Hydromation Corporation ("Hydromation," "we," "us," or "our") operates CMMC Map at cmmcmap.com. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.
1. Information We Collect
Account information: When you register, we collect your name, email address, organization name, and password (hashed). We do not store plain-text passwords.
Usage data: We collect information about how you use the platform — controls viewed, documents generated, progress scores, sign-in activity, and session activity. This data is used to provide the service, keep it secure, and improve it.
Billing information: Payment processing is handled by Stripe. We do not store credit card numbers or bank details. We receive only limited transaction metadata (last 4 digits, billing postal code, subscription status) from Stripe.
User-uploaded content: Documents and evidence files you upload are stored in your organization's private workspace so you can manage them alongside your assessment. They are protected by row-level security and you can delete them at any time. Uploaded files are not analyzed by AI unless you explicitly request it for a specific file (see Section 3).
Technical data: We collect standard server logs including IP addresses, browser type, and referring URLs for security and debugging purposes.
2. How We Use Your Information
- To provide, maintain, and improve the CMMC Map service.
- To process subscription payments and send transactional emails (receipts, sign-in codes, password resets, service notices).
- To respond to support requests sent to [email protected].
- To send product updates and compliance-relevant announcements (you may opt out at any time).
- To detect and prevent fraud, abuse, or security incidents.
We do not sell your personal data to third parties. We do not use your data to train AI models, and our AI provider does not train on it either (see Section 3).
3. AI Features and Third-Party APIs
CMMC Map offers optional AI-powered features — Q&A assistance, document drafting, and evidence analysis — using the Anthropic Claude API through our own managed connection. You do not supply an API key.
AI is off by default and runs only when you ask it to. An administrator for your organization must first enable AI features in Settings. Even when enabled, nothing is sent to the AI provider unless you explicitly invoke an AI action — for example, asking the assistant a question or clicking "Analyze with AI" on an uploaded file.
What is sent to Anthropic depends on the feature you invoke:
- Q&A assistant: your question, plus relevant context from your workspace (such as assessment progress and control status) so answers can be specific to your situation.
- Evidence analysis: text extracted from the specific file you chose to analyze (up to approximately the first 30,000 characters).
- Document generation: the answers and organization details you have entered that the document draws on.
Anthropic processes this content to return a response and, under our API terms with Anthropic, does not use it to train AI models. Your use of AI features is also subject to Anthropic's Privacy Policy. Do not submit CUI or other restricted information to AI features.
4. Connected AI Assistants (MCP)
CMMC Map offers a connector (using the Model Context Protocol) that lets you link your own AI assistant — such as Claude — to your workspace. Your assistant can read data from your workspace only after you authorize the connection through a secure OAuth sign-in, and only when you direct your assistant to use it. Data retrieved this way goes to your AI assistant and is handled under that assistant provider's own terms and privacy policy, not this one. You can revoke a connected assistant's access at any time, and we may revoke access tokens when needed for security.
5. Data Storage and Security
Your data, including uploaded files, is stored in Supabase (PostgreSQL and object storage), hosted in the United States. We use row-level security (RLS) to ensure each organization can only access its own data. All data in transit is encrypted via TLS. We follow CMMC-aligned security practices — consistent with what we help our customers achieve.
Important: CMMC Map is not an approved CUI storage system. Do not upload actual Controlled Unclassified Information to the platform.
6. Data Retention
We retain your account data, including uploaded files, for as long as your subscription is active and for 90 days after cancellation to allow for account recovery. After 90 days, account data is permanently deleted. You can delete individual uploaded files yourself at any time from within the app. Server logs are retained for 30 days. You may request immediate deletion at any time (see Section 9).
7. Cookies and Tracking
We use essential session cookies required to keep you logged in. We use Google Analytics on our public website to understand aggregate usage patterns. No advertising or cross-site tracking cookies are used. You can disable non-essential cookies in your browser settings.
8. Sharing of Information
We share data only with the following service providers who process it on our behalf:
- Supabase — database, authentication, and file storage hosting.
- Netlify — application hosting and delivery; AI feature requests transit our Netlify infrastructure on their way to Anthropic.
- Cloudflare — network security and content delivery in front of our sites.
- Stripe — payment processing.
- Anthropic — AI features (only the content described in Section 3, and only when you invoke an AI feature).
- Resend — transactional email delivery (sign-in codes, service notices).
- Brevo — email delivery for product updates and announcements.
- Google Analytics — aggregate website analytics.
If you connect your own AI assistant via our MCP connector, data your assistant retrieves is shared with that assistant at your direction (see Section 4). We may disclose data if required by law, subpoena, or to protect the rights and safety of Hydromation, our users, or the public.
9. Your Rights
You have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Request deletion of your account and associated data, including uploaded files.
- Export your compliance progress data in JSON format.
- Opt out of marketing emails via the unsubscribe link in any email.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
10. Children's Privacy
CMMC Map is intended for business use by adults (18+). We do not knowingly collect personal data from anyone under 18. If we learn that a minor has created an account, we will promptly delete the account and associated data.
11. Changes to This Policy
We may update this Privacy Policy as the service evolves. We will notify registered users of material changes by email at least 14 days before they take effect. The effective date at the top of this page reflects the most recent revision.
12. Contact
Privacy questions or requests:
Hydromation Corporation
12015 US-50 Suite 600
Fairfax, VA 22033
[email protected]