Privacy Policy

Overview

This Privacy Policy explains how Do GRC ("we", "us", or "our") collects, uses, stores, and protects your personal information when you access or use our platform. We are committed to safeguarding your privacy and handling your data transparently.

Who We Are

Do GRC is run by Hamish Dean, a sole trader based in Australia, who decides how your personal information is used (in the language of the GDPR, the controller). Address: Canberra, Australia. ABN 22 433 952 558. Our privacy contact is Hamish Dean, at hello@dogrc.com.

Information We Collect

We may collect the following types of information:

• Account Information — name, email address, and authentication credentials when you create an account, or the name and email address Google shares with us if you sign in with Google.
• Usage Data — learning progress, room completions, scenario responses, GRC tool records (e.g. risks, incidents, policies, vendors, audits), GRC Coach conversations, interview prep answers, and platform interaction patterns.
• Account Preferences — settings you control from your profile, such as your email and privacy preferences, the title you pick for the leaderboard (if any) and, on the Pro membership, whether your answer key is switched on. The answer-key setting is read each time you ask for an answer and each time XP would be awarded, because it decides both. If you turn marketing email on or off, we also record when you did so and the wording you were shown.
• Subscription Agreements — when you start a paid membership, a record of your agreement to its automatic renewal: when you agreed, the plan, the price and currency shown, whether a free trial was offered, and the wording you agreed to. When you change plan through Paddle, the same record of your agreement to the change, with the amount shown for that day; when you buy a team plan, of your agreement to its renewal, with the team and the seats bought. We also note each email we send you about your membership (which kind, and when), so that none is sent twice.
• Team Information — if you buy or join a team: the team's name and owner, its members' roles and seats, the addresses its managers invite and who invited them, what it asks its members to do, and the billing status of the team's plan. See Teams below.
• Technical Data — browser type, device information, IP address, and cookies used to deliver core functionality. To stop abuse we count requests per account or IP address over short time windows. Counts kept against an IP address are deleted within about three days; counts kept against an account are deleted after 12 months, or when you delete your account.
• Product Analytics — page views, how quickly pages load, clicks and other interaction events, referrer URL and UTM campaign parameters, and approximate geolocation derived from IP address. We do not record your screen or session.

How We Use Information

We use your information to:

• Operate, maintain, and improve the Do GRC platform.
• Personalise your learning experience and track your progress.
• Provide AI-powered features such as the GRC Coach, AI scenario grading, interview prep feedback, and GRC tool data population.
• Mark lab work, and issue CPE records.
• Send service-related communications such as account verification and updates.
• Switch AI features off where our AI provider does not operate or sanctions apply, and tell you before you rely on them: when you first visit in a browser session and when you use an AI feature, we check the country (and, for a few regions, the region) your IP address points to, and keep nothing. Your browser remembers only whether the AI features work where you are, until you close the tab, so it can show a notice where they don't (see our Cookie Policy).
• Email you about a paid membership: a confirmation of what you signed up for, a reminder before a free trial ends, a confirmation when you cancel, and notice of a price change. They are part of the membership, so they are sent whatever your marketing email choice.
• Send marketing email, only if you have turned it on in your privacy controls (we do not send any yet); every marketing email will include an unsubscribe link.
• Understand how the platform is used, through the product analytics described below, so that we can improve our content.
• Maintain the security and integrity of the platform.
• Keep the records we need to show what you agreed to and to meet our tax and legal obligations.

Legal Bases (EU and UK)

If you are in the European Union or the United Kingdom, we rely on these legal bases:

• Contract — to run your account and membership, record your progress, mark your work and issue CPE records.
• Consent — for analytics and marketing cookies and for marketing email. You can withdraw consent at any time; this does not affect what we did before you withdrew it.
• Legitimate interests — to keep the platform secure, prevent abuse and fraud, monitor errors and improve our services, balanced against your rights.
• Legal obligation — to keep tax and accounting records and records of what you agreed to, and to respond to lawful requests.

Data Sharing and Disclosure

We do not sell your personal information. We may share data with trusted third-party service providers solely to operate and improve the platform. These sub-processors currently include Supabase (authentication and database), Vercel (hosting, edge delivery, and consent-gated aggregate analytics and performance monitoring through Vercel Analytics and Speed Insights), OpenAI (AI-powered features, as described below), Google (sign-in with Google, Cloud Text-to-Speech for the "listen" feature, and Google Analytics and Google Ads, as described below), Paddle (subscription billing as Merchant of Record; Paddle's checkout also supports PayPal as a payment method), Stripe (subscription billing: the seller of record for individual subscriptions and team plans sold under Stripe Managed Payments, and otherwise the payment processor for subscriptions we sell ourselves, as described under Teams below), Sentry (error monitoring; reports are scrubbed of cookies, tokens, request bodies, URL fragments, IP addresses and location before they are sent, and errors and performance data from your browser are sent only after you grant the Analytics category), Resend (transactional email sent on our behalf, including messages submitted through our contact endpoint and team invites), Google Workspace (hosts our email inbox, hello@dogrc.com, where emails you send us, contact-form messages and privacy requests are received and kept), Cloudflare (every request to the site passes through Cloudflare's network, which delivers our pages and protects the site from attacks and abuse; Turnstile bot protection on the sign-up, sign-in and password-reset forms and on the contact endpoint; and Cloudflare Web Analytics after you grant the Analytics category, as described below), and Cookiebot by Cybot A/S, Denmark (consent banner and consent-log storage). We may also disclose information if required by law or to protect our legal rights.

The Leaderboard

The leaderboard shows the 50 members with the most XP. Each appears under a name we generate from their account (for example, "steady-ledger-482"), with their XP, their XP rank and, if they have picked one, a title from a short list in their profile settings. Nobody can type a name or any other text that appears on it, and it never shows your display name or email address. Usernames that members typed in for the leaderboard before are no longer shown, and we have deleted them.

Where Your Data Is Processed

Do GRC is run from Australia, and our service providers process data in other countries. OpenAI processes it in the United States. Supabase, Vercel, Stripe, Paddle, Sentry, Resend, Cloudflare, Cookiebot and Google may process it in the United States, the European Union and other countries where they operate. Where EU or UK law requires safeguards for these transfers, we rely on the standard contractual clauses in our providers' data processing terms.

Product Analytics

We use analytics to understand how the platform is used, diagnose problems and prioritise improvements. Vercel Analytics, Vercel Speed Insights and Cloudflare Web Analytics give us aggregate figures on page visits and on how quickly pages load. Cloudflare Web Analytics records the pages you visit, the page that sent you there and how quickly each page loads and responds; it sets no cookies and stores nothing on your device.

We also use Google Analytics and, for measuring sign-ups and purchases from our advertising, Google Ads. Google's tag is not loaded until you grant the Analytics category (Google Analytics) or the Marketing category (Google Ads) through the consent banner, so until then our pages send nothing to Google. If you grant the Analytics category, Google Analytics measures the pages you visit. If you grant the Marketing category, Google Ads measures sign-ups and purchases from our ads, and Google can use your visit for ad personalisation, such as showing you our ads on other sites. If you withdraw the Analytics category, Google Analytics stops at once; if you withdraw the Marketing category, the page reloads without Google Ads.

Analytics and performance tools, including Vercel Analytics, Vercel Speed Insights and Cloudflare Web Analytics, are only loaded after you grant the Analytics category through our Cookiebot consent banner. Until then, none of them runs. You can review or withdraw your choice at any time via the "Manage cookie preferences" button on our Cookie Policy page.

If you have an account, you can also switch off product analytics for it from your privacy controls. While that switch is on, Vercel Analytics, Vercel Speed Insights, Google Analytics and Cloudflare Web Analytics do not run for you when you are signed in on any device, whatever your cookie choices. It does not cover Google Ads, which follows your cookie choices as described above, or Sentry error reports. When you are signed out, your cookie choices alone decide, unless your browser sends Global Privacy Control.

Global Privacy Control and Do Not Track

If your browser sends a Global Privacy Control (GPC) signal, we treat it as your objection to product analytics and advertising on that browser, whether or not you are signed in and whatever you choose in the cookie banner: Vercel Analytics, Vercel Speed Insights, Google Analytics and Cloudflare Web Analytics do not run, and Google Ads, our only advertising tag, is not loaded. We don't act on the older Do Not Track signal, because there is no agreed standard for what it means; GPC, the cookie banner and your privacy controls cover the same choices.

AI-Powered Features and Third-Party Processing

Several platform features use third-party AI services to process your inputs and generate responses. These include the GRC Coach (conversations and journey generation), scenario and interview prep grading, the marking of written answers in lab environments, and GRC tool data population. When you use these features, the content you submit is sent to our AI provider for processing.

We do not use your submissions to train third-party AI models. The one exception is the features below, and only if you allow it: they can use a separate OpenAI organisation in which input/output sharing is enabled, so that OpenAI may use their non-personal inputs and outputs to improve its services. New accounts start with this sharing off. Accounts made before 11 October 2026 keep the setting they had, which is sharing on unless they turned it off:

• Exam prep generation — produces synthetic certification-style multiple-choice questions from non-personal inputs: the exam name, domain and difficulty, and the wording of up to 10 questions it generated for you in the last hour, so that it does not repeat them. That wording comes from our own server, never from what is typed in your browser.
• "AI Example" and "Populate examples" in our GRC tools — ask the model to invent realistic example records from scratch. None of your own GRC records are sent.
• Resume Point Generator — sends only a target role you pick from our list and the titles of Do GRC rooms you have completed. It does not send your name, contact details, or real employment history; the resume bullet points describe the platform's training content alone. If you type your own target role instead, that request always uses the organisation with sharing turned off.

You can turn this sharing on or off in your privacy controls, under "Object to AI training-eligible processing" (on means no sharing). With sharing off, those features use the organisation described next. Text you type never goes to the organisation with sharing enabled.

All other features — including the GRC Coach (chat and journey generation), interview prep, role play, scenario submissions, lab written answers, AI quiz answer checking, the Play Arcade, and the AI helpers in our GRC tools — use a separate OpenAI organisation in which input/output sharing is disabled. Inputs to those features are not used to train OpenAI's models, we ask OpenAI not to store their responses, and OpenAI keeps them for up to 30 days, the abuse-monitoring window in its API terms.

The GRC tool helpers send what each needs: a per-record fill helper sends the name or title of the record you are working on; the coach review sends your records across the tools (up to 50 of each type, including details such as treatment plans and root causes); smart suggestions send the titles of your records; and incident analysis sends the incident's description, impact and response actions. GRC tool records are for practice, so please don't enter real personal data or your organisation's confidential information.

Text-to-speech is not an OpenAI feature: the short text strings you choose to play are sent to Google Cloud Text-to-Speech (Google LLC) for audio synthesis and returned to your browser for immediate playback. Google processes that text only to synthesise the audio; we do not store the synthesised audio beyond playback.

For lab environments specifically, what is sent is the prompt, material from the lab it belongs to (such as its brief, and its marking rubric or, for a findings register, the findings it is marked against), and the answer you wrote. Every organisation, person, system and document in a lab is fictional, so a lab answer is written about invented evidence rather than about you or your employer — please keep it that way and do not paste your own organisation's material into an answer box. Only the written prompts are marked this way. The structured fields in a lab are compared against a stored key inside our own database and are never sent to any AI provider.

Automated Marking

Labs are marked automatically: structured answers are compared with a stored answer key, and written answers are marked by AI against a rubric. We do not use automated decision-making for anything else.

CPE Records and Name Changes

When you finish a learning path or submit a lab, we keep a continuing professional education (CPE) record of it: the name you confirmed for your records, the activity, the dates you worked on it, the time credited and the record's code. The time credited for a lab is worked out from when you started it and when you submitted it, and for a path from when you first answered in its rooms and when you finished them. So that records credit only answers you gave yourself, we also keep, for each question or lab, when its answer was first and last shown to you, by the reveal or the answer key, and when you first answered after that. These times are used only to work out your records, are included in your data export and are deleted with your account. Anyone who has a record's code can open it at dogrc.com/cpe/record, which shows the name on the record, the activity, its dates and hours, and the code — never your email or anything else about your account. Records are kept while your account exists, are included in your data export and are deleted with your account, so keep your own copies if a certifying body may ask for them.

If you reissue your CPE records in your current name, each one is changed to that name and given a new code. We keep the old code and the date it was replaced, so anyone who opens an old code sees only that the record was reissued, and whether it has since been withdrawn: not your old name, your new name or the new code. The old name is not kept on the record. When CPE records are reissued, we send ourselves an email listing the old and new codes, without any name, so that misuse can be spotted.

Teams

A team is a group whose seats one subscription pays for. If you buy or join a team, we keep the team's name, who owns it, who is in it, each member's role (owner, admin or member) and the tier of the seat they hold, and the status and dates of the team's plan. Team plans are billed through Stripe. When a team is sold under Stripe Managed Payments, Stripe is the seller of record and handles the buyer's payment and billing details under its own privacy policy; otherwise Stripe processes them for us. We keep the Stripe ids of the team's plan, never card details. The owner and admins can open the team's billing in Stripe's portal, which shows the card on file (its brand and last four digits), the billing details and the team's invoices. A team passes to another owner only once its plan has ended, and the new owner buys any new plan through a Stripe account of their own, so their card and billing details are never added to the previous owner's.

What joining shares. The team's owner and admins can see each member's name, email address, role and seat and, only while the team's plan is paid up (including the 7 days its seats keep working after a payment fails), their progress on Do GRC from the day they joined the team, and from before only if the member chooses to share their earlier progress with that team (it is off unless they turn it on from the team's page, and they can turn it off again at any time): the rooms and paths they complete and when, their lab results, the hours of their CPE records, and the date they were last active, including in an export of the team's training records. They cannot see your written answers, your own plan, or your conversations with the GRC Coach or in Role Play. The invite page says this before you join, and joining is your choice. When the team's plan ends, its owner and admins can no longer see or export members' progress. If you leave the team, or are removed from it, its managers stop seeing your progress at once; your own account, plan and progress are unchanged. The owner and admins may use what they see only to run the team's training.

Why managers can see it. Our legal basis is legitimate interests (in the EU and UK, Article 6(1)(f) of the GDPR): the team owner's in running the training their team plan pays for, and ours in providing it. The limits above keep that in balance with your interests: progress only while the plan is paid up, only from the day you joined unless you choose to share more, and never your written answers or conversations.

Assignments. A team's owner or an admin can ask members to finish a learning path or a lab, by a date if they choose. We keep what was assigned, to whom, by whom and when; whether it is done is read from your own progress. An assignment made to you alone is deleted when you leave the team.

Invites. A team's owner or an admin can invite someone by typing their email address. We email the invite through Resend, with a link that works only for a Do GRC account whose confirmed email address is that address (we treat an address with a +tag, and a Gmail address written with or without dots, as the same address), and keep the address, who sent the invite and when. The email names the team and the name the inviter has confirmed on their account, or, if they haven't, says it comes from a manager of the team. To stop invites being used to send mail in bulk, we count the invites sent to each address in a day, against a one-way hash of the address, and delete the count after two days. Each invite email also says why you are getting it, how long we keep your address, and where this policy is. An invite is deleted 30 days after it is accepted, withdrawn or expires. If you are invited and do not want to join, you need do nothing. If you want no team invites at all, use the link at the end of the invite email: we then keep a one-way hash of your address, not the address itself, until you ask us to remove it, and refuse any further invite to it, telling whoever tries only that the invite can't be sent.

A team is deleted with its owner's account, or by its owner once its plan has ended or if it was never paid for, and a membership with its member's account. Otherwise, 90 days after a team's plan ends, we delete the team and its records: its membership, seats, invites and assignments. Members' own accounts and progress are not deleted with it. The owner of a team whose plan is still running cannot delete their account until the plan ends, so that a plan is never left billing with no one able to cancel it.

Data Retention

How long we keep each kind of personal information:

• Your account and what you do on Do GRC — your profile and settings, progress, lab work, GRC tool records, AI conversations and answer checks, and CPE records: until you delete your account. When you do, we delete them from our database straight away, apart from the exceptions in this list, and the copies in our database provider's backups expire within 30 days.
• Records of your agreement to automatic renewal — kept after you delete your account too, because auto-renewal laws ask us to be able to show what you agreed to for three years from when you agreed, or for a year after the membership ends if that is later. Nothing deletes them automatically yet, so at present they are also kept after that time.
• Request counts — those kept against an IP address: about three days. Those kept against your account: 12 months, or until you delete your account if that is sooner.
• Team invites — 30 days after they are accepted, withdrawn or expire. The count of invites sent to an address in a day, kept against a one-way hash of the address: two days. If you asked for no more team invites, the one-way hash of your address that keeps them stopped: until you ask us to remove it.
• Teams — a team whose plan has ended is deleted, with its membership, seats, invites and assignments, 90 days after the plan ends.
• What our AI features send to OpenAI — in the organisation with sharing turned off, OpenAI keeps it for up to 30 days, for abuse monitoring, unless the law requires it to keep it longer.
• Error reports — kept in Sentry for 90 days at most.
• Payment details — held by Paddle or Stripe under their own privacy policies.

Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal data. You may also have the right to object to or restrict certain processing activities.

If you have an account, you can exercise most of these rights directly from your privacy controls: download a copy of your data, toggle marketing / analytics / AI-training preferences, correct your profile, or delete your account. For any right that isn't covered there, please contact us using the details below. We will respond within one month.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can also complain to a regulator: in Australia, the Office of the Australian Information Commissioner; in the European Union, the data protection authority where you live; in the United Kingdom, the Information Commissioner's Office; in New Zealand, the Office of the Privacy Commissioner; and in Canada, the Office of the Privacy Commissioner of Canada.

Children

Do GRC is for people aged 16 and over, and you confirm you are 16 or older when you sign up. We do not knowingly collect personal information from anyone younger; if we learn that we have, we will delete it.

Security

We protect your data with encryption in transit, row-level security on our database so that each account can reach only its own records, two-factor sign-in that you can turn on for your account, and restricted access to our production systems. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security. If a breach is likely to cause you serious harm, we will tell you, and the regulators the law requires us to tell, as soon as we can.

Changes to This Policy

We will post any change to this policy here and update the date at the top. If a change significantly affects how we use your personal information, we will also email you before it takes effect.

Contact

If you have questions or concerns about this Privacy Policy or your data, please contact our privacy contact, Hamish Dean, at hello@dogrc.com.