Privacy Policy

We collect three kinds of information.

• Account information. The name, work email, and organization details you provide when you create an account, together with the sign-in and billing records needed to run your subscription. Payment is handled by a third-party payment processor, and we do not store full card numbers.
• Assessment content. The content you enter to build and maintain your Level 1 self-assessment. This includes your scoping decisions, your Met, Not Met, and N/A determinations, the plain-English basis you record for each determination, the narratives you write, the evidence files you upload, and the dates and record of who confirmed each item.
• Usage and device data. Standard technical data such as IP address, browser type, device and operating system, referring pages, and the pages and features you use. This helps us keep the service secure and reliable, and on the website it also tells us which pages people find useful. How that works on each surface, and how to turn it off on the website, is set out in Cookies and Similar Technologies below.
• Progress through the Readiness Check. If you take the free Readiness Check on our website, we record your progress through it, such as whether you started, which step you reached, and whether you completed it. Your answers themselves stay in your browser. You can turn this off before you start. It is covered in Cookies and Similar Technologies below.

Evidence you upload. The service is the system of record for your self-assessment, and the evidence files you upload are stored in it, versioned and content-hashed. Evidence for a Level 1 assessment can contain Federal Contract Information, and the service is built to hold it in one protected place. Do not upload Controlled Unclassified Information, classified material, or other information beyond the Level 1 FCI scope. The safeguards for that stored evidence are summarized in the Data Security section below.

Personal information inside assessment content. Federal Contract Information is information about a government contract, not about people. The evidence behind a Level 1 self-assessment, however, usually does name people, because several requirements are about who can get in. A list of authorized users and their accounts, sign-in and access settings, a visitor log, records of who holds keys or badges, and the names of the people who approve or perform a task are all common evidence. That content can include names, work email addresses, usernames, device identifiers, and dates and times of access for your employees, contractors, and visitors. It reaches us only because your organization uploads it, and we handle it as described in Controller and Processor Roles below.

Our role depends on the type of information, because it changes who decides how that information is used.

• Where we are the controller. For account, billing, website, and marketing information, ProfytAI Pte. Ltd. decides why and how the information is handled. This policy governs that information.
• Where we are the processor. For the assessment content you enter, we act on behalf of your organization, which is the controller of that content. We process it to provide the service and only on your organization's documented instructions, except where the law requires otherwise or where our agreement with your organization permits it, such as the quarantine or removal of out-of-scope material.

Your organization’s responsibilities for that content. Your organization decides what goes into its assessment, including any personal information about its employees, contractors, and visitors. It is responsible for having the right to upload that information, for giving those people any notice the law requires, and for responding to their privacy requests. We recommend uploading only what an objective needs and removing details an artifact does not need to prove the point, such as personal phone numbers, home addresses, or identification numbers. We help your organization respond to requests about its content as its processor.

We offer a data processing agreement to organizations that require one, available through our Contact page. Where a data processing agreement is in place between us and your organization, it governs our processing of your assessment content, and if a term of that agreement conflicts with this policy for that content, the agreement controls.

We use the information we collect to run the service and to support you.

• To provide and maintain the service, and to save, display, and let you return to your assessment as you build it a little at a time.
• To authenticate you, process your subscription, and provide customer support.
• To secure the service, prevent abuse, and keep records for troubleshooting.
• To send service messages about your account, its security, and material changes to the product or this policy.
• To understand how the product is used and to improve it, working from aggregated and de-identified data where we can.

AI features. Where you use an AI feature of the service, the content you submit to it is processed to return advisory output to you. That output never makes a determination for you, as the Terms of Service explain.

We do not sell your personal information for money, and we do not sell or rent your assessment content. We do not use the assessment content you enter to train machine-learning models. We do use advertising and measurement cookies on the website, which counts as sharing under California and other state privacy laws. How that works, and how to stop it, is in Cookies and Similar Technologies and in Your Rights and Choices below.

For transparency, and to meet state privacy laws such as the California Consumer Privacy Act as amended, the categories of personal information we handle and the sources they come from are as follows.

• Identifiers. Name, work email, organization, and account identifiers. Collected from you when you create and use an account.
• Commercial information. Subscription and billing records. Collected from you and from our payment processor.
• Internet and network activity. IP address, device and browser data, and usage logs. Collected automatically as you use the website and application.
• Professional information. Your role and the assessment content you enter in the course of your work. Collected from you and other authorized users at your organization.
• Personal information about people at your organization. Names, work email addresses, usernames, device identifiers, and access and visitor records of your employees, contractors, and visitors, where they appear in the assessment content and evidence your organization uploads. Collected from your organization, which controls this content, and handled by us as its processor.

We do not intend to collect special or sensitive categories of personal information through the service, and you should not enter them. That includes government identification numbers such as Social Security or passport numbers, financial account numbers, health information, and biometric data. If an artifact you need as evidence contains any of these, redact them before you upload it.

We share information only as needed to run the service, and never to sell it.

• Service providers. We rely on a small set of providers for hosting, storage, AI model infrastructure, error monitoring, email delivery, and payment. Each is bound by contract to protect your data and to use it only to provide services to us.
• Analytics provider. On the website we use PostHog to measure how the site is used. It receives the pages you viewed, how long each page stayed open and how far down it you scrolled, the links and buttons you pressed, general device information, an approximate location derived from your IP address, and your progress through the free Readiness Check. It processes that data in the United States, on our behalf and under contract, and it is not present in the application.
• Email and marketing provider. We use Customer.io to send the email we send you, including replies to your enquiries and any marketing or product updates you asked to receive. When you send the contact form or request the Readiness Check PDF, the name, email, and message you submit reach us through our own application, and we may use Customer.io to respond and follow up. It processes that data in the United States, on our behalf and under contract. It does not run on the website, sets no cookies here, and is not present in the application. Your Readiness Check answers are not included.
• Legal and regulatory. We may disclose information if the law requires it, in response to a valid legal request, or to protect the rights, property, or safety of AssessrLog, our users, or the public.
• Business transfers. If AssessrLog is involved in a merger, acquisition, or sale of assets, your information may move as part of that transaction. We will tell you before your information becomes subject to a different policy.

• Advertising and measurement partners. On the website we run advertising and measurement tags from Google, LinkedIn, and Meta so we can see which advertisements bring people here. These set their own cookies and receive the pages you viewed on our website, along with the identifiers those platforms use to recognize a browser. When you finish certain steps on the website, such as completing the Readiness Check or the product tour, sending the contact form, or completing a purchase, Google also receives a note that the step happened, and for a purchase, its amount. They never receive what you typed, your Readiness Check answers, or your assessment content, and they are not present in the application.

We do not sell your personal information for money. We do share it for cross-context behavioral advertising, as that term is used under California and other state privacy laws, because the advertising tags described above work that way. You can stop that at any time. Use the Do Not Sell or Share My Personal Information control in the footer of any page, or send a Global Privacy Control signal from your browser, which we honor automatically.

We never share your assessment content, your evidence files, or anything you enter in the application with an advertising platform. Those tags exist only on the marketing website.

The website and the application behave differently here, so we describe them separately.

You can also control or clear cookies through your browser settings. Blocking the strictly necessary cookies will stop the application from working.

We keep information for as long as it is needed for the purpose it was collected.

• Assessment records. The CMMC rule requires the artifacts behind each annual Level 1 self-assessment to be kept for six years from the CMMC Status Date (32 CFR § 170.15), and that retention obligation belongs to your organization. We keep your assessment record and its evidence for as long as you hold a paid subscription covering it, so you can show a defensible history while you are with us. We do not undertake to keep it for any fixed period after that. Personal information inside your assessment content is kept and removed on the same schedule as the content it is part of.
• When your subscription ends. You can export your records while your subscription is active and during a closure window after it ends. The window is 30 days from the end of a subscription you paid for, or the 7 days from a failed payment if it ended unpaid. Subscribing again during the window restores the same account. After the window closes, your records can no longer be exported or restored through the service, we have no obligation to keep them or provide them to you, and we may delete them from the service at any time. We may be required to keep data for longer by law, a legal hold, or a separate signed agreement. Our Terms of Service set out the closure window in full.
• Account and billing data. We keep this for as long as your account is active, and for as long afterward as we need it to meet our legal, tax, and record-keeping obligations.
• Usage and log data. We keep this for as long as we need it for security and reliability, and no longer than our record-keeping obligations require. Request logs for this website are kept for 30 days.

You can ask us to delete your data on request or when your account is terminated, subject to records we are required to keep by law and records needed to preserve the integrity of a self-assessment you have already relied on. The six-year retention the CMMC rule requires is your organization’s obligation as the contractor, not ours, so export your records before your subscription ends.

We use administrative, technical, and physical safeguards designed to protect your information, and we keep working to improve them. No method of storage or transmission is perfectly secure, so we cannot promise absolute security.

The service stores your assessment record and the evidence you upload in one protected place, scoped to Level 1 and FCI only. Contact us if you need a fuller description of how the platform is built or how stored evidence is protected.

Depending on where you live, you may have rights over your personal information. We honor the rights that apply to you and will not discriminate against you for exercising them.

• Under US state privacy laws. You may have the right to know what we collect, to access it, to correct it, to delete it, and to opt out of any sale or sharing or of targeted advertising, along with the right not to be discriminated against for exercising these rights. To opt out of sharing for targeted advertising, use the Do Not Sell or Share My Personal Information control in the footer of any page. You do not need an account and we do not ask you to identify yourself to use it. We also honor the Global Privacy Control signal automatically, so a browser that sends it is opted out without doing anything further.
• Under Singapore’s PDPA. Because ProfytAI Pte. Ltd. is a Singapore company, the Personal Data Protection Act also applies to our handling of your personal data. You may request access to and correction of personal data we hold about you, and withdraw consent where processing relies on it.

To exercise any of these rights, reach us through our Contact page. We will verify your request and respond within the timeframes required by applicable law. You can also review and update your account information at any time inside the application.

If your information is in a customer’s assessment. If you work for, contract with, or visited one of our customers and your information appears in its assessment content, that organization controls the content and is the right place to make your request. If you contact us instead, we will refer your request to that organization and help it respond, acting on its instructions as its processor.

The service is provided by ProfytAI Pte. Ltd., a Singapore company, and is built for United States defense suppliers.

Your information is stored in the United States. The service and your assessment content are hosted on United States infrastructure, and we do not store assessment content anywhere else. Our personnel may access information from outside the United States, including from Singapore, to operate, support, and secure the service. That access is the only cross-border element in how the service is run, and where the law requires a safeguard for it, we put one in place.

AssessrLog is a business tool. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, reach us through our Contact page and we will delete it.

We may update this policy as the product and our practices change. When a change is material we will update the date shown above and, where appropriate, tell you through the service or by email. If you keep using the service after an update takes effect, that means you accept the updated policy.

Questions about this policy, or requests about your data, can be sent through our Contact page.