Privacy Policy

Introduction and Overview

Advanced GRC, Inc. (“AGRC,” “we,” “us,” or “our”) and its affiliates are committed to meeting legal and regulatory requirements regarding data protection and privacy. This Privacy Policy (“Policy”) describes how we collect, process, and use personal data (“Personal Data” or “Personal Information”) about individuals — including our business contacts, customers, vendors, and visitors — through our websites and other online features that link to this Policy (the “Sites”). It applies only to our online practices in connection with the Sites and not to offline practices. If you have questions, contact us at privacy [at] advancedgrc.com.

This Policy covers the Sites. Personal information that government agencies submit to our software products is addressed separately in “Our Products and Platform Data” below. By accessing or using the Sites, you agree to this Policy; please do not use the Sites if you disagree with any part of it. We may update this Policy at any time; the “Last Updated” date below shows when it was last revised, and changes become effective when posted.

1. Our Products and Platform Data — When We Act as a Service Provider

We offer software products to government agencies as a service (SaaS) — including ALiS, Resolve, and FDS — that agencies use to carry out their regulatory operations. In the course of using those products, agencies and the individuals who interact with them (such as license and permit applicants, filers, and other members of the public) submit personal information to the products. We refer to this as “Platform Data.”

For Platform Data, the government agency is the controller, and Advanced GRC acts as a service provider (as defined under the CCPA) and a processor (as defined under the GDPR). We access and process Platform Data only to provide and support the product for the agency, to protect its security and integrity, or as required by law, and in accordance with our agreement with the agency. We do not use Platform Data for our own purposes, and we do not sell or share it.

This Privacy Policy does not govern Platform Data; that data is governed by the agency’s agreement with us and by the agency’s own privacy notices. If your personal information was submitted to one of our products by an agency and you wish to access, correct, or delete it, please contact that agency directly. If you contact us instead, we will refer your request to the agency that controls the data, and we may ask you to identify that agency so we can direct your request appropriately.

2. Personal Information

Personal Information We May Collect

We may collect Personal Information through the Sites, such as your name, email address, phone number, company or organization and title, and the content of any message you send us.

How We May Use Personal Information

• to respond to your inquiries and fulfill your requests — for example, to provide information, factsheets, or demonstrations you request;
• to send you updates and communications about our products, services, or topics that may be of interest, in accordance with applicable law (you may opt out at any time);
• to keep a record of your contact information and correspondence and to use it to respond to you;
• to send administrative information, including changes to our terms, conditions, and policies;
• to provide our services;
• for internal business purposes, such as improving the Sites and operating our business; and
• as we believe necessary or appropriate under applicable law (including laws outside your country of residence); to comply with legal process; to respond to requests from public or government authorities; to enforce our terms and conditions; to protect our operations or those of our affiliates; to protect the rights, privacy, safety, or property of AGRC, our affiliates, you, or others; or to pursue available remedies or limit damages.

How Personal Information May Be Disclosed

• to our affiliates, for the purposes described in this Policy; AGRC remains responsible for the management of jointly used Personal Information;
• to third-party service providers that perform services on our behalf — such as website hosting and infrastructure, data analysis, IT services, customer service, email delivery, and auditing — under confidentiality and security obligations, and only to provide services to us;
• in connection with a reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or part of our business, assets, or stock; and
• as we believe necessary or appropriate under applicable law (including laws outside your country of residence); to comply with legal process; to respond to requests from public or government authorities; to enforce our terms and conditions; to protect our operations or those of our affiliates; to protect the rights, privacy, safety, or property of AGRC, our affiliates, you, or others; or to pursue available remedies or limit damages.

We do not sell your Personal Information, and we do not share it with third parties for advertising.

3. Other Information

Other Information We May Collect

“Other Information” is information that does not reveal your specific identity or directly relate to you as an individual, such as browser information; information collected through cookies and pixel tags; demographic and other information you provide; aggregated information; and postal/zip code.

How We May Collect Other Information

• Through your browser: most browsers transmit information such as your device type, operating system, and browser type; we use this to ensure the Sites function properly.
• Using cookies: cookies help us recognize your device, understand how the Sites are used, remember preferences, and improve your experience. You can decline cookies through your browser settings, though some features may not function as intended.
• Using pixel tags and similar technologies: used to measure Sites usage, the success of communications, and response rates.
• IP address: logged automatically in our server logs with the time of visit and pages viewed, and used for purposes such as measuring usage, diagnosing server problems, and administering the Sites.
• From you and by aggregation: information you volunteer (such as company, title, and interests), and aggregated information that does not personally identify you.

We may use and disclose Other Information for any purpose, except where we are required to treat it as Personal Information under applicable law. If we combine Other Information with Personal Information, we will treat the combined information as Personal Information.

4. Third-Party Sites

This Policy does not address, and we are not responsible for, the privacy or other practices of any third parties, including operators of sites to which the Sites link. The inclusion of a link does not imply our endorsement of the linked site.

5. Security

We use reasonable organizational, technical, and administrative measures to protect Personal Information under our control, consistent with the practices described on our Security page. No method of storage or transmission over the Internet is completely secure, however. Please do not send sensitive or confidential information to us by email.

6. Choices and Access

Marketing choices. If you no longer wish to receive marketing-related emails, you may opt out by following the unsubscribe instructions in any such message or by emailing us at privacy [at] advancedgrc.com. We may still send you administrative messages, from which you cannot opt out.

Access and correction. You may request to review, correct, update, suppress, or delete the Personal Information you have provided to us, or object to its use, by writing to us at privacy [at] advancedgrc.com. For your protection, we may need to verify your identity, and we will act on requests as soon as reasonably practicable. Please note that we may retain certain information for record-keeping and legal purposes, and residual information may remain in our records.

7. U.S. State Privacy Rights

Several U.S. states have comprehensive consumer privacy laws, including California (the CCPA, as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas, and others. To the extent one of these laws applies to us and to you as a resident of that state, you may have some or all of the following rights regarding your Personal Information:

• Right to know and access — to confirm whether we process your Personal Information and to access it, including the categories collected, the sources, the purposes, and the categories of third parties to whom it is disclosed;
• Right to delete — to request deletion of your Personal Information, subject to exceptions;
• Right to correct — to request correction of inaccurate Personal Information;
• Right to data portability — to obtain a copy of your Personal Information in a portable format;
• Right to opt out — of the sale or sharing of Personal Information, targeted advertising, and certain profiling. We do not sell or share Personal Information (including for cross-context behavioral or targeted advertising), so there is nothing to opt out of;
• Right to limit sensitive information — to limit the use and disclosure of sensitive Personal Information; we do not use sensitive Personal Information for purposes that require such an option; and
• Right to non-discrimination — we will not discriminate or retaliate against you for exercising your rights.

How to exercise your rights. To submit a request, email us at privacy [at] advancedgrc.com and describe the right you wish to exercise and any relevant details. You may use an authorized agent to submit a request on your behalf; where a state requires it, the agent must provide proof of authorization (and, in California, be registered with the Secretary of State). We will take steps to verify your identity before responding and cannot fulfill a request we are unable to verify.

Our response. We will respond within the time your state’s law requires — generally within 45 days of receipt, extendable by an additional period (up to 90 days total) where permitted, and we will notify you if we need the extension. If we decline a request, we will explain why. Where your state’s law provides a right to appeal a denial, you may appeal by replying to our response, and we will inform you of the outcome.

California “Shine the Light.” California residents may ask whether we disclose Personal Information to third parties for those third parties’ own direct marketing. We do not disclose Personal Information for that purpose.

For Personal Information you submitted to our products, see “Our Products and Platform Data” above — we act as a service provider and will refer your request to the controlling agency.

8. EU / UK Privacy Rights

If you are located in the European Union or the United Kingdom, you may have rights under the GDPR and UK GDPR, including the rights to access, rectify, erase, restrict, or object to the processing of your Personal Information, and the right to data portability. Where we process your Personal Information, we do so on a lawful basis — such as your consent, our legitimate interests, or compliance with a legal obligation. To exercise these rights, contact us at privacy [at] advancedgrc.com.

9. Implementation

We maintain internal arrangements to comply with this Policy, to enable individuals to exercise their rights, and to address concerns. You may exercise your rights or raise a concern by emailing us at privacy [at] advancedgrc.com.

10. Retention Period

We retain Personal Information for as long as necessary to fulfill the purposes described in this Policy. Contact information you provide is stored in our systems and retained for as long as we have, or reasonably expect to have, a business relationship with you or your organization, and thereafter until you ask us to delete it. Automatically-collected information, such as server logs and analytics data, is retained for up to 24 months. We may retain information longer where required or allowed by law.

11. Cross-Border Transfer

Advanced GRC operates in the United States and India. Your Personal Information may be stored and processed in the United States and India, where we and our subsidiary operate. Such access is within our organization only; we do not share your information with third parties. By using our Sites, you consent to the transfer of your information to these countries, which may have data-protection rules different from those in your country.

12. Sensitive Information

We ask that you not send us or disclose any sensitive Personal Information (for example, Social Security numbers, payment-card information, or information related to racial or ethnic origin, political opinions, religion or other beliefs, health, criminal background, or trade-union membership) on or through the Sites or otherwise to us.

13. Contacting Us

If you have any questions about this Policy, contact us at privacy [at] advancedgrc.com, or write to us at Advanced GRC, Inc., 19 Fulton Street, #408, New York, NY 10038 USA. Please note that email communications are not secure; do not include sensitive or confidential information in emails to us.

Last Updated: October 16, 2026