Last updated 8 October 2026
ScenarioLab runs cybersecurity scenarios for individuals learning on their own, for teams and educators, and for employers assessing candidates. This page explains what we keep, who can see it and for how long. We don't sell personal data or use it for advertising.
When you create an account we store your email address, whether it's an individual or a team/educator account, and — if you add them — your name and organisation. You sign in with a 6-digit code sent to your email; we never ask for or store a password. Signing in sets a session cookie that keeps you signed in; it isn't used for anything else.
Each time you complete a scenario we keep the choices you made at every step, any confidence ratings, your written answer, and your scores — overall and per skill. You can see all of your own attempts on your progress page.
If you join a team or class, its organiser can see the attempts you make after joining: every choice, your written answers and your scores. You're shown exactly this before you join. If you leave the team, it no longer sees your new attempts. An organiser may also hold back the results of an assignment until they release them.
For team and educator accounts we keep the team name, the email addresses invited, and the assignments created.
To try a free scenario or enter the competition you give an email address, which we use to send your result. We keep that email with your attempt (choices, written answer and score). The “notify me about new scenarios” box adds you to our updates list; every result email we send you while you're on it includes a one-click unsubscribe link.
Competition entries also ask for a display name. The leaderboard shows that name and your score — never your email.
If an employer invites you to an assessment, we use the email they invited to send you the link and a sign-in code. Once you verify, we remove that email from the invite and keep only a one-way hash of it and a masked form (such as jo•••@gmail.com), alongside the name you entered and the date you took the assessment, so the employer can see who completed it. Our email log still records that the invite and code were sent to your address. We don't keep your written answers to the assessment questions — only the scores and the evaluation report generated from them (for branching scenarios, the path of choices you took). Only the employer who invited you can see your results; there's no shared candidate profile across employers.
Subscriptions are handled by Stripe. Your card details go straight to Stripe and never reach ScenarioLab; we keep only Stripe's customer and subscription references and your plan status.
We record page visits (the page, time, browser type, referring site, and the country worked out from your IP address) to understand how the site is used, and key account events (such as sign-ups, subscriptions and completed scenarios) so we can support you and keep the service secure. We also keep a record of the emails we send you.
You can ask for a copy of your data, a correction, or deletion of your account and attempts at any time through our contact page or at hello@scenariolab.co. Use the unsubscribe link in any result email to leave the updates list.