--- title: Privacy Commitment | MIGHTY GRC description: MIGHTY GRC's privacy commitment to its customers and partners. --- [Skip to content](https://mightygrc.com/privacy#main-content) [![MIGHTY GRC company logo M](https://mightygrc.com/hs-fs/hubfs/Screenshot%202026-05-20%20at%2010.52.57%20AM.png?width=372&height=420&name=Screenshot%202026-05-20%20at%2010.52.57%20AM.png)Homepage](https://mightygrc.com/?hsLang=en) - Products - [PolicyPilot](https://mightygrc.com/products/policypilot?hsLang=en) - [RiskSnap](https://mightygrc.com/products/risksnap?hsLang=en) - [BudgetLens](https://mightygrc.com/products/budgetlens?hsLang=en) - Pricing - [SMB Pricing](https://mightygrc.com/policypilot-pricing?hsLang=en) - [Partner Program](https://mightygrc.com/policypilot-partner-pricing?hsLang=en) - Resources - [MIGHTY Blog](https://mightygrc.com/mighty-blog?hsLang=en) - [SMB Policy Guide](https://mightygrc.com/small-business-policy-guide?hsLang=en) - Tabletop Exercises - [Email Compromise](https://mightygrc.com/tabletop-exercise/business-email-compromise?hsLang=en) - Ransomware Event (coming soon) - Company - [The MIGHTY Mission](https://mightygrc.com/about-mighty-grc?hsLang=en) - [Contact Our Team](https://mightygrc.com/contact?hsLang=en) - [Privacy Policy](https://mightygrc.com/privacy) - [Blog](https://mightygrc.com/mighty-blog?hsLang=en) - [GET A DEMO](https://mightygrc.com/policypilot-demo?hsLang=en) LOG IN - Products - [PolicyPilot](https://mightygrc.com/products/policypilot?hsLang=en) - [RiskSnap](https://mightygrc.com/products/risksnap?hsLang=en) - [BudgetLens](https://mightygrc.com/products/budgetlens?hsLang=en) - Pricing - [SMB Pricing](https://mightygrc.com/policypilot-pricing?hsLang=en) - [Partner Program](https://mightygrc.com/policypilot-partner-pricing?hsLang=en) - Resources - [MIGHTY Blog](https://mightygrc.com/mighty-blog?hsLang=en) - [SMB Policy Guide](https://mightygrc.com/small-business-policy-guide?hsLang=en) - Tabletop Exercises - [Email Compromise](https://mightygrc.com/tabletop-exercise/business-email-compromise?hsLang=en) - Ransomware Event (coming soon) - Company - [The MIGHTY Mission](https://mightygrc.com/about-mighty-grc?hsLang=en) - [Contact Our Team](https://mightygrc.com/contact?hsLang=en) - [Privacy Policy](https://mightygrc.com/privacy) - [Blog](https://mightygrc.com/mighty-blog?hsLang=en) - [GET A DEMO](https://mightygrc.com/policypilot-demo?hsLang=en) LOG IN # Privacy Policy ![MIGHTY GRC logo for About Company Mission Page](https://mightygrc.com/hubfs/MIGHTY%20GRC%20logo%20for%20About%20Company%20Mission%20Page.png "MIGHTY GRC logo for About Company Mission Page") **Effective Date:** October 27th, 2026 ### Friendly Version At MightyGRC, we believe that trust is earned through transparency, responsible practices, and respect for the people and businesses we serve. - **We don't sell your personal information.** - **The MIGHTY platform has no advertising trackers.** - **Our website runs on HubSpot**, which uses cookies to understand site usage and manage contact requests. You can manage them through the cookie banner. - **Payment card details go straight to our payment processor.** They never touch our servers. - **You can ask for a copy of your data, or for us to delete it**, at any time by emailing **[privacy@mightygrc.com](mailto:privacy@mightygrc.com).**   ## Privacy Policy Contents 1. [Who we are and what this policy covers](https://mightygrc.com/privacy#section-1) 2. [Information we collect](https://mightygrc.com/privacy#section-2) 3. [How we use information](https://mightygrc.com/privacy#section-3) 4. [Cookies and similar technologies](https://mightygrc.com/privacy#section-4) 5. [How we share information](https://mightygrc.com/privacy#section-5) 6. [Sale and sharing of personal information](https://mightygrc.com/privacy#section-6) 7. [How long we keep information](https://mightygrc.com/privacy#section-7) 8. [How we protect information](https://mightygrc.com/privacy#section-8) 9. [Your choices and rights](https://mightygrc.com/privacy#section-9) 10. [Children](https://mightygrc.com/privacy#section-10) 11. [Changes to this policy](https://mightygrc.com/privacy#section-11) 12. [Contact us](https://mightygrc.com/privacy#section-12) ## 1. Who we are and what this policy covers MightyGRC LLC is the company responsible for the Services. Our contact details are in [section 12](https://mightygrc.com/privacy#section-12). In this policy, "MightyGRC," "we," "us," and "our" mean MightyGRC LLC. The "Website" is our marketing website at [mightygrc.com](https://mightygrc.com?hsLang=en). The "Platform" is our web application at [app.mightygrc.com](https://app.mightygrc.com), including PolicyPilot and our other apps. The "Services" are the Website, the Platform, and the related sales, support, and billing we provide. **Information we control.** This policy describes how we handle the personal information we collect for our own purposes. That includes Website visitor data, sales and support communications, Platform account information, and billing records. **Information we process for our customers.** When an organization uses the Platform, it enters information about its own business and people, such as its key personnel and the content of its policies. We process that "Customer Content" on the organization's behalf, as a service provider (sometimes called a "processor"), under our agreement with that organization. The organization decides what to enter and is responsible for its own privacy obligations to its people. If your information is in an organization's Customer Content and you want to access, correct, or delete it, please contact that organization. This policy doesn't cover third-party websites or services that we link to, including Google, Microsoft, Stripe, and the social networks linked from our Website. Their own privacy policies apply. ## 2. Information we collect ### On our Website Our Website is hosted on HubSpot. When you visit it, HubSpot collects the following on our behalf: - **Usage and device information:** the pages you view, how long you stay, the page or site that referred you, your browser and device type, and your IP address. We may use your IP address to estimate your general location, such as your city or country. - **Information you submit:** when you fill out a form (for example, to contact us or request a demo), we collect what you enter. This is typically your name, email address, company, job title, phone number, and your message. HubSpot also captures submissions from other forms on our Website. If you've already visited the Website, HubSpot links the form submission to your earlier browsing history on our Website. - **Email engagement:** when we send you marketing email, HubSpot records whether you opened it and which links you clicked. - **Advertising information:** if you interact with our ads on Meta (Facebook and Instagram), LinkedIn, or Google, those platforms may tell us that you clicked or viewed an ad. If you fill out a lead form inside one of those platforms, they send us what you entered there. ### On the Platform - **Account information:** your name, email address, and Google or Microsoft account identifiers; when you joined and last signed in; your display preferences and other settings; your in-app notifications; and which organizations you belong to and your roles in them. - **Customer Content:** information your organization enters, such as its profile and answers about its security practices, its policy content, and the names, job titles, email address, and phone numbers of key personnel it designates. Key personnel may not have an account. - **Billing information:** your organization's name and billing email, its plan and subscription status, and Stripe customer and subscription identifiers. Stripe holds card details, billing address, and tax ID; we don't. - **Discount eligibility:** for a nonprofit discount, the organization's EIN and its name as listed in IRS records; for an ownership discount, whether the business says it is veteran-, women-, or minority-owned. - **Activity (audit) log:** who performed an action, when, what it affected, the person's name and email at the time, and their IP address. - **Server logs:** error and operational logs. These may include an email address or account ID. ### When you contact us If you email us or contact our support team, we keep the conversation and your contact details. ### From other people and organizations - **Your organization or partner:** an administrator at your organization, or at a partner acting for it (such as a managed service provider), may create an account for you or list you as key personnel. This gives us your name and email address, and may include your job title and phone number. - **Google and Microsoft:** when you sign in, they send us your name, your email address, whether that address is verified, and an account identifier. - **Stripe:** Stripe tells us about your payment and subscription status. - **ProPublica Nonprofit Explorer:** when an organization claims a nonprofit discount, we look up its EIN in this public database of IRS records. ## 3. How we use information We use personal information to: - **Provide the Services:** create and secure accounts, sign you in, run the Platform's features, and send service messages such as policy review reminders. - **Handle billing:** process payments, apply discounts, and manage subscriptions. - **Support you:** answer questions, fix problems, and respond to demo and contact requests. - **Keep the Services secure:** prevent and investigate fraud, abuse, and security incidents, and keep audit records. - **Improve our Website:** understand which pages people visit and how they find us. - **Meet legal obligations:** keep required records, respond to lawful requests, and enforce our agreements. - **Send marketing emails:** send news, product updates, and educational content about MightyGRC. You can unsubscribe at any time (see [section 9](https://mightygrc.com/privacy#section-9)). - **Advertise:** show ads for MightyGRC on Meta, LinkedIn, and Google to people who may be interested, including people who have visited our Website, and measure how well those ads work. ## 4. Cookies and similar technologies Cookies are small text files a website stores in your browser. ### Website cookies (HubSpot) The Website uses HubSpot cookies to count and understand visits, to recognize returning visitors, and to remember your cookie choices. When you first visit, a cookie banner lets you accept or decline non-essential cookies. You can change your choice at any time through the banner's settings link. You can also block or delete cookies in your browser settings. For the specific cookies HubSpot uses, see HubSpot's current list at [knowledge.hubspot.com](https://knowledge.hubspot.com/privacy-and-consent/what-cookies-does-hubspot-set-in-a-visitor-s-browser). ### Advertising cookies and pixels If you accept advertising cookies, our Website may load tracking pixels from Meta, LinkedIn, and Google. These let those platforms recognize you as a visitor to our Website, show you our ads, and tell us how our ads perform. We may also upload a hashed (scrambled) version of business contacts' email addresses to these platforms. They use it to show our ads to matching users or to similar audiences, and to leave out existing customers. You can limit advertising tracking through the cookie banner, the Global Privacy Control signal (see below), and each platform's ad settings: [Meta](https://www.facebook.com/adpreferences), [LinkedIn](https://www.linkedin.com/psettings/advertising), and [Google](https://myadcenter.google.com). You can also use the industry opt-out tools at [optout.aboutads.info](https://optout.aboutads.info) and [optout.networkadvertising.org](https://optout.networkadvertising.org). ### Platform cookies The Platform uses cookies to sign you in, keep your session secure, and carry you through sign-in or an invitation link. These cookies are required for the Platform to work, so they can't be switched off. ### Do Not Track and Global Privacy Control The Platform has no analytics or advertising tracking for browser signals to switch off. For the Website, please use the cookie banner instead of a "Do Not Track" signal. On our Website, we treat a Global Privacy Control (GPC) signal from your browser as a request to opt out of the sale or sharing of your personal information for that browser, as described in [section 6](https://mightygrc.com/privacy#section-6). ## 5. How we share information ### Service providers We use the following companies to run the Services: | Provider | What they do for us | What they receive | | --- | --- | --- | | **HubSpot** | Hosts our Website and provides website analytics, the cookie banner, forms, and contact management | Website usage data, form submissions, and contact records | | **Google** and **Microsoft** | Sign-in ("Sign in with Google" and "Sign in with Microsoft") | They know when you sign in to the Platform. We receive the profile information listed in [section 2](https://mightygrc.com/privacy#section-2). | | **Stripe** | Payment processing, invoices, and the billing portal | Billing contact details, payment information, and subscription details | | **ProPublica** | Looks up nonprofit status in public IRS records | Only the EIN being checked | | **Cloud hosting providers** | Host the Platform's servers and database | All Platform data | | **Email delivery provider** | Sends service emails, such as policy review reminders | Recipient email address and message content | | **Security and content delivery providers** | Protect the Services from abuse and deliver static files to your browser | IP address and browser information | ### Advertising platforms When advertising cookies are allowed, Meta, LinkedIn, and Google receive information about visits to our Website. They may also receive hashed business contact information, as described in [section 4](https://mightygrc.com/privacy#section-4). These platforms use the information for their own purposes too, under their own privacy policies. ### Within your organization and its partners - **Your organization:** people with the right roles in your organization can see its information on the Platform. This includes the member list, key personnel, policy content, and the activity log of actions taken in that organization. - **Partners your organization connects:** an organization can grant roles to a partner, such as a managed service provider. People the partner assigns can then access the organization's information on the Platform, within those roles. ### Legal, safety, and business transfers We may disclose personal information: - if the law requires it, or in response to a valid subpoena, court order, or other request from a public authority; - to protect the rights, property, or safety of MightyGRC, our customers, or others, including to prevent fraud or abuse; - as part of a merger, acquisition, financing, or sale of all or part of our business; - with your consent, or at your direction. ## 6. Sale and sharing of personal information We don't sell or share personal information, except for the advertising described below. **Advertising and your right to opt out.** Some state privacy laws treat certain online advertising as a "sale" or "sharing" of personal information, or as "targeted advertising." This includes letting advertising platforms' pixels collect information on our Website, or sending them hashed contact lists, as described in [section 4](https://mightygrc.com/privacy#section-4). The categories involved are identifiers (such as cookie IDs, IP addresses, and hashed email addresses) and internet activity on our Website. You can opt out at any time in any of these ways: - decline advertising cookies in our Website's cookie banner; - turn on Global Privacy Control in your browser; or - email [privacy@mightygrc.com](mailto:privacy@mightygrc.com) with the subject "Do Not Sell or Share." Opting out through the banner or GPC applies to the browser you use. To make sure we also leave you out of contact list uploads, email us. ## 7. How long we keep information - **Platform accounts:** kept for as long as your account exists. If your account is deleted, we delete or anonymize your account information, except for what's described below. - **Organization data and Customer Content:** kept for as long as the organization uses the Platform. When an organization is deleted, it goes to a recycle bin, where it can be restored for 30 days. After that, it's permanently deleted, along with its members' roles, policy content, and partner connections. - **Website contacts:** we keep form submissions and contact records until you ask us to delete them. - **Unsubscribes:** if you unsubscribe from our marketing emails, we keep your email address on a suppression list so we don't email you again. - **Website analytics:** HubSpot keeps browsing activity for as long as the contact record or cookie it belongs to exists. - **Billing and tax records:** kept for as long as tax, accounting, and other laws require, generally up to 7 years. Stripe keeps its own records under its own policy. - **Discount eligibility:** kept as long as the discount applies, plus as long as tax and accounting law requires. - **Activity (audit) log:** kept indefinitely, even after the account or organization it describes is deleted, because it's needed to investigate security incidents and to show who changed what. - **Server logs:** kept for 7 days. - **Backups:** deleted data may remain in encrypted database backups for up to 30 days, until those backups are overwritten. ## 8. How we protect information We use reasonable administrative, technical, and physical safeguards designed to protect personal information, suited to the sensitivity of the information, including: - encryption in transit and at rest - access controls that limit each person to what their role needs - logging of sensitive actions - payment card handling by Stripe, a PCI-compliant processor. No system is perfectly secure, and we can't guarantee the security of information. ## 9. Your choices and rights ### Your choices - **Account settings:** update your display name and preferences on your account page. - **Cookies:** use the Website's cookie banner or your browser settings. - **Marketing email:** click "unsubscribe" in any marketing email, or email us. We'll still send service messages about your account, such as billing notices and policy review reminders. ### Rights under U.S. state privacy laws Depending on where you live, state privacy laws may give you the right to know what personal information we've collected about you, its sources, why we collected it, and whom we've disclosed it to; to get a portable copy of it; to correct or delete it; and to opt out of its sale or sharing, targeted advertising, and profiling (see [section 6](https://mightygrc.com/privacy#section-6)). We won't discriminate against you for using these rights. We use sensitive personal information only to provide the Services, and never to infer characteristics about anyone. To make a request, email [privacy@mightygrc.com](mailto:privacy@mightygrc.com). If you have a Platform account, please send it from the email address on your account. We verify requests by matching them with what we have, usually through your account email address. An authorized agent can make a request for you. We may ask them for proof that you authorized them, and ask you to confirm your identity directly. If we decline a request, you can appeal by replying to our decision or by emailing [privacy@mightygrc.com](mailto:privacy@mightygrc.com) with the subject "Privacy request appeal." If you disagree with the outcome, you can contact your state attorney general. **California notice.** In the past 12 months we've collected the categories of personal information below, from the sources and for the purposes described in [sections 2](https://mightygrc.com/privacy#section-2) and [3](https://mightygrc.com/privacy#section-3). We disclose them for business purposes to the service providers described in [section 5](https://mightygrc.com/privacy#section-5), and we retain them as described in [section 7](https://mightygrc.com/privacy#section-7). | Category (California law) | Examples | Sold or shared? | | --- | --- | --- | | Identifiers | Name, email address, IP address, account and cookie identifiers | No, except for the advertising described in [section 6](https://mightygrc.com/privacy#section-6) | | Customer records | Name, phone number, job title, and billing details | No | | Commercial information | Plans and subscriptions purchased | No | | Internet or network activity | Website page views and interactions, and actions recorded in the Platform's activity log | No, except for the advertising described in [section 6](https://mightygrc.com/privacy#section-6) | | Approximate geolocation | City or region estimated from IP address | No | | Professional information | Employer, job title, and role within your organization | No | | Sensitive personal information | Self-disclosed veteran-, women-, or minority-owned status of a business, where it relates to an individual | No | ## 10. Children The Services are for businesses and aren't directed to children. We don't knowingly collect personal information from anyone under 18. ## 11. Changes to this policy We may update this policy from time to time. When we do, we'll post the new version here and change the "Last updated" date at the top. ## 12. Contact us If you have questions about this policy or how we handle personal information, or want to make a privacy request, contact us: > **MightyGRC LLC** > Attn: Privacy > 13023 NE Hwy 99 #7-117 > Vancouver, WA 98686 > [privacy@mightygrc.com](mailto:privacy@mightygrc.com) ![Screenshot 2026-06-16 at 4.49.38 AM](https://mightygrc.com/hs-fs/hubfs/Screenshot%202026-06-16%20at%204.49.38%20AM.png?width=3244&height=1258&name=Screenshot%202026-06-16%20at%204.49.38%20AM.png) ## MIGHTY GRC MIGHTY is GRC software custom built for small teams to simplify compliance and risk management. Generate policies, assess risk, and stay compliant in one streamlined platform designed for SMBs. - Products - Pricing - Resources - Company - [Blog](https://mightygrc.com/mighty-blog?hsLang=en) - [GET A DEMO](https://mightygrc.com/policypilot-demo?hsLang=en) --- Privacy Policy · Legal · © 2026. All rights reserved.