This version applies until November 2, 2026, when the revised Privacy Policy takes effect. It is kept here for reference.

Hydromation Corporation ("Hydromation," "we," "us," or "our") operates CMMC Map, also styled CMMCMAP, at cmmcmap.com and app.cmmcmap.com. This Privacy Policy explains what data we collect, how we use it, who else touches it, and your rights regarding that data. It covers the public website and the application.

1. Information We Collect

Account information: When you create an account we collect your name, email address, company name, a phone number, and a password (stored only as a hash). We ask for the phone number because we call every new account to help it get started. If you sign in with Google, we receive your name and email address from Google and no password is created.

Workspace content: The answers, statuses, written responses, evidence notes, and documents you generate inside your workspace. This is your organization's data and stays in your workspace.

Uploaded files: Documents and evidence files you upload are stored in your organization's private workspace so you can manage them alongside your assessment. They are protected by row-level security and you can delete them at any time. Uploaded files are not analyzed by AI unless you explicitly request it for a specific file (see Section 3).

Evidence connectors: If you connect Microsoft 365 or Google Workspace (see Section 4), we store the read-only credentials you supply, encrypted at rest, and the configuration and metadata the connector reads from your tenant, filed as evidence in your workspace.

Team and client contacts: When you invite a colleague, or a consultant sends a question to a client contact, we store that person's email address and name so the invitation or question can be delivered and their reply recorded.

Usage data: How you use the platform, such as pages viewed, documents generated, progress scores, sign-in activity, and session activity. Used to provide the service, keep it secure, and improve it.

Billing information: Payment processing is handled by Stripe. We do not store card numbers or bank details. We receive limited transaction metadata (last four digits, billing postal code, subscription status) from Stripe.

Security and technical data: IP address, browser type, referring URL, and the outcome of sign-in attempts. Failed sign-ins, blocked sign-ups, password resets, and similar events are recorded with the address behind them so we can detect abuse.

2. How We Use Your Information

We do not sell your personal data. We do not use your data to train AI models, and our AI provider does not train on it either (see Section 3).

3. AI Features and Third-Party APIs

CMMC Map offers optional AI-powered features, such as Q&A assistance, document drafting, and evidence analysis, using the Anthropic Claude API through our own managed connection. You do not supply an API key.

AI features are on when a workspace is created. An owner or admin of the workspace can switch them off in Settings at any time, and that switch is enforced on our servers. Even when enabled, nothing is sent to the AI provider unless you explicitly invoke an AI action, for example asking the assistant a question or clicking "Analyze with AI" on an uploaded file.

What is sent to Anthropic depends on the feature you invoke:

Anthropic processes this content to return a response and, under our API terms with Anthropic, does not use it to train AI models. Your use of AI features is also subject to Anthropic's Privacy Policy. Do not submit CUI or other restricted information to AI features.

4. Evidence Connectors (Microsoft 365 and Google Workspace)

You can connect your Microsoft 365 tenant or Google Workspace domain so the app can file evidence for you. The connection uses read-only credentials that you create and supply. We encrypt those credentials at rest and use them only to read your tenant on your instruction or on the schedule you set.

What the connector reads is configuration and metadata: user accounts, whether multi-factor authentication is enforced, device and audit settings, sign-in and security policy settings, and file and folder metadata such as names, owners, sharing state, and labels. It does not read the contents of documents, email, or chat. The optional CUI discovery scan records where sensitive content appears to live (file names and locations), not the content itself.

Everything the connector files is labeled with its source and the time it was read. The connector suggests where evidence applies; it never sets a control's status for you. You can disconnect at any time from Settings, which deletes the stored credentials. Microsoft and Google are not our service providers in this arrangement; the connector reads your own tenant under the terms you have with them.

5. Connected AI Assistants (MCP)

CMMC Map offers a connector (using the Model Context Protocol) that lets you link your own AI assistant, such as Claude, to your workspace. Your assistant can read data from your workspace only after you authorize the connection through a secure OAuth sign-in, and only when you direct your assistant to use it. Data retrieved this way goes to your AI assistant and is handled under that assistant provider's own terms and privacy policy, not this one. You can revoke a connected assistant's access at any time, and we may revoke access tokens when needed for security.

6. Consultant and Client Workspaces

Consultants, managed service providers, and other advisors can manage several client organizations from one account. Each client has its own workspace. The consultant's account can view and edit that workspace, including its answers, evidence, and generated documents, and is billed for it. Client contacts the consultant adds may receive questions by email; their replies are recorded in the client's workspace. Documents generated for a client workspace may carry the consultant's name as preparer.

In this arrangement the consultant is responsible for having the client's authorization to hold and work on the client's information in CMMC Map, and for telling the client that CMMC Map is the system used. If you are a client and want a copy of your workspace or want it separated from a consultant's account, contact us and we will work it out with both of you.

7. Data Storage and Security

Your data, including uploaded files, is stored in Supabase (PostgreSQL and object storage), hosted in the United States. We use row-level security so each organization can only access its own data. All data in transit is encrypted with TLS. Connector credentials are encrypted at rest under a key held separately from the database. Multi-factor authentication is available for every account and can be required for every member of a workspace. We follow CMMC-aligned security practices, consistent with what we help our customers achieve.

Important: CMMC Map is not an approved CUI storage system. Do not upload actual Controlled Unclassified Information to the platform.

8. Data Retention and Deletion

We keep your account and workspace data for as long as your account exists, whether or not you have a paid subscription, so that a free account's work is never lost. You can delete individual uploaded files yourself at any time.

When you close your account or ask us to delete it, we delete your workspace data and uploaded files within 30 days of the request. We keep billing records, and security and activity records (sign-ins, failed attempts, IP addresses, browser type), for up to 12 months after deletion for fraud prevention, accounting, and legal purposes, then delete them.

9. Cookies and Analytics

Essential cookies: a session cookie that keeps you signed in, a cookie that remembers your appearance setting, and Cloudflare security cookies that protect the site from automated abuse.

Analytics: we use Google Analytics on the public website and inside the application to understand aggregate usage. In the application it records page views only: the path with workspace and record identifiers masked, no query strings, no user identifier, and no workspace content. Google Signals and ad personalization are turned off, and a random cookie identifier links a visit to the website with a visit to the application so we can see whether a page led to a sign-up. No advertising or cross-site tracking cookies are used. You can block analytics cookies in your browser without affecting the service.

10. Sharing of Information

We share data only with the following service providers who process it on our behalf, and only as needed to run the service:

Microsoft and Google act as sources of your own tenant's data when you use an evidence connector (Section 4), and your own AI assistant receives data you direct to it through the MCP connector (Section 5). We may disclose data if required by law, subpoena, or to protect the rights and safety of Hydromation, our users, or the public. If we ever add a service provider that receives personal data, we will update this list before it starts.

11. Your Rights

You can:

To exercise any of these rights, email [email protected]. We respond within 30 days.

12. Children's Privacy

CMMC Map is intended for business use by adults (18+). We do not knowingly collect personal data from anyone under 18. If we learn that a minor has created an account, we will promptly delete the account and associated data.

13. Changes to This Policy

We may update this Privacy Policy as the service evolves. We will notify registered users of material changes by email at least 14 days before they take effect. The effective date at the top of this page reflects the most recent revision.

September 12, 2026 revision: added the evidence connectors, consultant and client workspaces, Google sign-in, analytics inside the application, phone number at sign-up, and multi-factor authentication; restated retention and deletion as they are actually practiced; consolidated contact addresses to [email protected].

October 17, 2026 revision: named the two IP geolocation services (ipinfo.io and ip-api.com) that receive the network address of each visit to the public website.

October 19, 2026 revision: website visit lookups now go to IPinfo alone, for the network's owner and country; approximate location comes from Cloudflare, which already carries the site. ip-api.com no longer receives anything.

14. Contact

Privacy questions or requests:

Hydromation Corporation
12015 US-50 Suite 600
Fairfax, VA 22033
[email protected]