Privacy Policy

Last updated: June 5, 2026

1. Who We Are

This Privacy Policy explains how GRC Doctor LLC, a Texas limited liability company doing business as CMMC Doctor (“CMMC Doctor,” “we,” “us,” or “our”) collects, uses, and shares information when you interact with our website and services (the “Services”), including when you join our mailing list, complete a survey, or contact us.

We may add features and update our practices over time. When we make material changes to how we handle your information, we will update this policy as described in Section 11.

Independence & Trademark Notice. CMMC Doctor is an independent compliance platform operated by GRC Doctor LLC. We are not affiliated with, endorsed by, or sponsored by the U.S. Department of Defense (DoD), the Cyber Accreditation Body (“The Cyber AB”), or any government agency. CMMC® is a program of the U.S. Department of Defense, and “CMMC” and related marks are the property of their respective owners. Use of CMMC Doctor does not satisfy CMMC certification requirements; only authorized Certified Third-Party Assessor Organizations (C3PAOs) can perform official CMMC assessments.

2. Information We Collect

2.1 Information You Provide

  • Contact details. When you join our mailing list, we collect your email address, which we validate and store in lowercase form.
  • Survey information (optional). If you complete one of our surveys, we collect:
    • All users: first name, last name, the role you select (Defense Contractor / Organization Seeking Certification, or Vendor), company name, job title or role, and company size (employee-count band).
    • Contractors: self-rated CMMC familiarity, industry / Defense Industrial Base business type, your stage in the compliance journey, your supply-chain role (prime, subcontractor, or both), the CMMC levels you are pursuing, other compliance goals (such as ISO 27001, SOC 2, FCL, or FedRAMP), compliance milestones already achieved, and challenges or pain points you describe.
    • Vendors: years of experience supporting defense contractors, your service or vendor type, organizational authorizations held (such as C3PAO, RPO, CMMC Level 2, or FedRAMP), staff certifications held, the client compliance goals you support, and the business challenges or goals you describe.
  • Contact form. If you use our contact form, we collect your first name, last name, email address, and the message you write (up to 5,000 characters).
  • Free-text fields. Several fields — including any “Other” options, company name, and the contact message — let you type freely. Please do not include sensitive personal information, classified information, controlled unclassified information (CUI), or details you are not authorized to share. We are not responsible for information you voluntarily place in free-text fields.

2.2 Information Collected Automatically

When you use the Services, we and our service providers automatically collect:

  • Technical data: your IP address and browser user-agent string.
  • Event timestamps: the times of your signup, email confirmation, survey completion, and related emails.
  • Audit log entries: records of signup, confirmation, and submission actions, including action type, the related record identifier, IP address, and user-agent, which we keep for security and abuse-prevention.
  • Analytics data: usage and interaction data collected through PostHog (see Section 5).

We do not knowingly collect Social Security numbers, financial-account numbers, payment card data, government-clearance details, or other sensitive categories of personal information.

3. How We Use Your Information

We use the information we collect to:

  • Confirm your email and manage your subscription to our communications;
  • Send you updates, announcements, invitations, and related administrative messages;
  • Understand our audience and connect contractors with appropriate vendors;
  • Conduct product research and improve our Services;
  • Respond to your inquiries and provide support;
  • Detect, prevent, and address spam, abuse, fraud, and security issues; and
  • Comply with legal obligations and enforce our Terms of Service.

Email and consent. We use a double opt-in process: after you sign up, we email you a confirmation link, and we add you to our communications only after you confirm. You can unsubscribe at any time using the link in any marketing email, or by contacting us at [email protected].

4. How We Share Information

We do not sell your personal information. We share it only as described here:

  • Service providers (sub-processors): vendors who process data on our behalf and are bound to protect it, listed in Section 5.
  • Legal and safety: when we believe disclosure is required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of CMMC Doctor, our users, or others.
  • Business transfers: in connection with a merger, acquisition, financing, or sale of all or part of our assets, subject to this policy.

We do not sell your personal information or share it for cross-context behavioral advertising. Where our Services facilitate connections between contractors and vendors, we share your information only as needed to provide that functionality and consistent with this policy.

5. Service Providers We Use

To operate our Services, we rely on the following providers:

  • DigitalOcean — hosting, content delivery, and managed database (stores the information described above).
  • Resend — email delivery. Resend receives recipient email addresses, confirmation/resume links, and (for contact-form submissions) the sender’s name and message, which is also routed to our internal inbox.
  • PostHog — product analytics. We leverage PostHog Cloud to capture baseline usage analytics. This does include capturing IP Address.

6. Cookies and Analytics

We use cookies and similar technologies to keep our Services working, remember your preferences, and understand how they are used (through PostHog). You can control cookies through your browser settings; disabling some cookies may affect how the Services function.

7. Data Retention

We keep your information for as long as needed to provide our Services, communicate with you, and operate our business, and we keep contact submissions for as long as needed to handle your inquiry and maintain our records.

You may ask us to delete your information at any time (see Section 8). We may retain limited information where necessary to comply with legal obligations, resolve disputes, prevent abuse, or enforce our agreements.

8. Your Choices and Rights

You can unsubscribe from emails at any time, and you can ask us to access, correct, or delete your personal information by emailing [email protected]. We will respond consistent with applicable law.

8.1 Texas Residents

Under the Texas Data Privacy and Security Act, Texas residents may have the right to confirm whether we process their personal data; access, correct, or delete it; obtain a portable copy; and opt out of targeted advertising, sale of personal data, or certain profiling. We do not sell personal data or use it for targeted advertising. To exercise these rights, contact us at [email protected]. If we deny a request, you may appeal by replying to our response; you may also contact the Texas Attorney General.

8.2 California Residents

If you are a California resident, you may have rights under the California Consumer Privacy Act (as amended) to know, access, correct, and delete personal information, and to opt out of “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined. We will not discriminate against you for exercising these rights. To make a request, contact us at [email protected].

9. Data Security

We use reasonable technical and organizational measures designed to protect your information, including encryption in transit, access controls, and audit logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children’s Privacy

Our Services are intended for businesses and professionals and are not directed to children under 13 (or under 18). We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version and revise the “Last updated” date. Material changes may also be communicated by email. Your continued use of our Services after an update takes effect means you accept the revised policy.

12. Contact Us

Questions about this Privacy Policy or your information can be sent to: