Privacy Policy

Last updated: 2026-07-26

This Privacy Policy describes how O'Shea & Sons, LLC ("we", "us", or "our") collects, uses, and shares information when you use ControlDrill (the "Service"), including controldrill.com, session.controldrill.com, exercise rooms, and evidence packets.

Questions or privacy requests (including deletion): hello@controldrill.com.

1. Roles: controller and processor

Account and billing data (you as our customer contact). For your buyer account, authentication, and payment metadata, we act as a controller of that business-contact data.
Uploaded plans, exercise content, and participant details you provide. For incident-response / BCDR plan text and documents you upload, exercise decisions and transcripts, and participant names, roles, and emails you supply, you are the controller and O'Shea & Sons, LLC is the processor. We process that data only to provide the Service under our Data Processing Agreement.

2. Information we collect

Account and identity data. Name, email address, and authentication identifiers used when you sign in to buy or manage exercises (for example Google sign-in).
Billing data. Purchase status, customer and payment identifiers, and payment metadata. Card numbers are handled by Stripe; we do not store full card numbers on our servers.
Uploaded documents and plan text. Optional IR/BCDR plans, playbooks, or free-text context you paste or upload to tailor an exercise.
Exercise configuration and stack context. Company name, stack description, frameworks you select as context, schedule, and similar setup fields.
Participant data. Names, roles, and email addresses you provide so we can issue magic-link invitations and attribute decisions in the room.
Exercise decisions and transcript. Timed injects, messages, decisions, owners, timestamps, engagement signals, and related session state used to run the exercise and build the evidence packet.
Technical and usage data. IP address, user agent, request paths, and similar logs needed to operate, secure, and debug the Service.
Communications. Messages you send to support (for example via hello@controldrill.com).

3. How we use information

Authenticate buyers and manage purchases
Process one-time payments and prevent fraud
Tailor scenarios to your context using baseline intake and any plan text you provide
Run the facilitated exercise (magic-link access, injects, decision capture)
Produce and deliver the evidence packet
Respond to support and legal requests
Secure the Service and investigate abuse

Uploaded plans and exercise content are used only to tailor and run your exercises and to produce your packet. We do not sell personal information. We do not use customer content to train models.

4. Subprocessors

We use the following subprocessors to operate ControlDrill. This is the complete current disclosed list for the Service:

Cloudflare - hosting and infrastructure (Workers, Durable Objects, D1, R2 storage), DNS/CDN, and Cloudflare Workers AI for document-to-text conversion of uploaded plans and for tailoring inference (uploaded documents, extracted plan text, and tailoring stay on Cloudflare; there is no external LLM subprocessor)
Stripe - payment processing for one-time exercise purchases
WorkOS - buyer authentication and account sign-in (identity for the purchasing account)

These providers process data on our behalf under their terms and data-processing arrangements. They may process data in the United States and other countries where they operate.

5. Sharing

We share information with the subprocessors above as needed to run the Service, when required by law, to protect rights and safety, or with your direction (for example delivering magic links to participants you invite). We do not sell personal information.

6. Retention

Uploaded documents and extracted plan corpus: retained for up to 12 months from upload under our stated retention policy, or deleted earlier on request (including via in-product delete controls where available). The retention window is stated at upload.

Exercise records, transcripts, decisions, and evidence packets: retained while needed to provide the Service for your purchase and account, and as reasonably needed for support, security, and legal obligations, unless you request deletion sooner where feasible.

Account and billing records: retained as long as your account relationship is active and as needed for tax, fraud prevention, and dispute purposes.

Support emails: retained as reasonably needed to help you.

7. Deletion and access requests

You may request deletion or export of personal data and customer content we hold by emailing hello@controldrill.com from the address on your account (or describing the purchase sufficiently for us to locate it). For uploaded plans, in-product delete controls remove R2 originals and the extracted corpus for that purchase when available.

We will respond within a reasonable period and as required by applicable law. We may retain limited information where legally required (for example tax or fraud records) or where data has been de-identified so it no longer identifies a person.

Data subjects of participant records should generally exercise rights with you (the controller); we will assist as processor under the DPA.

8. Cookies and similar technologies

We and our processors may use cookies or similar technologies for authentication, security, and session continuity. You can control cookies through your browser settings; some features may not work without them.

9. Security

We use reasonable technical and organizational measures appropriate to a small SaaS product on Cloudflare's edge platform to protect information (including encrypted transport, access controls, and storage of uploaded plans in Cloudflare R2). No method of transmission or storage is completely secure; we cannot guarantee absolute security. We do not claim SOC 2, ISO, or similar certifications we do not hold.

10. Children

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16.

11. International transfers

If you or your participants access the Service from outside the United States, information may be processed in the United States and other countries where we or our subprocessors operate.

12. Changes

We may update this Privacy Policy. The "Last updated" date will change when we do. Continued use after the effective date means you accept the updated policy.

13. Governing law

This Privacy Policy is governed by the laws of the State of Illinois, USA, without regard to conflict-of-law rules, except where mandatory privacy protections of your residence apply.

14. Contact

O'Shea & Sons, LLC
Email: hello@controldrill.com
Website: https://controldrill.com/