Privacy

Necessary cookies support sign-in, sign-in security and the isolated demo session. Optional usage analytics remain off until Accept cookies is selected or the preference is enabled and saved in Cookie settings. Reject optional leaves sign-in and product features available. Closing settings or continuing to browse is not acceptance. The app does not use advertising cookies.

Cookie settings in Help and the footer provide access to the current preferences and controls to change them. The browser stores the choice, notice version and decision time for 180 days. Expiry, a changed notice version, or cleared site data asks for a new choice. Rejecting optional analytics stops future events and clears the optional usage identifiers; it does not erase previously collected events before their retention expires.

• wos-session: necessary signed-in session cookie; cleared on sign-out, with session validity checked by the authentication service.
• wos-auth-state and wos-auth-return: necessary sign-in security and return-path cookies; expire after 10 minutes and are cleared when the sign-in callback is handled.
• spp_m22_demo: necessary cookie for the isolated demo workspace, renewed during use and expiring after 24 hours of inactivity.
• security-program-planner.privacy-preferences: browser-local choice, notice version and decision time; valid for 180 days.
• security-program-planner.product-usage-session and security-program-planner.product-creation-attempt: optional tab storage, created only after analytics acceptance and cleared on rejection. Browser privacy signals override acceptance.

Registration and sign-in identify the individual account. Editable Programs, Report editions, and Conversations are stored in the signed-in account or selected organization workspace and are returned only after authorization for that scope is verified.

Interface preferences and share revocation keys are stored in the current browser profile. They remain available only while that site data remains intact and do not grant access to organization programs.

After optional usage analytics are accepted, the product records only defined route, creation-stage, completion, export, and bounded error or recovery categories. A random tab-session identifier and short-lived creation-attempt identifier are sent to the same-origin event endpoint; only their SHA-256 digests are stored. Program content, titles, saved identifiers, entered values, filenames, messages, query strings, IP addresses, and user-agent strings are excluded from the product-use event table.

• Global Privacy Control and Do Not Track suppress passive product-use collection.
• A five-minute cleanup cycle deletes raw event rows once they are older than 90 days; the public Usage page returns 30-day aggregates only.
• A tab session is not a person, account, device, or unique visitor, and valid automated traffic can affect counts. Separate abuse counters use a daily keyed digest of the trusted network address, expire after 48 hours, and contain no raw address. Anonymous feedback uses Cloudflare Turnstile verification. Verification tokens are not retained in feedback records.

Cancellation and recommendation questions are optional and are sent to the same-origin feedback endpoint only after the user selects Submit. A cancellation response contains one fixed reason and can include up to 180 characters when Other is selected. A completion response contains a 0–10 recommendation score. The response also contains a fixed program-family label, a random tab-session digest, a timestamp, and the product release version. It does not contain a saved program title or identifier.

• Raw first-party feedback rows are deleted after 90 days.
• Cancellation details are never returned on the public Usage page.
• Recommendation results appear only as bounded aggregates with response volume.

After a successfully submitted recommendation score of 9 or 10, AI Security Planner can offer a separate public SurveyMonkey link. The link contains no NPS score, program family, program identifier, account value, custom variable, query, fragment, or referrer from AI Security Planner. Anything a respondent enters is submitted directly to SurveyMonkey, which may process service metadata such as IP addresses under its collector settings and policies. AI Security Planner does not control SurveyMonkey retention.

• The detailed survey remains optional and opens only after a separate user action.
• A scheduled hourly check retrieves only the collector response total. Usage shows the count and freshness separately from owner-reviewed answer totals and permitted quotations.
• Approved public aggregates and quotes are versioned with the product until a later reviewed release removes them.

Program Share stores a separate, sanitized snapshot. Conversations and reporting history are excluded. The link expires after 30 days. Its separate revocation key is kept in the creating browser profile; clearing that profile can remove the key. Revocation removes the shared payload, and expiry ends access and removes the payload through the share cleanup path. Limited lifecycle records remain for the configured retention period. The editable Program is a separate record.

Report Share grants read-only access to one saved edition. The sender chooses a 1-, 7- or 30-day expiry and the allowed PDF and PowerPoint downloads. The server stores the share controls and a digest of its secret token; shared requests must still pass the edition and source-access checks. An authorized Report custodian can revoke the link. Expiry or revocation ends link access but does not by itself delete the Report definition, retained edition or its private visual artifacts. Report and account removal follow their own authorized deletion rules. A revoked or expired link cannot recall files already downloaded.

Imported JSON files are validated and processed in the browser. Downloaded JSON, CSV, Markdown, PNG, PDF, and PowerPoint files leave browser storage only through an explicit action. After export, handling is controlled by the selected device location or application.

The hosting, delivery, and security platform processes ordinary web-request metadata outside the product-use event table. Documentation, inspectors, Specs, and Design may link to public standards or references; opening one sends the usual browser request to that third-party site under its own privacy terms.

Browser site-data controls can remove interface preferences and local share-revocation keys, but not organization programs. Program, organization, and account deletion use their explicit authorized product actions and confirmation boundaries.