Privacy Policy

1. Introduction

CMMC Ready ("we," "our," or "us") operates cmmc.barsec.tech. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our CMMC gap analysis and compliance tracking services.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your email address, company name, and a securely hashed password. We do not store plaintext passwords.

2.2 Assessment Data

When you complete a CMMC self-assessment, we store your responses, compliance scores, and any notes or evidence you associate with specific controls. This data is used solely to generate your gap analysis reports and track compliance progress.

2.3 Payment Information

We use Stripe to process payments. We do not store your credit card details. Stripe collects and processes payment information in accordance with its own Privacy Policy.

2.4 Newsletter

If you subscribe to our newsletter, we collect your email address to send CMMC updates and compliance tips. You may unsubscribe at any time.

2.5 Automatically Collected Data

We collect standard server logs including IP address, browser type, and access timestamps for security and operational purposes.

3. How We Use Your Information

• To create and manage your account
• To generate gap analysis reports and compliance scores
• To process subscription and one-time payments
• To send service-related communications and password resets
• To deliver newsletter content (if subscribed)
• To improve our services and troubleshoot issues

4. Data Security

We implement industry-standard security measures to protect your data:

• Passwords are hashed using bcrypt before storage
• Session cookies are HTTP-only and secure
• Assessment data is access-controlled — users can only view their own reports
• All data is stored on secured servers with restricted access

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share data only in the following circumstances:

• Service Providers: With Stripe for payment processing and Resend for email delivery
• Legal Requirements: If required by law, regulation, or legal process
• Business Transfers: In connection with a merger, acquisition, or sale of assets

6. Data Retention

We retain your account and assessment data for as long as your account is active. If you wish to delete your account and all associated data, contact us at support@barsec.tech.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access, correct, or delete your personal data
• Object to or restrict certain processing
• Export your data in a portable format
• Withdraw consent for marketing communications

To exercise these rights, contact us at support@barsec.tech.

8. Children's Privacy

Our services are not intended for individuals under the age of 13. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new revision date.

10. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

• Email: support@barsec.tech
• Website: cmmc.barsec.tech