Privacy Policy

Overview

Expert CMMC is a free CMMC / NIST reference tool. This policy explains what we collect, why, and how it is handled. We collect only what's needed to run accounts and keep the service secure — we do not sell personal data or use third-party advertising trackers.

Information we collect

• Account details — your name and email address, and a password stored only as a salted bcrypt hash (we never store your plaintext password).
• Security tokens — short-lived email-verification and password-reset tokens, and the IP address recorded when you register.
• Request & error logs — when an error occurs we may log the request path, your IP address, browser user-agent, and related diagnostic context.
• Workspaces — organization membership, scope descriptions, objective responses, evidence references, remediation tasks, and activity history. The pilot is for non-CUI information only; do not enter CUI or upload sensitive material.
• Usage measurement — when enabled, first-party records capture organization/project identifiers, milestone names, and timestamps for up to 90 days. They exclude notes, evidence links, names, email addresses, IP addresses, and browser identifiers.
• Waitlist — if you ask to be notified about an upcoming feature, we store your email address and which feature you're interested in.

How we use it

• To create and authenticate your account and keep you signed in.
• To send transactional email (verification, password reset, workspace invitations, optional weekly reminders, and feature-launch notifications you opt into).
• To operate, secure, debug, and prevent abuse of the service.

Cookies

We use first-party authentication cookies to keep you logged in. Your light/dark theme preference is stored locally in your browser. We do not use advertising or cross-site tracking cookies.

Service providers

We share data only with the processors needed to run the service: a managed PostgreSQL database host (account and reference data), an SMTP email provider (to deliver the emails above), and Google reCAPTCHA on our forms when enabled (spam protection — subject to Google's privacy policy). They process data on our behalf and not for their own purposes.

Retention & your choices

Account data is kept until you ask us to delete it. Organization owners can export and delete workspace data. Organization deletion removes associated usage records and queued notifications. Deleted data may remain in restricted backups until their retention period expires; restored backups must have subsequent deletions reapplied before service resumes. Verification and reset tokens expire automatically; error logs are retained only as long as useful for debugging. To access, correct, or delete your data — or to leave a waitlist — email [email protected].

Security

Passwords are hashed with bcrypt, and traffic to the site is encrypted in transit over HTTPS. No system is perfectly secure, but we work to protect your information against unauthorized access.

Changes & contact

We may update this policy from time to time; material changes will be reflected by the “last updated” date above. Questions? Email [email protected].