This policy covers CMDash’s marketing site (this site) and the CMDash application (*.cmdash.net). It describes what personal data we collect, why, how long we keep it, and how to exercise your rights over it. For our formal data-processing commitments to customers (sub-processors, transfer mechanisms, breach notification), see the Trust Center and the Data Processing Addendum linked from it.
On this marketing site: with your consent — given in the cookie banner, or changed any time via Cookie settings in the footer — we may use Google Analytics to understand which pages are visited, and a first-party cookie to record which campaign or link first brought you here (so we can tell which marketing works; this attribution cookie is functional, not a Google tracking cookie). Both cookies are covered by the same consent choice: declining refuses them, and Withdraw in Cookie settings removes them and stops analytics immediately. Not every build of this site has Google Analytics configured; where it isn’t, only the attribution cookie is ever in play. Until you make a choice, the attribution cookie is set; declining or withdrawing removes it. The cookie names and durations (the consent cookie, the attribution cookie, the Google Analytics cookies and the load balancer’s session-affinity cookies) are listed in the cookies section of the subprocessor list. Separately from your browser, when you submit a form here or create an account, our servers can send a conversion event (an event name, campaign parameters and region, never your name or email) to Google Analytics; that does not depend on the cookie banner.
If you use the contact form or email us for a white paper: we store the name, work email, company and message you provide, so a person on our team can respond and so we can follow up about CMDash. CMDash includes a HubSpot CRM integration our team can turn on to manage that follow-up more efficiently; when it is off (its default), this data is never sent to HubSpot or any other third-party marketing or CRM tool — see the subprocessor list for whether it is currently on. We never check the box for you — every capture on this site requires you to actively opt in before it is submitted. These rows are kept for as long as they are useful for that follow-up; email privacy@cmdash.com at any time to have yours deleted.
In the CMDash application: account and organization data you or your organization provide directly (name, work email, organization, region), the security posture and compliance data you connect from your own tools, and application usage/audit logs generated by using the product.
Product analytics in the application: the CMDash application records in-app usage events (which screens and features are used, and clicks on links and buttons) with PostHog, a subprocessor. The events carry an opaque user identifier, an opaque organization identifier, plan tier and role; they do not carry names, email addresses, organization names or any compliance, risk or evidence content, and session recording is off. PostHog stores an identifier in your browser’s local storage and a first-party cookie. This runs on our legitimate interest in understanding how the product is used, not on a cookie banner, and it is on by default. An organization’s Owner or Admin can turn it off for the whole organization in Settings, Privacy; there is no per-user switch today. The sign-up and email-verification pages can also load Google Analytics, but only when you arrived from this site after accepting its cookie banner.
Sign-up bot check, sign-in and billing: the sign-up page uses Cloudflare Turnstile to tell people from bots; Cloudflare receives the challenge token, your IP address and browser metadata. If you choose “Continue with Google”, Google receives the fact that you are signing in to CMDash and returns your account identifier, email address and name. Paid subscriptions are billed through Stripe, which receives the billing contact, payment method and invoice details; CMDash stores only a payment-method token and invoice metadata, never the card number.
AI features: some features send text to Anthropic (the Claude model) to generate a result: policy drafting, policy-control link suggestions, questionnaire answers, risk-remediation suggestions and the executive summary run when a user asks for them. The daily AI risk narrative runs overnight, without a click, for each organization whose plan includes it. Depending on the feature, the text sent includes the organization name and risk, policy, evidence or questionnaire text the organization has entered. See the subprocessor list for what each feature sends and where it is processed.
We do not sell personal data, and we do not use customer security-posture data to train third-party models without a separate agreement to do so.
For visitors and customers in the EEA, UK, and Switzerland, we process personal data on one of these bases: performance of a contract (creating and running your CMDash account, billing your subscription), legitimate interests (operating and securing this marketing site, responding to a contact-form or white-paper request, preventing abuse), and consent (the analytics and attribution cookies described above, and any marketing email — both withdrawable at any time, via Cookie settings and the unsubscribe link respectively). We do not rely on legitimate interests for processing where the law requires consent.
Default retention settings for application data. Administrators can change them in the Data Retention page in the application; the nightly purge enforces them for each organization that has saved a retention policy:
These windows are enforced for each organization that has saved a retention policy. For an organization that has not, they are applied only when the operator of the deployment has switched on the default purge; until then the nightly job reports what it would delete and deletes nothing. Snapshots collected from your connected tools are removed once they expire (24 hours after collection) as soon as a newer snapshot has replaced them; the latest snapshot of each connection is kept while the connection exists.
Records that CMDash keeps about its own service are swept every night, whatever an organization has chosen:
When an organization’s Owner deletes the organization, access is revoked immediately and data is fully purged within 30 days. CMDash does not restore an organization after that purge, but copies of its data can remain in database backups taken earlier until those backups expire on the backup schedule of our infrastructure provider.
A workspace on the free plan that nobody signs in to for 60 days is closed and then deleted. Its owners and administrators are e-mailed 30 days and again 7 days before the closure date, and any member signing in before the data is purged keeps the workspace. Its data is purged 14 days after the closure, and a deletion certificate is issued. Paid, trial and contracted workspaces are never closed this way.
CMDash, Inc. is a U.S. company; production data is hosted primarily in AWS’s U.S. regions (see the subprocessor list for each vendor’s processing location). Where personal data originating in the EEA, UK, or Switzerland is transferred to the United States or another country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses — together with the UK Addendum and the Swiss FDPIC-adapted SCCs where those laws apply — with each subprocessor, as set out in full in the Data Processing Addendum.
California residents have the right to know what personal information we collect and why, to request deletion or correction of it, and to opt out of the sale or sharing of personal information — CMDash does not sell or share personal information as those terms are defined by the CCPA/CPRA. To exercise a California privacy right, email privacy@cmdash.com with “California privacy request” in the subject line. We verify your identity before fulfilling an access or deletion request and will not discriminate against you for exercising these rights.
CMDash has not appointed a formal Data Protection Officer or an Article 27 EU/UK representative as of the “last updated” date above. Until one is appointed, direct any data-protection inquiry to privacy@cmdash.com, which reaches the team responsible for these requests today.
To request access to, correction of, or erasure of personal data — including a GDPR Article 17 right-to-erasure request — email privacy@cmdash.com with your organization ID (found in Settings → General → Account, if you’re a CMDash customer), the email address the request concerns, and the nature of the request. We acknowledge requests within 72 hours and complete erasure requests within 30 days.
For data-processing agreements, sub-processor questions, or other contractual privacy matters, email legal@cmdash.com. For general account support, email support@cmdash.com.
If we materially change what we collect or how we use it, we will update this page and change the "last updated" date above. We do not currently have a mailing list for policy changes; check this page directly.
CMDash is operated by CMDash, Inc.. Registered address available on request via support@cmdash.com.