Privacy Policy

01Data we collect

We collect information you provide when requesting access to and using IR Now. This includes your name, work email address, company name, company size, and job title. When you set up your organization's training, we also collect the organizational profile, playbooks, policies, and other incident response documentation you submit to generate courses.

We automatically collect usage data to operate and improve the service. This includes module progress and completion status, quiz scores and attempts, certificate issuance records, session timestamps, browser type, and IP address. This data is used to produce readiness analytics for your organization and to maintain the platform.

02AI processing

IR Now uses third-party AI providers to generate training content from the organizational information you supply. When you create or regenerate courses, relevant portions of your organizational profile and uploaded documents are sent to our AI subprocessors for content generation. We share only the data necessary to produce your training materials.

We do not use your organizational data to train, fine-tune, or improve third-party foundation models. Your data is processed under each subprocessor's data processing agreement and is not retained by them beyond the processing window.

03Storage & security

Your data is stored on Amazon Web Services (AWS) infrastructure with encryption in transit (TLS 1.2+) and at rest (AES-256). We implement access controls, audit logging, and monitoring appropriate to the sensitivity of the data we handle.

We follow industry-standard security practices including role-based access controls for internal systems, regular security reviews, and incident response procedures. While no system is perfectly secure, we take reasonable and appropriate measures to protect your data from unauthorized access, alteration, disclosure, or destruction.

04Sharing

We do not sell, rent, or trade your personal data or organizational information. We share data only in the following circumstances:

• Subprocessors: With the third-party services necessary to operate the platform (see AI Processing section above), under appropriate data processing agreements.
• Certificate verification: Publicly verifiable certificates expose only the information necessary to confirm their authenticity — the learner's name, course title, completion date, and verification code. No other personal or organizational data is included.
• Legal requirements: Where required by law, regulation, legal process, or governmental request, we may disclose information as necessary to comply.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction, subject to the same privacy protections described here.

05Retention

We retain your data for as long as your account is active or as needed to provide the service, comply with legal obligations, resolve disputes, and enforce our agreements. Specifically:

• Account and profile data is retained for the duration of your active subscription and for up to 90 days following account termination to allow for reactivation.
• Generated course content and learner progress data is retained for the life of the account.
• Certificate records are retained indefinitely to support ongoing verification.
• Server logs and analytics data are retained for up to 12 months.

Upon request or following account termination, we will delete or anonymize personal data in accordance with our retention schedule and applicable legal obligations. Some data may be retained in anonymized or aggregated form for analytics purposes.

06Your rights

Depending on your jurisdiction, you may have certain rights regarding your personal data. These may include:

• Access and portability: The right to request a copy of the personal data we hold about you in a structured, machine-readable format.
• Correction: The right to request correction of inaccurate or incomplete personal information.
• Deletion: The right to request deletion of your personal data, subject to legal retention requirements and legitimate business interests.
• Objection and restriction: The right to object to or request restriction of certain processing activities.

To exercise any of these rights, contact us at contact@irnow.net. We will respond to verified requests within the timeframes required by applicable law.

07Cookies

We use cookies and similar technologies to operate the platform and understand how it is used. Our cookie usage falls into two categories:

• Essential cookies: Required for the platform to function, including session management, authentication, and security. These cannot be disabled.
• Analytics cookies: Used to understand usage patterns and improve the service. These are limited in scope and do not track you across third-party websites.

You can control non-essential cookies through your browser settings. Disabling essential cookies may prevent you from using the platform.

08International transfers

Your data may be processed in regions where our subprocessors operate, including the United States and other jurisdictions. Where personal data is transferred across borders, we rely on appropriate legal safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or other transfer mechanisms recognized under applicable data protection law.

By using IR Now, you acknowledge that your data may be processed in jurisdictions with different data protection laws than your own. We take steps to ensure that your data receives an equivalent level of protection regardless of where it is processed.

09Data controller

IR Now is the data controller for personal data processed through the service. We determine the purposes and means of processing your personal data in connection with providing the platform.

For privacy-related requests, questions, or concerns, contact us at contact@irnow.net. We will make every effort to resolve your inquiry promptly and transparently.

If you believe that your data protection rights have not been adequately addressed, you may have the right to lodge a complaint with your local data protection supervisory authority.