Privacy
Privacy policy
Our clients hand us their incident response plans and then discuss, out loud, the worst day their organisation has had or might have. This page says what happens to that.
Who we are
MyTabletops, operating from Ontario, Canada. We build and facilitate cybersecurity tabletop exercises and write the reports that follow them.
For anything about this policy, about the information we hold on you, or to have it corrected or deleted, write to [email protected]. That mailbox is the accountability point for privacy at MyTabletops and it is monitored. You will get a reply within one business day.
We do not currently publish a street address. If you need one for a formal request, ask at that address and we will provide it directly.
What we collect, and why
If you download something
One work email address. No name, no company, no phone number, no job title. We use it to send you the document you asked for and, occasionally, to tell you when a related one is ready. Every email we send has a working unsubscribe. Use it and we stop, permanently.
If you book a call
Booking runs on cal.com, which collects your name, email and the time you chose, plus anything you type into the notes field. We keep those notes because they are usually the context for the call.
If you become a client
This is the sensitive part, so it gets the most detail. During an engagement we may receive your incident response plan, business continuity documentation, crisis communications procedures and contact lists. During the session we hear what your leadership team says under pressure. Afterwards we hold the report, the attestation and our own working notes.
- You decide what we see before we see it. If a document is too sensitive to share, tell us and we will work from a summary.
- We do not reuse your scenario with another client.
- We do not use your exercise material to train public AI models.
- We do not name you as a client, anywhere, without your written permission. That includes logos, case studies and passing mentions on a sales call.
- Any anonymised observation we publish is stripped of anything identifying: no sector plus size plus region combination that narrows to one organisation.
If you just read the site
We use Ahrefs Web Analytics and Cloudflare Web Analytics. Both are cookieless. Neither one sets a cookie, writes to your browser storage, fingerprints you or follows you to other websites. They tell us which pages get read. They do not tell us who you are. This is why the site has no cookie banner: there is nothing to consent to.
Who else can see it
Only the services that make the site work. We do not sell personal information, we do not share it for advertising, and we run no advertising pixels.
| Service | What it handles |
|---|---|
| Cloudflare | Hosting, and cookieless site analytics |
| Ahrefs | Cookieless site analytics |
| Web3Forms | Processes the download forms and passes us the email address |
| cal.com | Scheduling and calendar bookings |
| Google Workspace | Our email, so anything you write to us sits there |
We would disclose information if the law required it. If that ever happens and we are permitted to tell you, we will.
How long we keep it
| What | How long |
|---|---|
| Download and enquiry email addresses | Until you unsubscribe or ask us to delete, reviewed annually |
| Client engagement material, including your plans and our notes | Two years after the engagement ends, then deleted |
| The after-action report and attestation | Seven years, because you may need us to reissue or defend it to a carrier long after the fact |
Ask us to delete any of it earlier and we will, except where we are required to keep it. We will tell you which category applies rather than refusing without a reason.
Your rights
Under Canadian federal privacy law you can ask what we hold about you, ask us to correct it, and withdraw consent to further contact. Write to [email protected] and we will respond within thirty days.
If you are not satisfied with how we handle it, you can complain to the Office of the Privacy Commissioner of Canada. We would rather you told us first, but you do not have to.
Security
Client material is held in access-controlled storage limited to the people working on your engagement. The site is served over HTTPS. We are not going to claim more than that, because a detailed list of our controls in public is itself a security problem, and because a company that tests other people's incident response should not overstate its own.
Changes
If this policy changes materially we will update the date at the top and, where it affects information we already hold about you, tell you directly rather than relying on you re-reading a web page.