PolicyReadinessPrivacy Policy
Last updated: October 25, 2026
1. Who we are
PolicyReadiness is run by PREMIO, 711 E Ascension St S251, Gonzales LA 70737. You can reach us at legal@policyreadiness.com. For data protection questions, contact legal@policyreadiness.com.
2. What we collect
- Account details: your email address, your name if you give it, and a password. We store the password only as a salted hash that we cannot read back.
- Company information you enter: your company name, your controls, your policies, and your answers in the readiness check, the AI Use Policy draft, and the staff survey.
- Evidence files you upload: the documents you give us as proof of a control. Each file is checked, scanned for malware, and given a SHA-256 fingerprint when stored.
- Settings read from Microsoft 365 or Google Workspace, if your company connects one: the organization name, the user accounts with their names, email addresses, admin roles, MFA registration and last sign-in, the devices known to the service with their type, model, user, and disk encryption, and the public email records (SPF, DKIM, DMARC) of your domains. These readings are stored as evidence. For the connection itself we store your Microsoft tenant ID, or your Google customer ID, domain, and the email address of the admin who connected. We store no password and no refresh token.
- Partner applications: when you apply to the partner program, your name, work email, company, website, the kind of company, the number of clients you expect, who would review the evidence, and your message.
- Contact and sign-up details: an email address you give us through a form, a lead form, or the contact page. When you send a free security assessment for review, we also store your answers, your score, your company name, and the details you enter in that form.
- Sign-in and security records: session tokens (stored as hashes), failed sign-in counts, and the activity record of your company.
- Error reports: when a script on one of our pages fails, your browser sends us the error, the page it happened on (without names or IDs), and the name and version of your browser, so we can fix it.
- Cookies and counters: see section 6.
3. Why we use your data, and our legal basis
| Purpose | Legal basis (GDPR Article 6) |
|---|---|
| Running your account, storing your evidence, and producing your readiness report | Performance of a contract |
| Keeping the service secure, preventing abuse, and keeping the activity record | Our legitimate interest in a safe service |
| Counting visits and sign-ups in total, with no personal data | Our legitimate interest in knowing whether the site works |
| Knowing which pages bring people in (the ch_ft cookie) | Your consent, given with the Accept button |
| Reviewing a partner application and answering you | Steps you asked for before a contract |
| Keeping records the law requires, such as invoices | Legal obligation |
We do not sell your data.
4. Who helps us run the service
We share data only with the companies below, and only as far as they need it to do their job.
| Company | What they do for us |
|---|---|
| Cloudflare, Inc. | Hosts the site and the API, stores records (D1) and files (R2), and runs the page security. |
| Anthropic, PBC | Runs the AI reviews and drafts. See section 5. Anthropic is our processor under its data processing addendum, which is part of its Commercial Terms. Anthropic does not train its models on what we send, and by default deletes it within 30 days. |
| Resend | Sends our emails, such as the sign-in confirmation and the password reset link. |
| Stripe, Inc. | Takes payments for paid plans, if you buy one. We do not store card numbers. |
The virus scanner runs in our own container, and no outside company receives your files for scanning.
When your company connects Microsoft 365 or Google Workspace, we read the settings above from Microsoft or Google, on your instruction and with read-only access. We do not send them your evidence.
Partners. If your company's plan comes from a partner of ours, such as an insurance broker, an agent, or an IT provider, that partner's staff can see your company's data in PolicyReadiness. If the partner reviews its clients itself, its staff also review your evidence and sign off your assessment. The partner pays us for your plan. A partner sees its own clients only.
5. How AI review works
When an analyst or the AI reviews an evidence file, the file text and the control it supports are sent over HTTPS to Anthropic's Claude API. Anthropic returns a verdict and a reason. We keep the verdict and the reason. We do not keep the file text after the review. You can ask for a human review of any verdict. A reading from Microsoft 365 or Google Workspace is reviewed the same way as a file.
When you use the AI Use Policy draft, we send Claude your five answers, your approved and banned tools, and the totals of your staff survey. We never send what staff wrote in their own words. When you ask the advisor a question, we send your question, your recent messages with the advisor, and a summary of your controls, reviews, plan, and survey totals. Your files and the comments staff wrote in the survey are not sent.
6. Cookies and similar tools
| Name | What it does | How long | Needs consent? |
|---|---|---|---|
| ch_session | Keeps you signed in. Only the server reads it. | Until you sign out, or as set at sign-in | No. The service cannot work without it. |
| ch_demo | Lets you open the read-only demo. | 24 hours | No. The service cannot work without it. |
| ch_ft | Remembers how you first found the site: the campaign link, the referring site, and the first page you opened. | 90 days | Yes. It is written only if you click Accept. |
Visit and sign-up counts are kept as totals for each day. They use no cookie and store no name, email, or address. If you refuse the ch_ft cookie, the site works the same.
Change your choice: click Cookie settings in the footer of any site page. You can change your choice at any time.
7. How long we keep data
- Account details: for as long as your account is active, and for 24 months after you close it.
- Evidence files and their review records: for the life of your account, then deleted within 90 days of account closure.
- Activity records: 12 months, because they show what happened to your company's evidence.
- Error reports: 30 days.
- Database backups: up to 30 days, after which they are overwritten.
- Payment records: 3 years, as tax law requires.
8. Where data is processed
Our providers may process data outside the European Economic Area, including in the United States. Where they do, we rely on the European Commission's Standard Contractual Clauses to ensure your data receives an equivalent level of protection. Where a provider is certified under the EU-US Data Privacy Framework, we may also rely on that certification.
9. Your rights
Under the GDPR, you can:
- ask for a copy of your data;
- ask us to correct data that is wrong;
- ask us to delete your data;
- ask us to limit how we use it;
- ask for your data in a format you can take elsewhere;
- object to our use of your data based on our legitimate interest;
- withdraw your consent at any time, for example by using Cookie settings.
To use a right, write to support@policyreadiness.com. We answer within one month. You may also complain to your national data protection authority.
10. Children
PolicyReadiness is for businesses. It is not for anyone under 16.
11. Changes to this policy
When we change this policy, we will change the date at the top. For large changes, we will tell account holders by email.
Cookie choices
The notice at the bottom of the page asks you to accept or reject the ch_ft cookie. Use the Cookie settings link in any footer to change your choice.