Who We Are
ClearanceIQ Inc. ("ClearanceIQ," "we," "us," or "our") is a Delaware corporation providing a free cybersecurity compliance assessment tool and related advisory services for small and mid-size aerospace and defense companies. This policy applies to clearanceiq.io and any subdomains, the embedded assessment tool, and any related services we offer.
ClearanceIQ is an independent, privately operated company. We are not affiliated with, operated by, or acting on behalf of the U.S. Department of Defense, DCSA, DHS, or any other government agency. Use of our tools creates no government record.
Data We Collect
We separate what we collect into three tiers, based on what action you take on the site.
Tier 1 — Anonymous visitors (most users)
If you visit the site and take the CMMC assessment without entering your email, we collect:
| Data | Source | Purpose |
|---|---|---|
| Page views, time on site, device type, browser, approximate location (country/region) | Google Analytics | Understand traffic and improve the site |
| Session behavior — clicks, scrolling, navigation | Microsoft Clarity | Identify confusing steps in the assessment |
| Your overall assessment score and risk category (e.g. "67% — Moderate Risk") | Calculated in your browser, then logged anonymously | Aggregate market research — never linked to your identity |
We do not collect or store your individual question-by-question answers. Scoring happens entirely in your browser using JavaScript; only the final score and risk bucket are logged, and never alongside any identifying information.
Tier 2 — If you submit your email
If you choose to enter your email to receive a PDF copy of your results, we additionally collect:
| Data | Purpose |
|---|---|
| Email address | To send your PDF report and, if you opt in, occasional compliance updates |
| Your assessment score and risk category | To personalize the report we send you |
| Self-reported role, sector, and company size (if provided) | To tailor follow-up guidance to your situation |
Tier 3 — If you book a consultation or become a client
If you schedule a free compliance review or engage our paid services, we additionally collect your name, company name, phone number, and any information you choose to share during that engagement, including compliance documentation if you become a client. Client engagement data is governed by a separate services agreement and is subject to additional confidentiality protections described in that agreement.
How We Use Your Data
- To calculate and display your CMMC readiness score (performed in your browser — not on our servers)
- To send you a PDF copy of your assessment results, if requested
- To follow up regarding a free compliance review you booked
- To improve the assessment tool based on aggregate, anonymized usage patterns
- To understand market-wide compliance trends across the aerospace and defense sector (using only anonymous score data, never tied to identity)
- To deliver services you have contracted us to provide
- To comply with legal obligations
We never use your data to train third-party AI models without consent, never sell your data to data brokers, never share your assessment answers with your prime contractor or any government body, and never use your data for advertising or retargeting.
Legal Basis for Processing
For visitors in jurisdictions that require a stated legal basis for data processing (such as the EU/UK under GDPR), we rely on:
- Consent — for analytics cookies (Google Analytics, Microsoft Clarity), which only load after you accept our cookie banner
- Consent — for email collection, which requires you to affirmatively enter your email and accept our stated terms at the point of collection
- Legitimate interest — for anonymous, aggregate score data used to improve the product and understand market trends, which contains no personal data
- Contract performance — for data collected in the course of delivering paid services to clients
How We Protect Your Data
- Email addresses are encrypted at rest using AES-256 encryption
- All data in transit is protected with TLS 1.3 encryption
- Access to systems containing personal data is restricted to named individuals on a need-to-know basis
- We maintain an audit log of access to lead and client data
- Assessment scoring happens client-side in your browser — your specific answers are never transmitted to or stored on our servers
No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you in accordance with applicable law.
Data Retention
| Data type | Retention period |
|---|---|
| Anonymous assessment scores (no PII) | Retained indefinitely for aggregate market research |
| Email address and lead data | 24 months from last interaction, or until you request deletion, whichever is sooner |
| Client engagement data | Per the retention terms in your services agreement, typically 7 years for compliance and audit purposes |
| Analytics cookie data | 13 months (Google Analytics) / 12 months (Microsoft Clarity), per provider default settings |
Your Rights
Regardless of where you live, we extend the following rights to anyone whose data we hold:
Access
Request a copy of what data we hold about you
Correction
Ask us to fix inaccurate information
Deletion
Request permanent removal of your data
Portability
Receive your data in a portable format
Opt-out
Unsubscribe from emails or analytics at any time
Object
Object to certain types of processing
To exercise any of these rights, email privacy@clearanceiq.io. We respond to all requests within 30 days, and typically within 24–48 hours for simple deletion requests.
California Privacy Rights (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you additional specific rights:
- The right to know what personal information we collect, use, and disclose
- The right to delete personal information we have collected from you
- The right to correct inaccurate personal information
- The right to opt out of the sale or sharing of personal information — we do not sell or share personal information, so there is nothing to opt out of
- The right to limit use of sensitive personal information
- The right to non-discrimination for exercising any of these rights
To submit a CCPA request, email privacy@clearanceiq.io with the subject line "California Privacy Request." We will verify your identity using your email address before fulfilling the request.
European Privacy Rights (GDPR)
If you are located in the European Economic Area or United Kingdom, the General Data Protection Regulation gives you the rights described in Section 9 above, plus:
- The right to lodge a complaint with your local supervisory authority
- The right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
- The right to restrict processing under certain circumstances
We do not currently maintain an EU representative, as our services are primarily directed at the United States aerospace and defense supply chain. If this changes, this policy will be updated accordingly.
Government & Law Enforcement Requests
We do not proactively share any data with the Department of Defense, DCSA, or any other government agency. We will only disclose data in response to a legally valid, binding request (such as a subpoena, warrant, or court order), and only to the extent legally required. We do not promise that disclosure will never occur in such circumstances, as we must comply with valid legal process — but we commit to disclosing the minimum data necessary to satisfy any such request.
Children's Privacy
ClearanceIQ is a business-to-business service intended for use by professionals in the aerospace and defense industry. Our services are not directed at, and we do not knowingly collect personal information from, anyone under the age of 18. If we learn we have inadvertently collected such information, we will delete it promptly.
Changes to This Policy
We may update this policy from time to time as our services evolve or to reflect changes in applicable law. Material changes will be reflected by an updated "Last updated" date at the top of this page. We encourage you to review this policy periodically.
Contact Us
For any questions about this policy, to exercise your privacy rights, or to request deletion of your data, reach out using the details below.