GreyLee CMMC

Privacy Policy

Last updated: September 1, 2026

1. Data Controller

GreyLee Services Group LLC (“we,” “us,” “our”), 125 E Browning Rd, Collingswood, NJ 08108. CAGE 0Q6E5. UEI UR93NFRB85B5.

2. What We Collect

  • Account email and name
  • Company information (name, address, CAGE, UEI, org type)
  • Payment information (processed via Stripe — we do not store card numbers)
  • Assessment responses and generated documents (we do not accept or store evidence files)
  • Usage analytics (via PostHog, with your consent)
  • Error reports (via Sentry)

3. What We Don't Do

  • We do not sell your data.
  • We do not accept or store evidence files.
  • We do not share your data with third parties except processors necessary to deliver the service: Stripe (payments), Anthropic (AI drafting), Vercel (hosting), Resend (email), PostHog (analytics), Sentry (error tracking).
  • Anthropic does not use API inputs or outputs to train its models, under its commercial terms. Anthropic deletes API inputs and outputs within 30 days by default. We do not have a zero-data-retention agreement in place.

4. Data Residency

All data is stored and processed in the United States. Our application servers run in Vercel's US East region (iad1). Our database is hosted on Railway in a US region. Analytics data is processed by PostHog's US instance.

5. Data Retention

Assessment data is retained while your subscription is active plus 90 days after cancellation. After that, data is deleted unless you request an export before the retention period ends.

6. Your Rights

Under GDPR and CCPA, you have the right to access, correct, delete, or export your personal data. Contact us at info@greyleegroup.com to exercise these rights.

7. Cookies

We use two categories of cookies:

  • Strictly necessary — authentication session cookies. These are always active and cannot be disabled.
  • Analytics — PostHog cookies for usage analytics. These are only set after you accept the cookie consent banner. Analytics event data is retained for 1 year. No advertising cookies.

8. Email Communications

We send transactional emails (sign-in links, SSP readiness, renewal reminders) that are necessary for the service. We may also send optional marketing emails (referral prompts, case study invitations, quarterly check-ins). You can unsubscribe from marketing emails at any time using the unsubscribe link in each email. Transactional emails cannot be unsubscribed from while your account is active.

9. Contact

Privacy inquiries: info@greyleegroup.com