Privacy Policy

Last updated: July 3, 2026

This policy explains what information GRCMigrate LLC ("GRC Migrate," "we," "us") collects through grcmigrate.com and our tools, and what we do with it. Short version: we collect what you give us plus standard analytics, we use it to respond to you and improve the Site, we never sell it, and software vendors never receive it.

What we collect

Information you submit. Form submissions (consultation requests, newsletter signup, assessment responses including the situation you select, scan early-access requests, partner inquiries) - typically your name, email, company, and your answers. Forms are processed by Netlify Forms; consultation scheduling runs on our own booking system backed by Google Calendar (your name, email, and the meeting details go on the calendar invite).

Scan summaries you choose to share. Our Migration Readiness Scan runs locally on your machine; nothing leaves it unless you use the explicit share action, which shows you the exact payload before sending. Shared summaries contain aggregate statistics only (readiness score, record counts by category, flag tallies, platform, complexity tier) plus the email you enter - never record-level data from your systems.

Analytics. We use Google Analytics 4 to understand Site usage (pages viewed, approximate location, device type, and interaction events such as which assessment path visitors choose). GA4 uses cookies; you can block them with standard browser controls and the Site works fine without them.

How we use it

To respond to your requests, deliver assessments and reports you ask for, send the newsletter you signed up for (unsubscribe anytime, one click), qualify and - only with your consent - introduce you to an implementation partner, improve the Site, and publish aggregate research.

Benchmark research. Scan summaries shared with consent contribute to our migration benchmark dataset in anonymized form: stripped of your email, company, and any identifier, and stored separately from your contact information. Published research uses only aggregates.

Partner introductions. If you ask us to connect you with a partner, we share a summary of your situation and your contact details with ONE partner, tell you we did, and disclose that the partner compensates us. We do not sell leads, share your information with multiple firms, or pass it to software vendors.

How we handle quote data

If you send us a platform quote or renewal for review (via the quote-review form or by emailing hello@ with a "Quote review" subject), here is exactly what happens to it. A human reads it - quote reviews are not processed by an automated pipeline. It may contribute to our aggregate pricing benchmarks in anonymized form only: the benchmark record is limited by our software to headcount band, frameworks, platform, amount, date, and a confidence label - your company name, your contact details, and the quote document itself are excluded by construction, not by policy alone. The quote content is then deleted: quote text and amounts are flagged for deletion 30 days after arrival and removed from our records after a manual confirmation step (we keep the fact that a review happened, for our own follow-up, but not the quote). Your company is never named in any benchmark, publication, or dataset.

Who else touches your data

Service providers that process data on our behalf: Netlify (hosting and forms), Google (analytics, and Calendar/Meet for consultations you book), Stripe (partner payment processing), and our email provider. Each receives only what its function requires. We don't sell personal information and we don't share it with platform vendors (Vanta, Drata, or anyone else) - independence is the product, and that includes your data.

Your choices and rights

Email us to access, correct, or delete information we hold about you; we'll act on verified requests within 30 days. Unsubscribe links work immediately. California residents: we don't sell or "share" personal information as the CCPA defines those terms, and you may exercise access and deletion rights via the email below without discrimination. If you're in a jurisdiction with additional rights (such as the EU/UK), we'll honor applicable requests the same way.

Retention, security, and children

We keep submissions as long as needed for the purposes above or as law requires, then delete them. We use reputable providers and reasonable safeguards, but no internet service is perfectly secure. The Site is for businesses and is not directed to children under 16; we don't knowingly collect their information.

Changes and contact

We'll post updates here with a new date; material changes to how we handle scan data will be highlighted on the scan page. Questions or requests: hello@grcmigrate.com · GRCMigrate LLC, Sheridan, Wyoming.