Privacy Policy

Introduction

Gray Warden Labs ("we", "our", or "us") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our CMMC compliance platform.

Information We Collect

We collect information you provide directly to us, including:

• Name and contact information
• Company name and business details
• Account credentials
• Compliance-related data you enter into the platform
• Communications with our support team

How We Use Your Information

We use the information we collect to:

• Provide and maintain our services
• Process your compliance assessments
• Send you important updates about our services
• Respond to your requests and support needs
• Improve our platform and develop new features

Sharing & Third Parties

We do not sell your personal information. We share it only with the service providers required to operate Gray Warden, and only for the purposes described in this policy:

• Payment processing: payments are processed by Stripe. Your card details are entered in Stripe-hosted fields and are never stored on Gray Warden's servers.
• Cloud hosting and infrastructure: providers that host the platform and store your data.
• Email delivery: providers that send transactional emails (verification, billing, and service notifications) on our behalf.
• Analytics: we use privacy-friendly, cookieless analytics (Plausible) on our marketing website. See "Tracking & Do Not Track" below.
• Legal requirements: we may disclose information where required by law, regulation, or valid legal process.

Tracking & Do Not Track

We do not use advertising cookies or cross-site trackers, and we do not permit third parties to collect personal information about your activity across other websites through our site. Our website analytics are cookieless and do not identify individual visitors. Because we do not track you across sites, our site behaves the same whether or not your browser sends a "Do Not Track" signal.

Data Security

We implement industry-standard security measures to protect your data, including encryption in transit and at rest, role-based access controls, tenant data isolation, and activity audit logging. Given the nature of our business serving the Defense Industrial Base, we take security seriously.

Data Retention

We retain your personal data for as long as necessary to provide our services and fulfill the purposes described in this policy. When you close your account, we will delete or anonymize your data within 90 days, except where we are required to retain it for legal or compliance purposes.

Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Object to processing of your data
• Export your data in a portable format

To exercise any of these rights, email privacy@graywarden.com from the address associated with your account. We will respond within 30 days.

Changes to This Policy

If we make material changes to this policy, we will update the effective date above and notify account holders by email or by a prominent notice in the application before the changes take effect. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

Contact Us

If you have questions about this privacy policy or our data practices, please contact us at privacy@graywarden.com.