SMOKE SOURCE PRIVACY POLICY. This Privacy Policy describes how your personal information is collected, used, and shared by Fantasium LLC, a Montana limited liability company, its affiliates, subsidiaries, and divisions as may change from time to time

Privacy Policy

Data Retention Policy for Smoke Source. Effective Date: 10/28/2023. 1. Introduction. This Data Retention Policy outlines the principles and guidelines for the retention and disposal of data collected and processed by Smoke Source (hereafter referred

Data Retention Policy for Smoke SourceEffective Date: 10/28/20231. IntroductionThis Data Retention Policy outlines the principles and guidelines for the retention and disposal of data collected and processed by Smoke Source (hereafter referred to as &quot;the application&quot;). Data retention is essential to ensure the security, privacy, and compliance of the application with relevant data protection laws and regulations.The application&#x2019;s security, data, and privacy systems are managed by Crowdbotics. For more information and system status updates you can visit the <a href="https://app.vanta.com/crowdbotics/trust/xvfg2v07gxixd7wrp635l">Crowdbotic&#x2019;s systems information page</a>.2. ScopeThis policy applies to all data collected, processed, and stored by the application, whether it pertains to individuals (user data), organizations, or any other data subject.3. Data CategoriesThe application may collect and process various data categories, including but not limited to:<ul><li>User account information</li><li>Usage logs</li><li>Personal user data</li><li>Analytics data</li><li>Customer support records</li><li>Backup data</li><li>Credit card and payment information</li></ul>4. Data Access ControlTo ensure privacy and security of data, the application has strong password requirements and logs access to user data.5. Data Encryption &amp; Data Loss PreventionFor security purposes all data in the application is encrypted at rest and in transit.The application has formal and disposal procedures in place ot guide the secure retention and disposal of company and customer data.6. Incident Response PlanThe company has a formal incident response plan in place to deal with any incidents that may occur.7. Monitoring and AuditingThe company&apos;s has formal policies and procedures in place to monitor and audit any sensitive data stored by the application.8. Data Retention PeriodsThe retention periods for different data categories are defined as follows:a. User Account Information:<ul><li>Data Category: User registration data, such as username, email, and profile information.</li><li>Retention Period: Data will be retained as long as the user maintains an active account with the application. Upon account deletion, all related data will be deleted within 365 days.</li></ul>b. Usage Logs and Analytics Data:<ul><li>Data Category: Logs and analytics data used for application performance analysis and improvement.</li><li>Retention Period: Logs and analytics data will be retained for a period of 12 months for statistical and troubleshooting purposes.</li></ul>c. Personal User Data:<ul><li>Data Category: Any personal data provided by users, such as messages, documents, or media.</li><li>Retention Period: Data will be retained for as long as the user chooses to keep it within the application. Users can delete their data at any time, which will result in the immediate and permanent removal of such data.</li></ul>d. Customer Support Records:<ul><li>Data Category: Records of customer support interactions, including support tickets and email communication.</li><li>Retention Period: Customer support records will be retained for a period of 60 months after the resolution of the support request.</li></ul>e. Backup Data:<ul><li>Data Category: Backup copies of application data for disaster recovery purposes.</li><li>Retention Period: Backup data will be retained for a maximum of 12 months, with regular deletion of older backups as new ones are created.</li></ul>9. Data DeletionData will be deleted in accordance with the specified retention periods. Data deletion will be performed securely to ensure that data is irrecoverable. When data is deleted, it will be removed from all active databases and backup systems.10. Data Subject RightsThe application will respect data subjects&apos; rights, including the right to access, rectify, or erase their personal data. Users can exercise these rights by contacting our customer support or using the features provided within the application.11. ComplianceThis policy will be updated as necessary to ensure compliance with relevant data protection laws, including but not limited to the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).The application&#x2019;s systems are compliant with the following:<ul><li>SOC 2 Type</li><li>SOC 2 Type I</li><li>SOC 2
SOC 2 Type II</li><li>GDPR</li><li>CCPA
COMPLIANT
CCPA</li><li>HIPAA</li><li>NIST Cybersecurity Framework</li><li>Minimum Viable Secure Product</li><li>NIST 800-53</li><li>NIST 800-171</li></ul>12. Review and RevisionThis Data Retention Policy will be reviewed annually and updated as necessary to reflect changes in data handling practices, laws, or regulations. Any updates will be communicated to relevant stakeholders.13. Contact InformationIf you have any questions or concerns about this Data Retention Policy or the data we collect and process, please contact <a href="mailto:support@smokesource.co">support@smokesource.co</a>.14. Document History<ul><li>Document created 10/28/2023</li></ul>By using the application, you agree to abide by this Data Retention Policy.

Data Retention Policy

The purpose of this incident response plan is to outline the procedures and guidelines for effectively responding to security and operational incidents within the SmokeSource application. By and large Smoke Source’s incident response plan is run thro

<h2 id="isPasted">1. Introduction</h2><h3 id="purpose">Purpose</h3>The purpose of this incident response plan is to outline the procedures and guidelines for effectively responding to security and operational incidents within the SmokeSource application.By and large Smoke Source&#x2019;s incident response plan is run through our development and hosting agency, Crowdbotics. For more information on our response plan as well as our preventative measures, please visit <a href="https://app.vanta.com/crowdbotics/trust/xvfg2v07gxixd7wrp635l">Crowdbotic&#x2019;s security page</a>.<h3 id="scope">Scope</h3>This plan applies to all personnel involved in the development, deployment, and operation of SmokeSource.<h3 id="objectives">Objectives</h3>The main objectives of this plan are:<ul><li>Minimize the impact of incidents on the software application and its users.</li><li>Identify and report incidents promptly.</li><li>Contain, eradicate, and recover from incidents efficiently.</li><li>Learn from incidents and improve our incident response capabilities.</li></ul><h2 id="2-incident-categories">2. Incident Categories</h2>Categorize potential incidents based on their nature and severity. Common categories include but are not limited to:<ul><li>Security breaches</li><li>Data breaches</li><li>Unauthorized access</li><li>Data loss</li><li>Downtime and service disruptions</li><li>Malware or virus infections</li><li>Insider threats</li></ul><h2 id="3-incident-response-team">3. Incident Response Team</h2><h3 id="roles-and-responsibilities">Roles and Responsibilities</h3><ul><li>Incident Response Coordinator - Fantasium LLC</li><li>IT and Security Team - Crowdbotics</li><li>Legal and Compliance Team - Cutler Law Firm</li><li>Communication and PR Team - Fantasium LLC, CaliConnected</li><li>Management Team - Fantasium LLC</li></ul><h3 id="contact-information">Contact Information</h3><ul><li>Fantasium LLC - <a href="mailto:dloud@fantasiummedia.com">dloud@fantasiummedia.com</a>, 1+ 605-321-7249</li><li>Crowdbotics Security Team - <a href="mailto:security@crowdbotics.com">security@crowdbotics.com</a></li></ul><h2 id="4-preparation--prevention-phase">4. Preparation &amp; Prevention Phase</h2><ul><li>Maintain an inventory of all assets related to the application.</li><li>Conduct regular risk assessments.</li><li><a href="https://app.vanta.com/crowdbotics/trust/xvfg2v07gxixd7wrp635l/monitoring#INFRASTRUCTURE_SECURITY">Document security policies and procedures.</a></li><li>Implement training and awareness programs.<ul><li>The company requires employees to complete security awareness training within thirty days of hire and at least annually thereafter.</li></ul></li><li>Deploy detection mechanisms.<ul><li>The company&apos;s penetration testing is performed at least annually. A remediation plan is developed and changes are implemented to remediate vulnerabilities in accordance with SLAs.</li></ul></li><li>Ensure availability of incident response tools.</li></ul><h2 id="5-incident-detection-and-reporting">5. Incident Detection and Reporting</h2>Crowdbotics manages incident detection and reporting. For details on how they do this please <a href="https://app.vanta.com/crowdbotics/trust/xvfg2v07gxixd7wrp635l/monitoring#INTERNAL_SECURITY_PROCEDURES">visit their security page</a>.<h2 id="6-assessment-phase">6. Assessment Phase</h2><ul><li>Categorize incidents.</li><li>Perform initial triage.</li><li>Assess the impact.</li><li>Notify relevant parties.</li><li>Escalate as necessary.</li></ul><h2 id="7-response---containment-and-eradication">7. Response - Containment and Eradication</h2><ul><li>Isolate affected systems.</li><li>Remediate vulnerabilities or weaknesses.</li><li>Preserve evidence for investigation.</li></ul><h2 id="8-recovery-phase">8. Recovery Phase</h2><ul><li>Restore affected systems and services.</li><li>Recover lost data.</li><li>Perform a post-incident review.</li></ul><h2 id="9-communication-and-coordination">9. Communication and Coordination</h2><ul><li>Communicate internally and externally.</li><li>Coordinate with relevant parties, including law enforcement if necessary.</li></ul><h2 id="10-post-incident-activities">10. Post-Incident Activities</h2><ul><li>Document the incident and response actions.</li><li>Conduct a lessons learned session.</li><li>Update policies and procedures based on findings.</li></ul><h2 id="11-testing-and-training">11. Testing and Training</h2><ul><li>Regularly conduct tabletop exercises.</li><li>Provide training to all involved personnel.</li></ul><h2 id="12-references-and-appendices">12. References and Appendices</h2>Include any supporting documents, contact lists, and incident report templates.Remember that this plan is a living document and should be regularly reviewed and updated to adapt to changing threats and technology. Training and awareness are key to successful incident response, and testing through exercises ensures the plan&apos;s effectiveness.

Policies

Privacy Policy

Data Retention Policy

Incident Response Plan