Last updated: 18 October 2026
PlanProof designs and facilitates business continuity tabletop exercises for organizations in the UAE and wider GCC. This policy covers the website at plan-proof.com, the request forms on it, and the PlanProof exercise player — the join page and the screens used by participants, Observers, facilitators and room screens during an exercise. It does not cover third-party sites we link to.
We never tick a box for you. Every permission on our forms and screens starts unticked, and nothing optional happens unless you tick it yourself:
You can change your mind about any of these at any time by contacting us.
Depending on which form you use, we may collect:
We do not use cookies, analytics, or tracking scripts on this site. If that changes in the future, this policy will be updated to reflect it.
When you join an exercise through the PlanProof exercise player, we collect:
Voice notes. If you tap the microphone to dictate a note, the recording is sent to a speech-to-text service (Microsoft Azure Speech, or, if that is unavailable, your own browser's speech service, for example Google's or Apple's) only to turn it into text. The recording is not kept by us; only the text you check and log is saved.
On your device. The exercise player keeps your registration, any unsent drafts and a copy of your answers in your own browser's storage, so a reload or a dropped connection does not lose your work. This is not a cookie and is not used for tracking. The copy of your answers is removed from your device an hour after the exercise ends; your registration details stay in your browser until you clear its data.
We use exercise information only to run the exercise and to write its report. Findings in the report are presented at team level and describe roles and plans, never named individuals. Exercise information is held in the secure data storage service described below and is deleted after the exercise report is delivered, except the short exercise history if your organization opted in.
When you submit a form on this website, your submission, including any plan document you attach, is received by our website hosting provider and held there only until a copy has reached our business inbox through an email delivery service; any plan document you attach is then deleted from the hosting provider. Your contact details, form answers and the choices you ticked are also kept in a secure data storage service so we can keep track of inquiries and respond to them; any plan document you attach is not copied there. Submissions are held in private accounts accessible only to us; they are never published or made publicly accessible.
If you prefer not to use the forms, you can email us directly instead.
We do not use your information for advertising, and we do not sell or rent personal data to third parties.
Business continuity plans or organizational details you share with us are reviewed directly, one-to-one, and are never published or made publicly accessible. Materials are deleted after your exercise package is delivered unless you ask us to retain them. What we keep afterwards is limited to anonymised insights that cannot identify you and, only if you opted in, the short exercise history described under “Your exercise history” below. A mutual non-disclosure agreement is available on request before you share sensitive material.
We use a small number of service providers to run this business, who may process information on our behalf:
Some of these providers may process or store data on servers located outside the UAE. Each provider applies its own security measures to the data it handles for us.
You can ask us which providers we currently use by contacting us at the address below. Apart from these service providers, we do not share your information with third parties except where required by law.
Contact and inquiry information is kept for as long as needed to respond to you and, if you become a client, to deliver and support your engagement. If you opted in to marketing emails, we keep your email address for that purpose until you withdraw.
After your exercise package is delivered, we delete the materials you shared and the exercise information described above. Only if your organization opted in do we keep the short exercise history described below. We may retain anonymised, aggregated insights (for example, common gaps by sector) that cannot identify your organization or any individual, to improve future exercises.
So that your next exercise can build on the last one and show your progress, we can keep a short record of each exercise we deliver for your organization — but only if you tick “Yes, keep our exercise history” on the request form, or ask us to in writing. The record contains:
We do not keep your plan document, any files you attach, or the names and answers of exercise participants. These are deleted after delivery.
If you opt in, we keep this record for 5 years from your most recent exercise, then delete it. If you do not opt in, we keep none of it after delivery. You can ask us at any time to stop keeping it or to delete it.
The record is held in the secure data storage service described above, can be opened only by us with two-step sign-in, and is never shared. When someone contacts us about a previous exercise, we discuss it only with a known contact at your organization or someone writing from your organization's own email domain.
Depending on applicable law, including the UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, you may have the right to:
To exercise any of these, contact us using the details below.
This policy is governed by the laws of the United Arab Emirates.
We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent version.
For any privacy questions or requests, email us at exercises@plan-proof.com.
← Back to PlanProof