Privacy Policy

Last updated: October 22, 2026

This Privacy Policy describes how TableX ("TableX," "we," "us") collects, uses, and shares information when you use our crisis-simulation platform at tablex.tech and demo.tablex.tech (the "Service"). By using the Service you agree to this Policy.

1. Information we collect

• Account information. Name, email address, organization, and role when you register or are invited.
• Content you provide. Scenarios, exercise scripts, messages, decisions, files, and other material you or your organization create or submit during exercises.
• Usage and technical information. Log data such as IP address, browser type, pages and features used, timestamps, and actions taken within exercises, which we use to operate, secure, and improve the Service.
• Communications. Email addresses and message metadata for invitations and notifications we send on your behalf, and records of support correspondence.
• Scenario pack signups. If you request a free scenario pack on tablex.tech, we record the email address you enter, the date and time of the request, and the page you signed up from. We use this to deliver the pack files and to measure interest in the pack. The record is stored on our own server, and we do not sell it.

2. How we use information

• To provide and operate the Service, including running exercises and generating after-action reports.
• To run AI features described below.
• To send invitations, notifications, and service-related messages.
• To protect the security and integrity of the Service, prevent abuse, and comply with legal obligations.
• To understand usage and improve the Service.

3. AI processing

When an exercise uses AI participants or non-player characters, exercise content — such as the scenario, role briefings, and messages in the exercise — is sent to our AI service provider (currently OpenAI) to generate responses. We do not use your content to train our own models. Do not place highly sensitive real-world personal data or live operational secrets into exercises unless your organization has approved doing so.

4. How we share information

We do not sell personal information. We share information only:

• Within your organization, according to the roles and permissions your organization configures (for example, facilitators can see exercise activity and reports).
• With service providers that process data on our behalf, including cloud hosting (DigitalOcean), AI generation (OpenAI), and email delivery (Twilio/SendGrid), bound by their contractual obligations.
• For legal reasons, where required by law, legal process, or to protect the rights, safety, and property of TableX, our users, or the public.
• In a business transfer, such as a financing, merger, or acquisition, subject to this Policy.

5. Cookies and local storage

The Service uses browser local storage and essential cookies to keep you signed in and to remember session state. We do not use advertising or cross-site tracking cookies.

6. Data retention

We retain account and exercise data while your account or organization remains active, and for a reasonable period afterward for security, legal, and operational purposes. You may request deletion of your personal information as described below; some records may be retained where required by law or for legitimate security purposes.

7. Security

We use administrative, technical, and organizational measures to protect information, including encryption in transit and role-based access controls. No system is completely secure, and we cannot guarantee absolute security.

8. Your choices and rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, or to ask questions about this Policy, contact us at the address below. Organization members may also contact their organization administrator, who controls much of the exercise data.

9. Children

The Service is intended for professional and organizational use and is not directed to children under 16. We do not knowingly collect information from children under 16.

10. International processing

TableX operates the Service from the United States, and information is processed and stored in the United States. If you use the Service from elsewhere, your information will be transferred to and processed in the United States.

11. Changes to this Policy

We may update this Policy from time to time. Material changes will be posted on this page with a revised date.

12. Contact

Privacy questions or requests: privacy@tablex.tech.