Privacy Policy
Last updated 14 September 2026
This policy explains what personal data SmarterGRC processes, why, and the choices you have. It covers visitors to smartergrc.com, the people who register and administer an organization, and the people whose data an organization brings into the service.
1. Two roles
For your organization’s data — the workforce, accounts, vendors, risks and policies you manage in SmarterGRC — your organization is the controller and we are the processor: we process it on your instructions to provide the service. For account, billing and website data we are the controller.
2. What we collect and why
| Data | Source | Purpose |
|---|---|---|
| Name, work email, company, role | Registration, invitations, sign-in | Create and secure accounts; send service notices |
| Payment method details (brand, last four digits, expiry) and invoices | Your payment provider token | Bill the plan. We never receive or store full card numbers. |
| Sign-in events, IP address, browser | Your use of the service | Security, fraud prevention, audit trail |
| Data from connected systems (users, groups, accounts, devices, projects, findings) | Integrations you authorise | Run the GRC modules on your behalf |
| Documents you upload and the AI-assisted output | You | Import and draft policies, risks, vendors |
3. AI assistance
Some features send text you provide to a large-language-model service running in our cloud provider’s environment to classify documents or draft content. The content is used only to produce your result; it is not used to train models.
4. Where data lives and who sees it
Data is hosted on Google Cloud in the United States. Each organization’s data is isolated at the database level and accessible only to that organization’s members. Our operators access customer data only to provide support or keep the service secure, and every such access is logged. We use sub-processors for hosting (Google Cloud), identity (Auth0), transactional email (Postmark) and payments; a current list is available on request.
5. Retention
Organization data is kept while the organization is active and deleted within 30 days of closure. Audit logs and invoices are kept as long as the law requires. Deleted documents are purged 30 days after deletion.
6. Your rights
You may access, correct, export or delete your personal data, and object to or restrict processing where the law provides. Members of an organization should contact their administrator first, as the controller; anyone may write to privacy@smartergrc.com. You may also complain to your data-protection authority.
7. Cookies
We use only the cookies needed to keep you signed in and to protect forms. There is no advertising or cross-site tracking.
8. Changes
We will announce material changes to this policy at least 30 days before they take effect.