Who we are
CheckmateAI is operated by Libre Group LLC, a Maryland limited liability company (SDAT N623800473), registered agent address 306 W Redwood St STE 200, Baltimore, MD 21201, USA ("CheckmateAI", "we"). We are the controller for personal data processed through this website and in our sales process, and the processor for personal data our customers submit to the CheckmateAI platform under their agreement with us. Contact: privacy@checkmateapp.ai.
Data we collect
(a) Website and demo requests: name, business email, company, role, and any message you send us when you request a demo by email; technical data in server logs (IP address, user agent, timestamps) processed for security and operation. This website sets no analytics or advertising cookies. (b) Platform data (on behalf of customers): account data (name, work email, role, tenant), exercise content (scenarios, injects, participant decisions, chat messages, evaluations, after-action reports), and append-only audit records of exercise activity.
Purposes and legal bases (GDPR Art. 6)
Providing and securing the service and responding to demo requests — performance of a contract or steps prior to one (6(1)(b)); service security, defence of legal claims, and reasonable B2B follow-up to your enquiry — legitimate interests (6(1)(f)); any optional cookies or marketing we may introduce — consent (6(1)(a)), asked for first.
AI processing
The platform uses large-language-model services to generate and evaluate exercise content. To generate realistic scenarios, the organisation profile a customer enters — such as organisation name, domains, key systems, key vendors and locations — and the text participants type during an exercise are sent to our AI sub-processor, Anthropic, in the United States. Participant identities are not sent. Anthropic’s commercial terms prohibit training models on this content. AI-generated injects are reviewed by a human facilitator before delivery to participants.
Sub-processors and recipients
Hosting and database: Railway (EU — Amsterdam). Edge security, TLS, web hosting and inbound email routing: Cloudflare. Identity and sign-in: Microsoft Entra ID. AI inference: Anthropic (United States). Email mailbox: Google Workspace. We do not sell personal data and do not share it for third-party advertising.
International transfers
Transfers to sub-processors outside the EEA, including Anthropic in the United States, rely on the recipient’s EU–US Data Privacy Framework certification where it applies and otherwise on the EU Standard Contractual Clauses, with supplementary measures where required.
Retention
Sales and website data: as long as needed for the enquiry and up to 24 months after our last contact. Platform data: for the duration of the customer agreement and as instructed in the Data Processing Agreement. Certain exercise and audit records are maintained in append-only form to evidence regulatory exercising obligations; where erasure applies, personal data is deleted or irreversibly de-identified except where retention is required by law.
Your rights
Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests. Write to gdpr@checkmateapp.ai. You may lodge a complaint with the data protection supervisory authority in your country of residence. EU representative (Article 27 GDPR): being appointed. Until then, individuals and authorities in the EU may contact gdpr@checkmateapp.ai. If you are a platform participant, your organisation is the controller of your exercise data — direct requests to it and we will support them under the DPA.
Security
Tenant isolation at the database layer, encryption in transit, least-privilege access, EU hosting, and blocking security gates in our release pipeline. Report vulnerabilities to security@checkmateapp.ai.
Children
The service is for business use and not directed at anyone under 18.
Changes
We will post updates here with a revised date; material changes affecting customers are notified under the agreement.