Privacy Policy

Last updated: October 24, 2026

1. Who we are

RMF GRC AI (the "Service", at rmfgrc.ai) is an online training application that lets you practice the work of an Information System Security Officer on simulated systems using the NIST Risk Management Framework. It is created and operated by 1teamyb LLC, doing business as ConvoCourses ("we", "our", "us"). This policy explains what information we collect, how we use and share it, how long we keep it, and the choices you have.

2. Information we collect

• Account information. When you sign up with an email address, we collect that address and the password you choose (stored only as a secure hash by our authentication provider). When you sign in with Google, we receive your name, email address and profile picture from your Google account.
• Your callsign and profile. The callsign and any profile details you choose to add.
• Work you do in the Service. The simulated systems, records, answers, points and portfolio items you create while you train.
• Reports and feedback. Messages you send us, survey answers, and problem reports. A problem report can include a screenshot of the screen you were on, taken only when you choose to send one.
• Usage information. Which screens you open and which lesson steps you complete, collected through Google Analytics (see section 5). If the app crashes, technical details about the error.
• Payment information. If you buy a plan, payment is handled by Stripe or PayPal. We receive the plan, status and the last digits and type of your card; we never receive or store your full card number.

3. How we use your information

• To create your account, sign you in and keep your account secure, including email sign-in links and verification.
• To provide the Service: save your progress, grade your work, unlock lessons and show your portfolio.
• To answer your messages and fix the problems you report.
• To send service emails, such as sign-in links and important changes. If you join our mailing list, to send news about the Service; you can unsubscribe at any time.
• To understand, in aggregate, which lessons work and where learners get stuck, so we can improve them.

We do not sell your personal information, and we do not use it to show you advertising.

4. Information we receive from Google

If you choose "Sign in with Google", the Service requests only the basic scopes openid, email and profile. From these we receive your name, email address and profile picture. We use them only to create and sign in to your RMF GRC AI account and to show your name or picture inside your account. We do not request access to your Gmail, Google Drive, Calendar, contacts or any other Google data. We do not sell Google user data, use it for advertising, or transfer it to anyone except the service providers in section 5 that run the Service for us.

RMF GRC AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Who we share information with

We share information only with service providers that process it on our behalf to run the Service, and only as much as each needs:

• Supabase: account sign-in and the database that stores your account and work.
• Google Cloud: hosting of the application.
• Google Analytics: usage statistics. It uses cookies and receives your browser's IP address, device information and a random account identifier, but not your name or email address. Learn how Google uses information from sites that use its services, or opt out with the Google Analytics Opt-out Browser Add-on.
• Stripe and PayPal: payments, if you buy a plan.
• MailerLite: email newsletters, if you join our mailing list.
• Error monitoring: technical crash details, so we can fix errors.

We may also disclose information if the law requires it, or to protect the rights, safety and security of our users and the Service.

6. How long we keep it, and deleting your account

We keep your account information and work for as long as your account is active. You can ask us to delete your account at any time by emailing contact@convocourses.com from the address on your account. We delete your account and the personal information linked to it within 30 days of your request, except where we must keep records, such as payment records, to meet legal obligations. Usage statistics in Google Analytics are kept in aggregate according to our Analytics retention settings.

7. How we protect it

Information is encrypted in transit and at rest with our providers, access to the database is restricted by account-level security rules, and only the people who operate the Service can reach administrative tools. No system is perfectly secure, so please use a strong password and keep your sign-in email secure.

8. Your choices and rights

• Access or correct your information: most of it is visible and editable in your account; for anything else, email us.
• Delete your account: see section 6.
• Stop marketing email: use the unsubscribe link in any newsletter.
• Analytics: use the opt-out add-on in section 5.
• Disconnect Google: you can remove RMF GRC AI's access at any time in your Google Account permissions.

9. Children

The Service is intended for adults and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has given us information, contact us and we will delete it.

10. Changes to this policy

If we change this policy, we will update the date at the top of this page, and for significant changes we will tell you in the Service or by email.

11. Contact us

1teamyb LLC (DBA ConvoCourses)
Email: contact@convocourses.com