If you want to understand what information AffirmReady collects, how it is used, and how it is protected before you trust us with it, this article explains it in plain language.
The short answer
AffirmReady collects only what it needs to run the service, never sells personal information, and never stores your evidence files. Your evidence stays in your own systems. We do not use your data for advertising, and we do not use it to train AI models.
What we collect
- Account and contact information: your name, business email, company name, job title, and phone number.
- Sign-in and security information: your password (stored only in hashed form), your authenticator app setup (stored encrypted), and recovery codes (stored only in hashed form).
- Billing information: your plan, billing address, and payment status. Stripe processes payment details, and we never store full card or bank account numbers.
- Your readiness information: assessment answers, evidence register entries, notes, and links you add. Links point to your own systems, and we do not access the content behind them.
- Readiness Check summary requests: if you ask us to email you a summary, your name, business email, company name, readiness score, email preferences, and the date of your request. We don't store your individual answers.
- Support messages and website chat: emails you send to support, Help Center feedback you submit, and messages you type into the assistant on our website. Website chats are processed by Microsoft to provide the assistant.
- Usage information: log data, IP address, browser type, pages visited, and feature usage, collected through cookies, browser local storage, and similar technologies, including a page-view counter provided by Polsia.
What you should never enter
AffirmReady is built for Federal Contract Information (FCI) readiness only. Never enter Controlled Unclassified Information (CUI), classified information, or export-controlled technical data such as ITAR or EAR data in any field, note, evidence register entry, or chat. Never enter passwords or sensitive company information in the website chat either. If your company handles CUI, see What is the difference between CMMC Level 1 and Level 2?
How your information is protected
- Data is encrypted in transit.
- Every account must use multi-factor authentication with an authenticator app.
- Passwords and recovery codes are stored only in hashed form, and authenticator setup information is encrypted.
- Internal access is limited to those who need it.
- Because we never store evidence files, the most sensitive records of your security program stay in your own systems.
No system is completely secure. If a breach affects your personal information, we will notify you as required by law, including the Michigan Identity Theft Protection Act.
Who we share it with
We share information only with service providers that help us run AffirmReady, under contracts that limit how they can use it. Today these are Polsia (application hosting, operations, and website analytics), Stripe (payment processing), Resend (account and service emails), Microsoft (business email, support, and the website chat assistant), and Cloudflare (domain and web traffic services). We may also disclose information when required by law, to protect our rights or users' safety, or as part of a merger or sale of the business, with notice to you.
Emails we send
Account and service emails come from notify.affirmready.com and do not track whether you open them or click links. Marketing emails include an unsubscribe link, and you can opt out at any time.
How long we keep it
We keep your account and readiness information while your subscription is active and for 30 days after cancellation, so you can export it. After that, it is deleted, except where the law requires us to keep certain records longer, such as billing records. We delete Readiness Check summary requests 12 months after the request unless you become a customer.
Your choices
You can access, correct, export, or delete your personal information through your account or by emailing support@affirmready.com. Depending on where you live, you may have additional rights under state privacy laws, and we honor verified requests as required.
The official policy
This article summarizes AffirmReady's Privacy Policy in plain language. If anything here differs from the Privacy Policy, the Privacy Policy controls.
Still need help?
If you have a privacy question or request, email support@affirmready.com and include your company name. Our team is available Monday through Friday, 8:00 AM to 5:00 PM Eastern, and replies within one business day.