Privacy Notice

StayReady Games is committed to respecting your privacy and handling personal information responsibly. This Privacy Notice explains what personal information we collect and process, how it is used, who it may be shared with, and your rights.

1. Who we are

StayReady Games is a trading name of STAYREADY LTD, a private limited company registered in England and Wales under company number 17205530.

Our registered office is:

Our role under UK data protection law depends on the circumstances in which personal information is being processed.

For information relating to our website, business contacts, security, business administration and other purposes that we determine ourselves, STAYREADY LTD acts as a data controller.

Where an employer, training provider, client or other organisation provides individuals with access to the StayReady Games platform, that organisation will usually determine why the training is taking place, who participates and how learning information is used. For much of this activity, that organisation acts as the data controller and STAYREADY LTD acts as a data processor, processing personal information on its behalf and in accordance with its instructions.

There may be limited circumstances in which STAYREADY LTD acts as a controller for particular processing associated with the platform where we determine the purpose ourselves, for example to protect the security and integrity of our services, comply with legal obligations or administer our business.

If you have questions about this notice, want to exercise your data protection rights, or want to make a data protection complaint, you can contact us at privacy@stayreadygames.com.

2. What this notice covers

This notice applies to:

• visitors to stayreadygames.com;
• people who book a call with us;
• people who contact us about StayReady Games;
• prospective customers and other business contacts we communicate with; and
• users who access the StayReady Games platform through an employer, training provider, client or other organisation.

If an organisation has provided you with access to StayReady Games, that organisation may also provide you with its own privacy information explaining why it uses StayReady Games, its lawful basis for doing so, who within the organisation can access your information, and how it uses your learning results.

3. Information we collect and process

Information processed when you visit our website

Our marketing website is hosted using Lovable. When the website is served to you, Lovable processes basic technical information that is normally transmitted as part of a web request, including:

• your IP address;
• your browser user agent; and
• the page or website that referred you to our site, where available.

Lovable acts as a data processor on our behalf for this activity.

We can also see aggregate website statistics, such as overall visitor and page-view counts. The marketing website does not use device identifiers to identify visitors or build profiles of individual visitors across separate visits.

Information you provide when booking a call

If you choose to book a call with us, you may be directed to Calendly, a third-party scheduling service.

We may receive information you provide when making the booking, such as:

• your name;
• your email address;
• your company or role, if provided;
• your chosen meeting time; and
• any other information you choose to provide as part of the booking.

Calendly processes information to provide its scheduling service and may also process information in accordance with its own privacy notice.

Information you provide when contacting us

If you contact us by email or through another business communication channel, we may collect information such as your name, work contact details, organisation, role and the contents of your correspondence with us.

Platform account information

If an organisation provides you with access to StayReady Games, we may process information needed to create and administer your account, such as:

• your name;
• email address;
• organisation;
• role or user type;
• invitation and account status;
• authentication and login information; and
• information about your use of the platform.

Some of this information may be provided to us directly by your organisation rather than by you.

Access to the platform may be provided through methods such as an invitation link, email and password, magic link or, where available, single sign-on.

How you use the platform

To understand how StayReady Games is used and to diagnose problems, we process information about your interactions with the platform, including:

• pages visited and features used;
• controls selected and the sequence of actions taken;
• the timing and duration of activity;
• device, browser and approximate location derived from your IP address; and
• error and diagnostic information.

We also record sessions on the platform. A session recording shows what was on your screen, which can include your responses and the report you were shown. Session recordings are used only by StayReady to diagnose faults and improve the platform. They are not made available to your organisation, and they are deleted automatically after 30 days.

Simulation and learning information

When you participate in a StayReady Games simulation, we may process information relating to your learning activity, including:

• simulations assigned to you;
• spoken or written responses;
• audio recordings of spoken simulations;
• transcripts;
• simulation attempts and completion information;
• timestamps and activity history;
• assessment criteria;
• scores or other assessment results;
• AI-generated feedback; and
• other information relating to your participation and performance within the platform.

The exact information available will depend on the features being used by your organisation.

Information disclosed during a simulation

Workplace conversations can involve personal, sensitive or confidential subjects. Information you choose to mention during a simulation may therefore become part of an audio recording, transcript or other learning record.

You should avoid unnecessarily including confidential business information, trade secrets or sensitive personal information about yourself or identifiable third parties.

Where possible, you should describe real workplace situations without providing information that identifies the people involved or disclosing sensitive information that is not necessary for the training exercise.

4. How we use information

We may use personal information to:

• operate, maintain and secure our website and platform;
• create and administer platform accounts;
• authenticate users and manage access;
• provide interactive workplace simulations;
• process spoken and written responses;
• record and transcribe simulations;
• generate AI-powered interactions;
• generate assessments, scores and feedback;
• maintain learning and participation histories;
• allow users to review their learning activity and results;
• provide authorised customer users with information about learner activity and results, including by sending notifications to a workplace messaging tool where an organisation has chosen this;
• provide cohort, programme and aggregate analytics;
• troubleshoot technical issues and provide support;
• prevent misuse, fraud or unauthorised access;
• understand and improve the performance, reliability and effectiveness of StayReady Games;
• respond to enquiries;
• arrange and manage meetings;
• communicate with prospective customers and business contacts;
• take steps towards entering into a business relationship with you or your organisation;
• manage an existing business relationship; and
• comply with legal or regulatory obligations.

Where we process platform information as a processor, we do so on behalf of the organisation that provided the user with access and in accordance with our agreement with that organisation.

We do not sell personal information.

5. Artificial intelligence

StayReady Games uses artificial intelligence to provide interactive simulations, generate responses from simulated characters and produce feedback and assessments.

This means that information from a simulation, including transcripts and relevant contextual information, may be processed by AI systems and service providers acting on our behalf in order to provide the service.

AI-generated responses, feedback, scores and assessments are probabilistic. They may sometimes be inaccurate, incomplete or inconsistent and should not be treated as infallible measures of an individual’s ability or likely workplace performance.

STAYREADY LTD does not itself make decisions about a user’s recruitment, employment, promotion, compensation, disciplinary status or termination.

StayReady Games is designed as a learning, practice and development tool. Our customer terms provide that StayReady Games outputs must not be used as the sole basis for significant employment decisions such as recruitment, promotion, compensation, disciplinary action or termination.

6. What your organisation may be able to see

If an organisation has provided you with access to StayReady Games, authorised users within that organisation may be able to access information about your activity. Depending on the features available to your organisation, this may include:

• participation and completion information;
• simulation attempts;
• spoken or written responses;
• audio recordings;
• transcripts;
• assessment criteria;
• scores or other assessment results;
• AI-generated feedback;
• learning history; and
• cohort or programme analytics.

Session recordings described in section 3 are not included in the above. They may show your responses and reports, but they are used only by StayReady to diagnose technical faults and are not made available to your organisation.

You should not assume that activity completed through your organisation’s StayReady Games account is private from that organisation.

Your organisation determines who within it is authorised to access this information and how it uses the information, subject to applicable law and its agreement with StayReady Games.

Where an organisation has chosen to receive notifications in a workplace messaging tool such as Slack, information about learner activity may be sent to a channel that organisation nominates. These notifications contain a learner’s name, the scenario practised and the attempt number. They do not contain recordings, transcripts, quotations, scores or assessment results. Who can see a notification is determined by the membership of that channel rather than by StayReady Games access controls.

Questions about why your organisation is using StayReady Games or how it uses your learning information should generally be directed to your organisation.

7. Our lawful bases for processing

Under UK data protection law, a controller needs a lawful basis for processing personal information.

Where STAYREADY LTD acts as a controller, depending on the circumstances we may rely on:

Legitimate interests – where processing is reasonably necessary to operate and secure our website and services, communicate with prospective customers and business contacts, prevent misuse, manage our business and improve the reliability and effectiveness of our services, provided those interests are not overridden by your rights and interests.

Steps before entering into a contract or performance of a contract – where you ask us to take steps relating to a potential business relationship, or where processing is necessary to provide services under an agreement with you.

Legal obligations – where we need to process information to comply with a legal or regulatory requirement.

Where STAYREADY LTD acts as a processor for an organisation using the platform, that organisation is responsible for determining the appropriate lawful basis for its processing of learner information.

Agreeing to the StayReady Games Platform User Terms does not mean that a learner has given data protection consent to all processing associated with the platform.

If we introduce processing in the future that specifically requires your consent, we will ask for that consent separately where required.

8. Using information to develop and improve StayReady Games

We may analyse how StayReady Games operates and performs in order to evaluate and improve our simulations, assessment methods, prompts, AI systems, product functionality, reliability and user experience.

We may create and use aggregated or anonymised information derived from use of StayReady Games for analytics, research, evaluation and product development.

We do not use identifiable learner conversations to train AI models for other customers.

Where information has been genuinely anonymised so that an individual can no longer reasonably be identified, it is no longer personal information.

Information that has merely had obvious identifiers removed but can still reasonably be linked back to an individual will continue to be treated as personal information.

9. Cookies and similar technologies

The StayReady Games platform uses cookies, local storage or similar technologies that are necessary to provide authentication, security, session management and related platform functionality.

The platform also uses PostHog, a product analytics service, which sets identifiers used to record how the platform is used, to record sessions as described in section 3, and to report technical errors. PostHog processes this information on infrastructure located in the European Union.

If we introduce non-essential cookies, analytics or other tracking technologies on our marketing website, or introduce technologies on the platform that require consent, we will update this notice and introduce appropriate consent or other controls where required.

10. Who we share information with

We use service providers to operate our website, platform and business.

These include:

• Lovable, which provides marketing website hosting and aggregate website analytics;
• Calendly, where you choose to use its service to schedule a meeting with us;
• Anthropic, which provides artificial intelligence used to support simulated interactions, feedback and assessment;
• ElevenLabs, which provides speech synthesis, speech-to-text and transcription functionality, and voice functionality for simulated counterparts;
• PostHog, which provides product analytics, session recording and error reporting for the StayReady Games platform, hosted in the European Union;
• Slack Technologies, LLC (part of Salesforce), where an organisation has chosen to receive StayReady Games notifications in its Slack workspace;
• cloud infrastructure and hosting providers;
• database and authentication providers;
• other artificial intelligence and speech-processing providers we may use in the future;
• communications and email providers;
• security, error-monitoring and technical-support providers;
• other IT and business service providers; and
• professional advisers, regulators, courts or public authorities where disclosure is reasonably necessary or required by law.

Where these providers process personal information on our behalf, we require appropriate contractual and data protection arrangements.

If you access StayReady Games through an organisation, information may also be made available to authorised users of that organisation as described in section 6.

We only share personal information where reasonably necessary for the relevant purpose.

A current list of service providers and subprocessors used to operate the StayReady Games platform is available by contacting privacy@stayreadygames.com.

11. International transfers

Some of our service providers process personal information outside the United Kingdom, including in the United States.

Where UK data protection law requires safeguards for an international transfer, we use an applicable lawful transfer mechanism.

For transfers of personal information to Anthropic that require an international transfer safeguard, Anthropic’s Data Processing Addendum incorporates the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses.

ElevenLabs’ US entity is certified under the UK Extension to the EU-US Data Privacy Framework. Where that framework is applicable to a transfer to ElevenLabs’ US entity, it provides the relevant transfer mechanism. ElevenLabs’ Data Processing Addendum also incorporates the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses for transfers outside the United Kingdom where required.

Slack Technologies, LLC is certified under the UK Extension to the EU-US Data Privacy Framework, as one of the Salesforce entities covered by Salesforce’s certification. Where that framework is applicable to a transfer to Slack, it provides the relevant transfer mechanism. Slack’s Data Processing Addendum also incorporates the European Commission’s Standard Contractual Clauses, with the equivalent United Kingdom clauses where applicable, for transfers outside the United Kingdom where required.

PostHog processes information for the StayReady Games platform on infrastructure located in the European Union. Where personal information is transferred from the United Kingdom to the European Economic Area, we rely on the United Kingdom's adequacy regulations for the EEA.

Other service providers may rely on UK adequacy regulations, the UK International Data Transfer Agreement, the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, or another transfer mechanism recognised under UK data protection law, as applicable.

For further information about international transfer arrangements relevant to the StayReady Games platform, contact privacy@stayreadygames.com.

12. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected or processed.

For enquiries, meeting bookings and business correspondence, this depends on factors such as whether discussions remain active, whether a business relationship develops, and whether we need to retain information for legal, contractual, accounting or dispute-resolution purposes.

For platform users, retention depends on factors including:

• the type of information involved;
• the duration of the organisation’s relationship with StayReady Games;
• the organisation’s instructions;
• whether information is needed to provide learning history or reporting;
• security and fraud-prevention requirements;
• applicable legal or contractual requirements; and
• whether the information can instead be anonymised.

Audio recordings and transcripts of simulations will be retained for no longer than 12 months after the relevant learning activity or programme ends, unless our agreement with the relevant customer specifies a shorter period.

Session recordings are retained by PostHog for 30 days and are then deleted automatically.

We may retain particular information for longer where this is required by law or reasonably necessary to establish, exercise or defend legal claims.

Other learner information, such as assessment results, feedback, completion information and learning history, may be retained for longer where this is necessary to provide the service, maintain an agreed learning record or meet the relevant organisation’s documented requirements.

When a customer’s relationship with StayReady Games ends, we will delete, return or anonymise personal information processed on its behalf in accordance with our agreement with that customer, subject to any limited retention required for legal, security, backup or dispute-resolution purposes.

We may retain genuinely anonymised or aggregated information for longer because it no longer identifies individual users.

Technical information used to host our marketing website is processed by Lovable. We do not receive or retain a separate copy of Lovable’s raw server logs. Lovable has not published a specific raw server-log retention period to us.

Once a notification has been delivered to an organisation’s messaging tool, how long it is retained there is governed by that organisation’s own settings and is outside StayReady’s control.

We periodically review the information we hold and delete or anonymise it when we no longer have a reason to keep it.

13. Your data protection rights

Depending on the circumstances, UK data protection law may give you the right to:

• ask for a copy of the personal information held about you;
• ask for inaccurate or incomplete information to be corrected;
• ask for your personal information to be deleted;
• ask for processing of your information to be restricted;
• object to certain processing based on legitimate interests;
• receive certain information in a portable format; and
• withdraw consent where processing genuinely relies on consent.

These rights are not absolute and may not apply in every circumstance.

Where STAYREADY LTD acts as the controller, you can exercise your rights by contacting privacy@stayreadygames.com.

Where we process learner information solely on behalf of the organisation that provided your access, that organisation is normally responsible for responding to your request as controller. You may contact that organisation directly.

You can also contact us at privacy@stayreadygames.com. Where appropriate, we will pass the request to the relevant organisation or assist it in responding to your request.

We may need to ask for information to confirm your identity before responding to a request.

14. Data protection complaints

If you have concerns about how STAYREADY LTD has handled personal information for which we are responsible as controller, you can make a data protection complaint by emailing privacy@stayreadygames.com.

We will take appropriate steps to investigate your concern and respond without undue delay.

Where your concern relates principally to how the organisation that provided your StayReady Games access uses your learning information, you may also wish to raise the issue directly with that organisation.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection and information rights. Information about making a complaint is available through the ICO’s website.

We would welcome the opportunity to address your concerns directly first, but you are not required to contact us before making a complaint to the ICO.

15. Security

We take reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures include controls relating to access, authentication, infrastructure, data handling, service providers and security monitoring.

No method of transmitting or storing information electronically can be guaranteed to be completely secure.

We review and develop our safeguards as StayReady Games and the information we process evolve.

16. Children

The StayReady Games platform is intended for adults participating in professional learning and development.

Users must be at least 18 years old unless we have expressly agreed otherwise with an organisation and appropriate safeguards have been put in place.

17. Links to other websites

Our website or platform may contain links to third-party websites and services, including Calendly and LinkedIn.

When you follow a link to another website or independently operated service, that organisation is responsible for explaining how it handles information through its own services. We encourage you to review its privacy information where relevant.

18. Changes to this notice

We may update this Privacy Notice as StayReady Games develops or if our data practices or legal obligations change.

We will publish the current version on this page and update the date at the top when we make changes.

Where a change materially affects how we process platform users’ personal information, we may also take additional reasonable steps to bring the change to the attention of affected users or customers.

19. Contact us

For privacy enquiries, data protection requests or complaints:

STAYREADY LTD

Trading as StayReady Games

Email: privacy@stayreadygames.com