing payment fraud	Legitimate interests
Protecting the service against spam, fraud and unauthorised access	Legitimate interests
Maintaining audit, support and operational records	Contract and legitimate interests
Monitoring capacity, reliability and security	Legitimate interests
Complying with legal, regulatory or court requirements	Legal obligation
Establishing, exercising or defending legal claims	Legitimate interests or legal obligation, as applicable
Optional marketing and advertising measurement	Consent, where required and collected separately

The contract basis applies where processing is necessary to provide the requested service or take requested pre-contractual steps. Other operational and security uses may rely on legitimate interests or another applicable basis.

Our legitimate interests include:

operating, securing and improving Crisis Cloud AI;
preventing abusive, fraudulent or duplicate registrations;
protecting customers and other users;
diagnosing faults;
managing shared-service capacity;
reconciling payments and maintaining accurate commercial records; and
demonstrating what administrative action occurred.

We do not add an applicant or customer contact to general marketing solely because they request a trial or buy a subscription. Any marketing choice is separate and optional.

4. Automated checks

We use automated checks to assess matters including:

email validity;
duplicate applications;
reserved or invalid hostnames;
submission speed and volume;
bot indicators;
rate limits; and
whether an application is eligible for automatic provisioning in the requested region.

These checks may prevent immediate automatic provisioning or refer a request for manual review. A person may request human review by contacting info@crisis-solutions.com.

5. Who receives personal information

We may disclose relevant information to service providers supporting Crisis Cloud AI, including:

Microsoft Azure, for application hosting, databases, networking, monitoring and related infrastructure;
Stripe, for payment processing, subscriptions, invoicing and, where enabled, tax calculation;
Xero, for accounting, financial records and reconciliation;
our banking providers, where required to receive, reconcile or return payments;
Brevo, for transactional verification, access and lifecycle email;
Cloudflare, for Turnstile, content delivery, security and abuse protection;
Anthropic, where an authorised user invokes an AI-assisted feature;
analytics, advertising or media providers, including Google or embedded-video providers, only where they are enabled and applicable consent has been obtained;
professional advisers, auditors and insurers;
contractors supporting the service under confidentiality and data-protection obligations; and
courts, regulators, law-enforcement bodies or public authorities where disclosure is required or lawful.

Suppliers may act as processors, independent controllers or both, depending on the service and the information concerned. Their own privacy notices may also apply when they determine how personal information is used.

6. Controller and processor roles

Crisis Solutions is the controller for information it uses to:

assess trial and subscription requests;
administer customer relationships, accounts and billing;
protect and operate the platform;
communicate with applicants, customers and users;
manage subscription renewals, cancellations and payment issues; and
meet its own legal obligations.

For personal information that a Customer independently chooses to place in an exercise or otherwise process through its organisation site, the Customer will usually determine why that information is used. In that situation, the Customer may be the controller and Crisis Solutions may act as its processor.

The legal role depends on who determines the purpose and means of the particular processing, rather than simply who operates the software. A separate data-processing agreement may be required before non-fictional, sensitive or high-risk personal information is used in the service.

7. International transfers and hosting regions

UK and European customer services are intended to be hosted in the United Kingdom region. United States customer services may be hosted in a United States region. The applicable region may depend on the Customer’s service arrangement and provisioning choice.

Some suppliers may process support, security, email, payment, AI, analytics or diagnostic information outside the United Kingdom. Access by a supplier or support team from another country may also constitute an international transfer.

Where a restricted transfer takes place, we use an applicable safeguard, which may include:

UK adequacy regulations;
the UK International Data Transfer Agreement;
the UK Addendum to approved contractual clauses; or
another legally permitted transfer mechanism.

Customers should contact us if they need confirmation of the hosting region or transfer arrangements applying to their service.

8. How long we retain information

We retain personal information only for as long as reasonably necessary for the relevant purpose, subject to legal, accounting, security and dispute requirements.

Information	Normal retention period
Unverified, rejected or duplicate trial applications	One year
Verification tokens	Until used or expired; associated security record for one year
Active trial account and Customer Content	For the duration of the trial
Expired trial site and Customer Content	Reviewed after 30 days and normally deleted within 90 days after expiry, unless converted to a paid service, retained at the Customer’s request, or needed for legal or security reasons
Active paid account and Customer Content	For the duration of the subscription
Ended paid subscription and Customer Content	Normally deleted within 90 days after the service ends, subject to agreed export, transition, legal hold or security requirements
Security and access logs	One year
Routine support correspondence	One year after the matter is closed
Contract, order and terms-acceptance evidence	Six years after the customer relationship ends
Billing, tax, invoice and subscription records	Six years after the end of the relevant financial year or transaction, as applicable
Backups following deletion from the live service	Up to six months, after which they are overwritten or deleted through the normal backup cycle
Legal, regulatory, fraud or dispute records	For as long as reasonably required for the relevant claim, investigation or obligation

Deletion from backups may not occur immediately. Information retained in a backup is isolated from ordinary use and is restored only when necessary for recovery or security purposes.

We may retain information for longer where necessary to investigate abuse, respond to a dispute, comply with law or establish, exercise or defend legal claims. Where possible, information retained for statistical analysis will be anonymised.

9. Security

We use organisational and technical controls intended to protect personal information, including:

role-based access;
organisation-site separation;
encrypted HTTPS connections;
controlled administrative access;
managed secret storage;
rate limiting and bot protection;
logging and audit records;
backup and recovery controls; and
security and deployment review procedures.

No internet service is completely secure. Users must protect their credentials and report suspected unauthorised access promptly.

10. Your rights

Depending on the circumstances, individuals may have the right to:

be informed about the use of their information;
request access;
request correction;
request erasure;
request restriction;
object to processing based on legitimate interests;
receive certain information in a portable format;
withdraw consent where processing is based on consent; and
challenge certain solely automated decisions.

Some rights are subject to legal conditions and exemptions. Requests should be sent to info@crisis-solutions.com. We may need to verify the requester’s identity.

Where Crisis Solutions processes Customer Content only as a processor, an individual should normally direct their request to the relevant Customer. We will assist that Customer as required by the applicable data-processing arrangements.

11. Complaints

Please contact us first so that we can investigate a concern.

Individuals also have the right to complain to the UK Information Commissioner’s Office. Information about doing so is available at ico.org.uk.

12. Children

Crisis Cloud AI is intended for professional and organisational use by adults. Applicants and customer administrators must be at least 18.

The service is not directed at children. Customers must not create accounts for children or place children’s personal information in the service without prior written agreement and an appropriate legal basis and safeguards.

13. Cookies, similar technologies and external services

Our websites and checkout or customer-facing pages may use essential technologies needed for security, authentication, payments and service delivery. Optional analytics, advertising or embedded-media technologies are used only where enabled and, where required, after consent.

Stripe-hosted checkout pages and other external services may set their own cookies or similar technologies under their own privacy information. Further detail should be provided in the applicable website cookie notice or consent tool.

14. Changes to this notice

We may publish a new version of this notice where our processing, suppliers, legal obligations or service design changes.

The version accepted during registration or purchase may be recorded against the relevant request or customer account. Material changes affecting existing users will be communicated where appropriate.

15. Contact

Questions, requests or concerns about this notice should be sent to:

Crisis Solutions Ltd
Ashwell House, High Street
Longborough GL56 0QE
United Kingdom
Email: info@crisis-solutions.com