LAST REVISED:
May 6, 2026
This privacy notice for Cimento AI Inc. ("Cimento AI," "we," "us," or "our"), describes how and why we might collect, store, use, and/or share ("process") your information when you use our services ("Services"), such as when you:
Visit our website, or any website of ours that links to this privacy notice
Engage with us in other related ways ― including any advisory meetings, mentor sessions, sales, marketing, or events such as webinars
Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at contact@cimento.ai
SUMMARY OF KEY POINTS
What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with Cimento AI Inc. and the Services, the choices you make, and the products and features you use.
We may process sensitive personal information when necessary with your consent or as otherwise permitted by applicable law. This personal information is largely limited to your name, contact information (such as your email address and phone number), payment information, and information related to our Services.
We may receive information from public databases, marketing partners, social media platforms, and other outside sources.
How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so under applicable data protection laws, including consent, contractual necessity, legitimate interests, or legal obligations.
When do we share your information? We may share information in specific situations and with specific categories of third parties.
How do we keep your information safe? We have organizational and technical processes and procedures in place to protect your personal information. Personal data is collected, stored, and processed securely using encryption, access controls, and other industry-standard security measures. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information.
What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information.
The easiest way to exercise your rights is by sending a data subject request to contact@cimento.ai. We will consider and act upon any request in accordance with applicable data protection laws.
Want to learn more about what Cimento AI Inc. does with any information we collect? Review the notice in full below.
TABLE OF CONTENTS
1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
4. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
5. HOW LONG DO WE KEEP YOUR INFORMATION?
6. HOW DO WE KEEP YOUR INFORMATION SAFE?
7. DO WE COLLECT INFORMATION FROM MINORS?
8. WHAT ARE YOUR PRIVACY RIGHTS?
9. CONTROLS FOR DO-NOT-TRACK FEATURES
10. CIMENTO AI INC. AND STATE LAWS
11. DO WE MAKE UPDATES TO THIS NOTICE?
12. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
13. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?
14. EU REPRESENTATIVE
15. THIRD-PARTY INTEGRATIONS: SLACK
1. WHAT INFORMATION DO WE COLLECT?
We collect personal information that you voluntarily provide to us when you express an interest in our Services, such as learning about us or our Services,
Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:
Your first and last name
Your email address
Your phone number
Special Categories of Personal Data. We may process sensitive personal information when necessary with your consent or as otherwise permitted by applicable law. Under Article 9 of the GDPR, special categories of personal data we may collect include:
Information related to your professional training and security awareness (which may indirectly relate to your employment context)
Data you voluntarily provide in the course of using our Services
We only process such special category data based on:
Your explicit consent, or
As necessary for establishing, exercising, or defending legal claims, or
As otherwise permitted under applicable law
You have the right to withdraw your consent at any time by contacting us at contact@cimento.ai.
Payment Data. We may collect data necessary to process your payment if you make purchases, such as your payment instrument number (such as a credit card number), and the security code associated with your payment instrument. All payment data is stored by Stripe, Inc. You may find their privacy notice link(s) here: https://stripe.com/privacy. Stripe also covers instances where financing through Affirm or Klarna is used.
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.
Information automatically collected
In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.
We automatically collect certain information when you visit, use, or navigate our service. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.
The information we may collect includes:
Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called “crash dumps”), and hardware settings).
Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.
Location Data. We collect location data such as information about your device’s location, which can be either precise or imprecise. How much information we collect depends on the type and settings of the device you use to access the Services. For example, we may use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt out of allowing us to collect this information either by refusing access to the information or by disabling your Location setting on your device. However, if you choose to opt out, you may not be able to use certain aspects of the Services.
Cookies and Tracking Technologies. We use cookies and similar tracking technologies (such as web beacons and pixels) to access or store information. The types of technologies we use include:
Essential cookies: Required for the website to function properly
Analytics cookies: Help us understand how visitors interact with our Services
Functional cookies: Enable enhanced functionality and personalization
Marketing cookies: Used to track visitors across websites for marketing purposes
You can control cookie settings through your browser preferences. However, disabling certain cookies may affect your ability to use some features of our Services.
2. HOW DO WE PROCESS YOUR INFORMATION?
Legal Basis for Processing (GDPR Article 6)
We process your personal information based on the following lawful bases:
Consent: When you have given us explicit permission to process your information for specific purposes
Contract: When processing is necessary to fulfill our contractual obligations to you
Legitimate Interests: When we have a legitimate business interest that does not override your privacy rights (e.g., fraud prevention, network security, direct marketing to business contacts)
Legal Obligation: When we must process your information to comply with applicable laws and regulations
The specific legal basis we rely on depends on the purpose for which we process your data, as described below:
We process your personal information for a variety of reasons, depending on how you interact with our Services, including:
To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
To deliver and facilitate delivery of Services to the user. We may process your information to provide you with the requested service.
To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
To fulfill and manage your orders. We may process your information to fulfill and manage your orders, payments, returns, and exchanges made through the Services.
To enable user-to-user communications. We may process your information if you choose to use any of our offerings that allow for communication with another user.
To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.
To send you marketing and promotional communications. We may process the personal information you send to us for our marketing purposes, if this is in accordance with your marketing preferences. You can opt out of our marketing emails at any time.
To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them.
To determine the effectiveness of our marketing and promotional campaigns. We may process your information to better understand how to provide marketing and promotional campaigns that are most relevant to you.
To save or protect an individual’s vital interest. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.
Use of Artificial Intelligence Systems
Cimento AI Inc. utilizes artificial intelligence systems as part of our Services to deliver security awareness training and phishing simulations. When we process personal information through AI systems:
Personal data used to train or improve AI systems is anonymized or aggregated to prevent identification
AI-generated content and simulations are created based on anonymized patterns and do not rely on identifiable personal information
We implement appropriate safeguards to ensure AI processing complies with data protection principles
You have the right to object to automated decision-making that produces legal effects or similarly significantly affects you
For questions about how AI systems process your data, please contact us at contact@cimento.ai.
3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents (“third parties”) who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with our third parties, which are designed to help safeguard your personal information. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will also not share your personal information with any organization apart from us. They also commit to protect the data they hold on our behalf and to retain it for the period we instruct. The categories of third parties we may share personal information with are as follows:
Cloud Computing Services
Communication & Collaboration Tools
Data Analytics Services
Data Storage Service Providers
Finance & Accounting Tools
Government Entities
Order Fulfillment Service Providers
Payment Processors
Performance Monitoring Tools
Product Engineering & Design Tools
Retargeting Platforms
Sales & Marketing Tools
Testing Tools
User Account Registration & Authentication Services
Website Hosting Service Providers
Workplace Communication Platforms (such as Slack, where your organization's administrator has authorized a Cimento integration — see Section 15)
We also may need to share your personal information in the following situations:
Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
Business Partners. We may share your information with our business partners to offer you certain products, services, or promotions.
4. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
We operate and may process information in multiple jurisdictions, service providers, and other third parties may be located or process information outside of the jurisdiction in which you reside. In such cases, your information may be collected, used, disclosed, stored, and processed in these other jurisdictions for the purposes described in this privacy notice. The data protection and other laws of the United States might differ from your jurisdiction. In addition, your information may be subject to the laws of those other jurisdictions, including lawful requirements to disclose information to government authorities. We are committed to your privacy rights and if you want to know what we are doing to comply with rights that may be applicable to you, please contact us as the details set out below.
To the extent information including information from the EU and EEA is transferred outside of those jurisdictions by your use of the Services, we will adopt standard contractual clauses or other means pertaining to data protection approved in your country or region, and transfer the information to a third country according to the requirements of applicable laws.
5. HOW LONG DO WE KEEP YOUR INFORMATION?
We will only keep your information for as long as it is necessary to provide you with Services or for other purposes as described in this privacy notice, unless a longer retention period is required or permitted by law (such as tax, accounting or other legal requirements). Other than (a) information we are required to retain by law and (b) credentials and configuration data for active third-party integrations you have authorized (such as Slack), which are retained for as long as the integration remains connected and as described in the relevant integration section of this notice, no purpose in this privacy notice will require us keeping your information for longer than 1 year.
When we have no ongoing legitimate business need to process your information, we will either delete or anonymize such information, or, if this is not possible (for example, because your information has been stored in backup archives), then we will securely store your information and isolate it from any further processing until deletion is possible.
6. HOW DO WE KEEP YOUR INFORMATION SAFE?
We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process, including:
Technical Measures:
Encryption of data in transit and at rest
Secure authentication and access controls
Regular security testing and vulnerability assessments
Network security monitoring and intrusion detection
Secure data storage with redundancy and backup procedures
Organizational Measures:
Access to personal data is restricted to authorized personnel only on a need-to-know basis
Regular employee training on data protection and security practices
Incident response procedures and breach notification protocols
Vendor management and third-party security assessments
Regular reviews and updates of our security practices
Data used in AI systems is anonymized or aggregated to prevent identification where feasible.
Personal data is collected, stored, and processed securely in accordance with industry best practices and applicable data protection laws.
However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.
7. DO WE COLLECT INFORMATION FROM MINORS?
We do not knowingly solicit data from or market to children under 18 years of age. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent’s use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at contact@cimento.ai.
8. WHAT ARE YOUR PRIVACY RIGHTS?
Depending on your location, you may have the following rights regarding your personal information:
Right of Access: You have the right to request access to the personal information we hold about you and to receive information about how we process it.
Right to Rectification: You have the right to request that we correct any inaccurate or incomplete personal information we hold about you.
Right to Erasure ("Right to be Forgotten"): You have the right to request that we delete your personal information in certain circumstances, such as when it is no longer necessary for the purposes for which it was collected or when you withdraw consent.
Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal information in certain circumstances, such as while we verify the accuracy of the data or assess your objection to processing.
Right to Data Portability: You have the right to receive your personal information in a structured, commonly used, and machine-readable format and to transmit that data to another controller where technically feasible.
Right to Object: You have the right to object to our processing of your personal information based on legitimate interests, including for direct marketing purposes. We will cease processing unless we have compelling legitimate grounds that override your interests.
Right to Object to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you, unless such processing is necessary for contract performance, authorized by law, or based on your explicit consent.
Right to Withdraw Consent: Where we rely on your consent to process your personal information, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
How to Exercise Your Rights
Via Your Account Settings: If you have registered with our Services, you may have the ability to access and use certain features and functionality that provide you with the ability to set certain privacy, permissions, and account options. Please be aware that if you limit the collection of certain information, you may not be able to use all of the features and functionality of the Services.
Via Email: You may contact us by email at contact@cimento.ai. In your request, please specify clearly what information you would like to access, change, update, suppress, or delete, or which right you wish to exercise.
Additionally, you may opt-out of:
• Electronic Communications From Us: If you no longer want to receive marketing-related emails from us, you may opt-out by (a) contacting us via email, and/or (b) using the opt-out mechanism contained in each email. Please note that you may not opt-out of certain service notification emails.
• SMS messaging: You may terminate SMS messaging by replying "STOP".
• Third Party Marketing Purposes: You may request that we do not disclose your information with third parties for their direct marketing purposes by contacting us via email.
For any requests, we may request certain information to verify your identity. We will respond to your requests within the timeframes required by applicable law (typically within 30-45 days).
9. CONTROLS FOR DO-NOT-TRACK FEATURES
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy notice.
10. CIMENTO AI INC. AND STATE LAWS
Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (the “CCPA”), California residents have additional rights to what is set out in this privacy notice which impact how your information is being processed:
As described in this privacy notice, we collect various types of information about you in order to fulfill specific business purposes, including for performance of business operations, management and administration, and legal and regulatory compliance. We do not use your information for commercial purposes.
Subject to exceptions detailed in the CCPA, as a California resident, you have the right to request: (i) deletion of your information, (ii) correction of inaccurate information (iii) to know / access the categories of information that we collect about you, including the specific pieces of information; and (v) to know the categories of information disclosed for a business purpose.
Submitting a request
You may ask us to disclose certain information to you about our collection and use of your information over the past 12 months. Once we receive and confirm your identity as a user of our Service, we can disclose that information to you. You may also make a request to have that information erased or deleted.
You may make these requests by contacting us at the details set out below.
You may make a request for your information twice every twice every 12 months. If you are making an erasure request, it will help us if you include details of the information you would like erased. We may need to ask for additional information to fully identify you. If we can’t identify you, we may not be able to erase your information.
Please note that if you request that we remove your information, we may retain some of the information for specific reasons, such as to resolve disputes, troubleshoot problems, and as required by law.
Furthermore, some information is never completely removed from our databases due to technical constraints and the fact that we regularly back up our systems. Therefore, not all of your information will be completely removed from our databases.
We will respond to you on these requests as quickly as received your note but it may take us up to 45 days. If we need more time than that, we will let you know.
We will not discriminate against you for submitting a right request.
Virginia, Colorado, Connecticut or Utah Residents
As residents of the above-named states, you also have rights under each of the following laws:
The Virginia Consumer Data Privacy Act and any regulations, amendments and/or updates thereto;
The Colorado Data Privacy Act and any regulations, amendments and/or updates thereto;
The Connecticut Act Concerning Personal Data Privacy and Online Monitoring and any regulations, amendments and/or updates thereto; and
The Utah Consumer Privacy Act and any regulations, amendments and/or updates thereto,
As a user of our Services, you can request that we provide you information to:
Conduct and document data protection assessments about us;
Ask us to demonstrate our compliance with our obligations under each of the state laws above named (to the extent we have determined they are applicable);
Request that we implement appropriate technical and organizational measures and to assist you in the event of a data security and/or data breach notification.
11. DO WE MAKE UPDATES TO THIS NOTICE?
We may update this privacy notice from time to time. The updated version will be indicated by an updated “Revised” date and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy notice frequently to be informed of how we are protecting your information.
12. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
If you have questions or comments about this notice, you may contact us by email at contact@cimento.ai.
Right to Lodge a Complaint with Supervisory Authority
If you are located in the European Economic Area (EEA) or United Kingdom and believe that our processing of your personal information violates data protection laws, you have the right to lodge a complaint with your local supervisory authority.
If you remain dissatisfied with how we handle your personal information or our response to any requests you have made to us regarding the use of your personal information, you can make a complaint to the relevant data protection authority:
For EU/EEA residents: Contact your national data protection authority (a list is available at: https://edpb.europa.eu/about-edpb/board/members_en)
For UK residents: Information Commissioner's Office (ICO) - https://ico.org.uk
You may also contact our EU Representative listed in Section 14 of this privacy notice.
13. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?
You may request to review, update, or delete the personal information we hold about you at any time.
How to submit a request. Send an email to contact@cimento.ai with the subject line "Data Request." In your message, please tell us:
Which action you would like us to take (review, correction, deletion, or another right described in Section 8).
The information you would like us to act on, in as much detail as you can provide.
The email address or other identifier you used when interacting with our Services, so that we can locate your records.
Identity verification. Before we act on a request, we may ask you to confirm your identity using information we already hold about you. This is to prevent unauthorized access to or deletion of someone else's data.
Timing. We will acknowledge your request promptly and respond substantively within the timeframes required by applicable law, typically within 30–45 days. If your request is complex or we need more time, we will let you know within that window.
Limits on deletion. When you ask us to delete your information, we will remove it from our active systems. Some information may persist temporarily in encrypted backups (for up to the duration of our backup retention window) before becoming irrecoverable, and we may retain limited information where required by law, to resolve disputes, or to enforce our agreements.
Requests from employees of our customers. If you are an employee of a Cimento customer (for example, an organization that uses Cimento to deliver security awareness training to its workforce), Cimento generally acts as a processor on your employer's behalf for that data. We will forward your request to the appropriate administrator at your employer and assist them in fulfilling it. You may also contact your employer's privacy or IT team directly.
14. EU REPRESENTATIVE
Under Article 27 of the GDPR, we have appointed an EU Representative to act as our data protection agent in the European Union. Our nominated EU Representative is:
Instant EU GDPR Representative Ltd.
Contact: Adam Brogden
Email: contact@gdprlocal.com
Tel: +353 15549700
Address: Office 2, 12A Lower Main Street, Lucan Co. Dublin K78 X5P8, Ireland
If you are located in the EU or EEA, you may contact our EU Representative regarding data protection matters.
15. THIRD-PARTY INTEGRATIONS: SLACK
When a workspace administrator at your organization connects Cimento to Slack, we use Slack's OAuth 2.0 protocol to obtain limited access to the workspace solely for the purpose of delivering training-related notifications as direct messages. This section describes specifically how we handle data exchanged with Slack. It supplements, and does not replace, the rest of this notice.
OAuth scopes we request
We request only the minimum scopes required to deliver direct-message notifications:
chat:write — to send direct messages from the Cimento app.
im:write — to open a 1:1 direct-message conversation with a recipient before sending the first notification.
users:read — to look up workspace members.
users:read.email — to match Slack users to Cimento employees automatically by email address, so that administrators do not have to map users by hand.
We do not request scopes that would allow us to read messages in channels or direct messages, post to public channels, or access files, voice, huddles, or any Slack data beyond the four scopes listed above.
Slack data we store
When the integration is connected, we store the following in our encrypted multi-tenant database:
The OAuth access token, refresh token, and token expiry for the connection, encrypted at the application layer using a per-tenant key managed in AWS KMS, on top of database-level encryption at rest.
The Slack workspace ("team") identifier, the workspace name, and the user identifier of the Cimento bot user within that workspace.
The status of the integration (connected, error, or disconnected) and any associated error code or message.
We also store the notifications that Cimento itself sends through the Slack integration, including the rendered message content, the title, the recipient's email address, the sender, and the delivery status. These are stored in the same records used for notifications delivered through other channels (such as email or SMS).
Slack data we do not store
We do not receive or store the contents of any messages your users send within Slack — we never request the scopes that would allow that. We do not maintain a persistent mapping of Slack user identifiers to Cimento users; the Slack recipient identifier for each message is looked up at send time using the recipient's email address and is not retained in our database.
Subprocessors that handle Slack-related data
In addition to Slack itself, the following subprocessors may process data associated with the Slack integration:
Amazon Web Services, in the United States (region us-west-2): hosting our application services, encrypted database, encryption keys, message queues, and application logs.
Sentry: error monitoring; stack traces from Slack-related code paths may contain identifiers such as the workspace identifier, the integration identifier, or the recipient's email address.
Datadog: application performance monitoring; collects request traces and metrics but does not inspect message payloads.
Region
All Slack-linked data we store is held in Amazon Web Services infrastructure in the United States (region us-west-2).
Encryption
Slack OAuth tokens are encrypted at the application layer using AWS KMS-managed keys before being written to the database, and the underlying database storage is itself encrypted at rest. All connections to Slack's API use TLS in transit.
Retention and deletion
A workspace administrator can revoke Cimento's access to Slack at any time by removing the Cimento app from Slack's workspace settings ("Manage apps" → "Cimento" → "Remove app"). When this happens:
We immediately mark the integration as disconnected and stop using the credentials to call Slack on the workspace's behalf.
The encrypted OAuth credentials remain in our database, unusable, until the integration is explicitly deleted by an administrator within the Cimento product, or until we receive a deletion request to contact@cimento.ai.
On deletion, the integration record is removed from our primary database immediately. Encrypted copies may persist in our encrypted database backups for up to 7 days (our point-in-time-recovery window) before becoming irrecoverable.
Notifications already delivered through the Slack integration are retained according to your organization's standard retention configuration in Cimento, alongside notifications delivered through other channels.
If you would like Cimento to delete your Slack credentials and associated data without waiting for an administrator action in the Cimento product, you may contact us at contact@cimento.ai and we will process the deletion within the timeframes required by applicable law.
If access tokens are revoked at the Slack side without uninstalling the app, we may not be notified by Slack directly. We detect the revocation on the next attempt to send a notification or refresh the token, and at that point we mark the integration as requiring re-authentication and stop using the credentials.
Your relationship with Slack
Slack is the operator of your Slack workspace and remains the controller for the messages and metadata stored within Slack itself. Slack's privacy practices are governed by Slack's own privacy policy, available at https://slack.com/trust/privacy.
Contact
Questions or requests specific to the Slack integration may be directed to contact@cimento.ai. The general contact information in Section 12 of this notice also applies.
LAST REVISED:
May 6, 2026
This privacy notice for Cimento AI Inc. ("Cimento AI," "we," "us," or "our"), describes how and why we might collect, store, use, and/or share ("process") your information when you use our services ("Services"), such as when you:
Visit our website, or any website of ours that links to this privacy notice
Engage with us in other related ways ― including any advisory meetings, mentor sessions, sales, marketing, or events such as webinars
Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at contact@cimento.ai
SUMMARY OF KEY POINTS
What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with Cimento AI Inc. and the Services, the choices you make, and the products and features you use.
We may process sensitive personal information when necessary with your consent or as otherwise permitted by applicable law. This personal information is largely limited to your name, contact information (such as your email address and phone number), payment information, and information related to our Services.
We may receive information from public databases, marketing partners, social media platforms, and other outside sources.
How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so under applicable data protection laws, including consent, contractual necessity, legitimate interests, or legal obligations.
When do we share your information? We may share information in specific situations and with specific categories of third parties.
How do we keep your information safe? We have organizational and technical processes and procedures in place to protect your personal information. Personal data is collected, stored, and processed securely using encryption, access controls, and other industry-standard security measures. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information.
What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information.
The easiest way to exercise your rights is by sending a data subject request to contact@cimento.ai. We will consider and act upon any request in accordance with applicable data protection laws.
Want to learn more about what Cimento AI Inc. does with any information we collect? Review the notice in full below.
TABLE OF CONTENTS
1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
4. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
5. HOW LONG DO WE KEEP YOUR INFORMATION?
6. HOW DO WE KEEP YOUR INFORMATION SAFE?
7. DO WE COLLECT INFORMATION FROM MINORS?
8. WHAT ARE YOUR PRIVACY RIGHTS?
9. CONTROLS FOR DO-NOT-TRACK FEATURES
10. CIMENTO AI INC. AND STATE LAWS
11. DO WE MAKE UPDATES TO THIS NOTICE?
12. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
13. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?
14. EU REPRESENTATIVE
15. THIRD-PARTY INTEGRATIONS: SLACK
1. WHAT INFORMATION DO WE COLLECT?
We collect personal information that you voluntarily provide to us when you express an interest in our Services, such as learning about us or our Services,
Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:
Your first and last name
Your email address
Your phone number
Special Categories of Personal Data. We may process sensitive personal information when necessary with your consent or as otherwise permitted by applicable law. Under Article 9 of the GDPR, special categories of personal data we may collect include:
Information related to your professional training and security awareness (which may indirectly relate to your employment context)
Data you voluntarily provide in the course of using our Services
We only process such special category data based on:
Your explicit consent, or
As necessary for establishing, exercising, or defending legal claims, or
As otherwise permitted under applicable law
You have the right to withdraw your consent at any time by contacting us at contact@cimento.ai.
Payment Data. We may collect data necessary to process your payment if you make purchases, such as your payment instrument number (such as a credit card number), and the security code associated with your payment instrument. All payment data is stored by Stripe, Inc. You may find their privacy notice link(s) here: https://stripe.com/privacy. Stripe also covers instances where financing through Affirm or Klarna is used.
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.
Information automatically collected
In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.
We automatically collect certain information when you visit, use, or navigate our service. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.
The information we may collect includes:
Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called “crash dumps”), and hardware settings).
Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.
Location Data. We collect location data such as information about your device’s location, which can be either precise or imprecise. How much information we collect depends on the type and settings of the device you use to access the Services. For example, we may use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt out of allowing us to collect this information either by refusing access to the information or by disabling your Location setting on your device. However, if you choose to opt out, you may not be able to use certain aspects of the Services.
Cookies and Tracking Technologies. We use cookies and similar tracking technologies (such as web beacons and pixels) to access or store information. The types of technologies we use include:
Essential cookies: Required for the website to function properly
Analytics cookies: Help us understand how visitors interact with our Services
Functional cookies: Enable enhanced functionality and personalization
Marketing cookies: Used to track visitors across websites for marketing purposes
You can control cookie settings through your browser preferences. However, disabling certain cookies may affect your ability to use some features of our Services.
2. HOW DO WE PROCESS YOUR INFORMATION?
Legal Basis for Processing (GDPR Article 6)
We process your personal information based on the following lawful bases:
Consent: When you have given us explicit permission to process your information for specific purposes
Contract: When processing is necessary to fulfill our contractual obligations to you
Legitimate Interests: When we have a legitimate business interest that does not override your privacy rights (e.g., fraud prevention, network security, direct marketing to business contacts)
Legal Obligation: When we must process your information to comply with applicable laws and regulations
The specific legal basis we rely on depends on the purpose for which we process your data, as described below:
We process your personal information for a variety of reasons, depending on how you interact with our Services, including:
To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
To deliver and facilitate delivery of Services to the user. We may process your information to provide you with the requested service.
To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
To fulfill and manage your orders. We may process your information to fulfill and manage your orders, payments, returns, and exchanges made through the Services.
To enable user-to-user communications. We may process your information if you choose to use any of our offerings that allow for communication with another user.
To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.
To send you marketing and promotional communications. We may process the personal information you send to us for our marketing purposes, if this is in accordance with your marketing preferences. You can opt out of our marketing emails at any time.
To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them.
To determine the effectiveness of our marketing and promotional campaigns. We may process your information to better understand how to provide marketing and promotional campaigns that are most relevant to you.
To save or protect an individual’s vital interest. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.
Use of Artificial Intelligence Systems
Cimento AI Inc. utilizes artificial intelligence systems as part of our Services to deliver security awareness training and phishing simulations. When we process personal information through AI systems:
Personal data used to train or improve AI systems is anonymized or aggregated to prevent identification
AI-generated content and simulations are created based on anonymized patterns and do not rely on identifiable personal information
We implement appropriate safeguards to ensure AI processing complies with data protection principles
You have the right to object to automated decision-making that produces legal effects or similarly significantly affects you
For questions about how AI systems process your data, please contact us at contact@cimento.ai.
3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents (“third parties”) who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with our third parties, which are designed to help safeguard your personal information. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will also not share your personal information with any organization apart from us. They also commit to protect the data they hold on our behalf and to retain it for the period we instruct. The categories of third parties we may share personal information with are as follows:
Cloud Computing Services
Communication & Collaboration Tools
Data Analytics Services
Data Storage Service Providers
Finance & Accounting Tools
Government Entities
Order Fulfillment Service Providers
Payment Processors
Performance Monitoring Tools
Product Engineering & Design Tools
Retargeting Platforms
Sales & Marketing Tools
Testing Tools
User Account Registration & Authentication Services
Website Hosting Service Providers
Workplace Communication Platforms (such as Slack, where your organization's administrator has authorized a Cimento integration — see Section 15)
We also may need to share your personal information in the following situations:
Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
Business Partners. We may share your information with our business partners to offer you certain products, services, or promotions.
4. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
We operate and may process information in multiple jurisdictions, service providers, and other third parties may be located or process information outside of the jurisdiction in which you reside. In such cases, your information may be collected, used, disclosed, stored, and processed in these other jurisdictions for the purposes described in this privacy notice. The data protection and other laws of the United States might differ from your jurisdiction. In addition, your information may be subject to the laws of those other jurisdictions, including lawful requirements to disclose information to government authorities. We are committed to your privacy rights and if you want to know what we are doing to comply with rights that may be applicable to you, please contact us as the details set out below.
To the extent information including information from the EU and EEA is transferred outside of those jurisdictions by your use of the Services, we will adopt standard contractual clauses or other means pertaining to data protection approved in your country or region, and transfer the information to a third country according to the requirements of applicable laws.
5. HOW LONG DO WE KEEP YOUR INFORMATION?
We will only keep your information for as long as it is necessary to provide you with Services or for other purposes as described in this privacy notice, unless a longer retention period is required or permitted by law (such as tax, accounting or other legal requirements). Other than (a) information we are required to retain by law and (b) credentials and configuration data for active third-party integrations you have authorized (such as Slack), which are retained for as long as the integration remains connected and as described in the relevant integration section of this notice, no purpose in this privacy notice will require us keeping your information for longer than 1 year.
When we have no ongoing legitimate business need to process your information, we will either delete or anonymize such information, or, if this is not possible (for example, because your information has been stored in backup archives), then we will securely store your information and isolate it from any further processing until deletion is possible.
6. HOW DO WE KEEP YOUR INFORMATION SAFE?
We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process, including:
Technical Measures:
Encryption of data in transit and at rest
Secure authentication and access controls
Regular security testing and vulnerability assessments
Network security monitoring and intrusion detection
Secure data storage with redundancy and backup procedures
Organizational Measures:
Access to personal data is restricted to authorized personnel only on a need-to-know basis
Regular employee training on data protection and security practices
Incident response procedures and breach notification protocols
Vendor management and third-party security assessments
Regular reviews and updates of our security practices
Data used in AI systems is anonymized or aggregated to prevent identification where feasible.
Personal data is collected, stored, and processed securely in accordance with industry best practices and applicable data protection laws.
However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.
7. DO WE COLLECT INFORMATION FROM MINORS?
We do not knowingly solicit data from or market to children under 18 years of age. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent’s use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at contact@cimento.ai.
8. WHAT ARE YOUR PRIVACY RIGHTS?
Depending on your location, you may have the following rights regarding your personal information:
Right of Access: You have the right to request access to the personal information we hold about you and to receive information about how we process it.
Right to Rectification: You have the right to request that we correct any inaccurate or incomplete personal information we hold about you.
Right to Erasure ("Right to be Forgotten"): You have the right to request that we delete your personal information in certain circumstances, such as when it is no longer necessary for the purposes for which it was collected or when you withdraw consent.
Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal information in certain circumstances, such as while we verify the accuracy of the data or assess your objection to processing.
Right to Data Portability: You have the right to receive your personal information in a structured, commonly used, and machine-readable format and to transmit that data to another controller where technically feasible.
Right to Object: You have the right to object to our processing of your personal information based on legitimate interests, including for direct marketing purposes. We will cease processing unless we have compelling legitimate grounds that override your interests.
Right to Object to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you, unless such processing is necessary for contract performance, authorized by law, or based on your explicit consent.
Right to Withdraw Consent: Where we rely on your consent to process your personal information, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
How to Exercise Your Rights
Via Your Account Settings: If you have registered with our Services, you may have the ability to access and use certain features and functionality that provide you with the ability to set certain privacy, permissions, and account options. Please be aware that if you limit the collection of certain information, you may not be able to use all of the features and functionality of the Services.
Via Email: You may contact us by email at contact@cimento.ai. In your request, please specify clearly what information you would like to access, change, update, suppress, or delete, or which right you wish to exercise.
Additionally, you may opt-out of:
• Electronic Communications From Us: If you no longer want to receive marketing-related emails from us, you may opt-out by (a) contacting us via email, and/or (b) using the opt-out mechanism contained in each email. Please note that you may not opt-out of certain service notification emails.
• SMS messaging: You may terminate SMS messaging by replying "STOP".
• Third Party Marketing Purposes: You may request that we do not disclose your information with third parties for their direct marketing purposes by contacting us via email.
For any requests, we may request certain information to verify your identity. We will respond to your requests within the timeframes required by applicable law (typically within 30-45 days).
9. CONTROLS FOR DO-NOT-TRACK FEATURES
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy notice.
10. CIMENTO AI INC. AND STATE LAWS
Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (the “CCPA”), California residents have additional rights to what is set out in this privacy notice which impact how your information is being processed:
As described in this privacy notice, we collect various types of information about you in order to fulfill specific business purposes, including for performance of business operations, management and administration, and legal and regulatory compliance. We do not use your information for commercial purposes.
Subject to exceptions detailed in the CCPA, as a California resident, you have the right to request: (i) deletion of your information, (ii) correction of inaccurate information (iii) to know / access the categories of information that we collect about you, including the specific pieces of information; and (v) to know the categories of information disclosed for a business purpose.
Submitting a request
You may ask us to disclose certain information to you about our collection and use of your information over the past 12 months. Once we receive and confirm your identity as a user of our Service, we can disclose that information to you. You may also make a request to have that information erased or deleted.
You may make these requests by contacting us at the details set out below.
You may make a request for your information twice every twice every 12 months. If you are making an erasure request, it will help us if you include details of the information you would like erased. We may need to ask for additional information to fully identify you. If we can’t identify you, we may not be able to erase your information.
Please note that if you request that we remove your information, we may retain some of the information for specific reasons, such as to resolve disputes, troubleshoot problems, and as required by law.
Furthermore, some information is never completely removed from our databases due to technical constraints and the fact that we regularly back up our systems. Therefore, not all of your information will be completely removed from our databases.
We will respond to you on these requests as quickly as received your note but it may take us up to 45 days. If we need more time than that, we will let you know.
We will not discriminate against you for submitting a right request.
Virginia, Colorado, Connecticut or Utah Residents
As residents of the above-named states, you also have rights under each of the following laws:
The Virginia Consumer Data Privacy Act and any regulations, amendments and/or updates thereto;
The Colorado Data Privacy Act and any regulations, amendments and/or updates thereto;
The Connecticut Act Concerning Personal Data Privacy and Online Monitoring and any regulations, amendments and/or updates thereto; and
The Utah Consumer Privacy Act and any regulations, amendments and/or updates thereto,
As a user of our Services, you can request that we provide you information to:
Conduct and document data protection assessments about us;
Ask us to demonstrate our compliance with our obligations under each of the state laws above named (to the extent we have determined they are applicable);
Request that we implement appropriate technical and organizational measures and to assist you in the event of a data security and/or data breach notification.
11. DO WE MAKE UPDATES TO THIS NOTICE?
We may update this privacy notice from time to time. The updated version will be indicated by an updated “Revised” date and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy notice frequently to be informed of how we are protecting your information.
12. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
If you have questions or comments about this notice, you may contact us by email at contact@cimento.ai.
Right to Lodge a Complaint with Supervisory Authority
If you are located in the European Economic Area (EEA) or United Kingdom and believe that our processing of your personal information violates data protection laws, you have the right to lodge a complaint with your local supervisory authority.
If you remain dissatisfied with how we handle your personal information or our response to any requests you have made to us regarding the use of your personal information, you can make a complaint to the relevant data protection authority:
For EU/EEA residents: Contact your national data protection authority (a list is available at: https://edpb.europa.eu/about-edpb/board/members_en)
For UK residents: Information Commissioner's Office (ICO) - https://ico.org.uk
You may also contact our EU Representative listed in Section 14 of this privacy notice.
13. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?
You may request to review, update, or delete the personal information we hold about you at any time.
How to submit a request. Send an email to contact@cimento.ai with the subject line "Data Request." In your message, please tell us:
Which action you would like us to take (review, correction, deletion, or another right described in Section 8).
The information you would like us to act on, in as much detail as you can provide.
The email address or other identifier you used when interacting with our Services, so that we can locate your records.
Identity verification. Before we act on a request, we may ask you to confirm your identity using information we already hold about you. This is to prevent unauthorized access to or deletion of someone else's data.
Timing. We will acknowledge your request promptly and respond substantively within the timeframes required by applicable law, typically within 30–45 days. If your request is complex or we need more time, we will let you know within that window.
Limits on deletion. When you ask us to delete your information, we will remove it from our active systems. Some information may persist temporarily in encrypted backups (for up to the duration of our backup retention window) before becoming irrecoverable, and we may retain limited information where required by law, to resolve disputes, or to enforce our agreements.
Requests from employees of our customers. If you are an employee of a Cimento customer (for example, an organization that uses Cimento to deliver security awareness training to its workforce), Cimento generally acts as a processor on your employer's behalf for that data. We will forward your request to the appropriate administrator at your employer and assist them in fulfilling it. You may also contact your employer's privacy or IT team directly.
14. EU REPRESENTATIVE
Under Article 27 of the GDPR, we have appointed an EU Representative to act as our data protection agent in the European Union. Our nominated EU Representative is:
Instant EU GDPR Representative Ltd.
Contact: Adam Brogden
Email: contact@gdprlocal.com
Tel: +353 15549700
Address: Office 2, 12A Lower Main Street, Lucan Co. Dublin K78 X5P8, Ireland
If you are located in the EU or EEA, you may contact our EU Representative regarding data protection matters.
15. THIRD-PARTY INTEGRATIONS: SLACK
When a workspace administrator at your organization connects Cimento to Slack, we use Slack's OAuth 2.0 protocol to obtain limited access to the workspace solely for the purpose of delivering training-related notifications as direct messages. This section describes specifically how we handle data exchanged with Slack. It supplements, and does not replace, the rest of this notice.
OAuth scopes we request
We request only the minimum scopes required to deliver direct-message notifications:
chat:write — to send direct messages from the Cimento app.
im:write — to open a 1:1 direct-message conversation with a recipient before sending the first notification.
users:read — to look up workspace members.
users:read.email — to match Slack users to Cimento employees automatically by email address, so that administrators do not have to map users by hand.
We do not request scopes that would allow us to read messages in channels or direct messages, post to public channels, or access files, voice, huddles, or any Slack data beyond the four scopes listed above.
Slack data we store
When the integration is connected, we store the following in our encrypted multi-tenant database:
The OAuth access token, refresh token, and token expiry for the connection, encrypted at the application layer using a per-tenant key managed in AWS KMS, on top of database-level encryption at rest.
The Slack workspace ("team") identifier, the workspace name, and the user identifier of the Cimento bot user within that workspace.
The status of the integration (connected, error, or disconnected) and any associated error code or message.
We also store the notifications that Cimento itself sends through the Slack integration, including the rendered message content, the title, the recipient's email address, the sender, and the delivery status. These are stored in the same records used for notifications delivered through other channels (such as email or SMS).
Slack data we do not store
We do not receive or store the contents of any messages your users send within Slack — we never request the scopes that would allow that. We do not maintain a persistent mapping of Slack user identifiers to Cimento users; the Slack recipient identifier for each message is looked up at send time using the recipient's email address and is not retained in our database.
Subprocessors that handle Slack-related data
In addition to Slack itself, the following subprocessors may process data associated with the Slack integration:
Amazon Web Services, in the United States (region us-west-2): hosting our application services, encrypted database, encryption keys, message queues, and application logs.
Sentry: error monitoring; stack traces from Slack-related code paths may contain identifiers such as the workspace identifier, the integration identifier, or the recipient's email address.
Datadog: application performance monitoring; collects request traces and metrics but does not inspect message payloads.
Region
All Slack-linked data we store is held in Amazon Web Services infrastructure in the United States (region us-west-2).
Encryption
Slack OAuth tokens are encrypted at the application layer using AWS KMS-managed keys before being written to the database, and the underlying database storage is itself encrypted at rest. All connections to Slack's API use TLS in transit.
Retention and deletion
A workspace administrator can revoke Cimento's access to Slack at any time by removing the Cimento app from Slack's workspace settings ("Manage apps" → "Cimento" → "Remove app"). When this happens:
We immediately mark the integration as disconnected and stop using the credentials to call Slack on the workspace's behalf.
The encrypted OAuth credentials remain in our database, unusable, until the integration is explicitly deleted by an administrator within the Cimento product, or until we receive a deletion request to contact@cimento.ai.
On deletion, the integration record is removed from our primary database immediately. Encrypted copies may persist in our encrypted database backups for up to 7 days (our point-in-time-recovery window) before becoming irrecoverable.
Notifications already delivered through the Slack integration are retained according to your organization's standard retention configuration in Cimento, alongside notifications delivered through other channels.
If you would like Cimento to delete your Slack credentials and associated data without waiting for an administrator action in the Cimento product, you may contact us at contact@cimento.ai and we will process the deletion within the timeframes required by applicable law.
If access tokens are revoked at the Slack side without uninstalling the app, we may not be notified by Slack directly. We detect the revocation on the next attempt to send a notification or refresh the token, and at that point we mark the integration as requiring re-authentication and stop using the credentials.
Your relationship with Slack
Slack is the operator of your Slack workspace and remains the controller for the messages and metadata stored within Slack itself. Slack's privacy practices are governed by Slack's own privacy policy, available at https://slack.com/trust/privacy.
Contact
Questions or requests specific to the Slack integration may be directed to contact@cimento.ai. The general contact information in Section 12 of this notice also applies.
Get Started
See It Live
Explore how modern phishing simulations and real-time human risk insights can strengthen your security posture. Let’s talk.
Get Started
See It Live
Explore how modern phishing simulations and real-time human risk insights can strengthen your security posture. Let’s talk.
Get Started
See It Live
Explore how modern phishing simulations and real-time human risk insights can strengthen your security posture. Let’s talk.
Get Started
See It Live
Explore how modern phishing simulations and real-time human risk insights can strengthen your security posture. Let’s talk.