Privacy Policy

Data Controller

GreyLee Services Group LLC (“we,” “us,” “our”), Collingswood, NJ. CAGE 0Q6E5. UEI UR93NFRB85B5.

What We Collect

• Account email and name
• Company information (name, address, CAGE, UEI, org type)
• Payment information (processed via Stripe — we do not store card numbers)
• Evidence files you upload (stored in Cloudflare R2, encrypted at rest)
• Assessment responses and implementation language
• Usage analytics (via PostHog)
• Error reports (via Sentry)

What We Don't Do

• We do not sell your data.
• We do not share your data with third parties except processors necessary to deliver the service: Stripe (payments), Anthropic (AI drafting — prompts not retained), Cloudflare (hosting, storage), Resend (email), PostHog (analytics), Sentry (error tracking), Vercel (hosting).

Data Retention

Assessment data and evidence are retained while your subscription is active plus 90 days after cancellation. After that, data is deleted unless you request an export before the retention period ends.

Your Rights

Under GDPR and CCPA, you have the right to access, correct, delete, or export your personal data. Contact us at privacy@greyleegroup.com to exercise these rights.

Cookies

We use essential cookies for authentication (ontract_session) and analytics cookies (PostHog). No advertising cookies.

Contact

Privacy inquiries: privacy@greyleegroup.com