Privacy notice

This notice covers personal data handled by Practice Makes Ready, a service operated by Impaque. It applies to the public website and to the signed-in application.

Where your organization puts personal data into a drill — the names of the people in the room, for example — your organization decides what goes in and why. We hold it on your behalf and act on your instructions.

Account data: the name and email address of whoever creates an account, and a hashed form of the password. We need this to sign you in and to attribute a drill to an organization.

Organization data: the organization name, rough size and area of work, entered at setup. It is used to word the drill so it reads as though it were written for you.

Drill data: the first names or initials of participants and the role each played; answers to the five setup questions; decisions recorded during the hour, against roles rather than names; debrief answers; the drafted report and your edits to it; and corrective actions with their owners and due dates.

If you paste part of your own incident-response plan at setup, the text itself is not stored. It is read once, in memory, and discarded; only the short verbatim quotes shown in your brief are kept, and those are deleted with the drill.

We do not run analytics, advertising or tracking of any kind. The only cookie is the one that keeps you signed in.

The database is a managed PostgreSQL instance hosted in AWS eu-west-2 (London). The application runs on Vercel.

Each organization's data is isolated inside the database by row-level security, enforced by the database rather than only by the application, and the role the application connects with cannot bypass it.

Text is sent to Anthropic's API in three narrow cases: to draft your report, to word an update for your organization, and — only if you choose to paste it — to read part of your own plan. Email addresses and long numbers are removed before anything is sent for that last case.

It is not sold, and it is not shared with anyone else. Our infrastructure providers (Vercel, Neon) process data in order to run the service.

We may sign in as your account to reproduce a problem you have reported. When that happens a banner appears on every screen for the duration, including on anything printed or exported.

Drill data is kept while your account is open, because the value of a drill is being able to compare it with the next one.

Ask us to delete a drill, or your whole account, and we will. Deletion is on request rather than self-service at the moment; we would rather say so than imply a button exists.

Depending on where you are, you may have the right to access, correct, export or erase personal data we hold about you, and to object to or restrict how it is used.

Write to us and we will act on it. If you are unhappy with how we respond, you can complain to your data protection regulator.