Privacy Policy
What personal data CMCfy collects, why, who we share it with and your rights. The documents and data you work with in the tools never reach us.
Draft pending legal review. This policy is a draft and has not yet been reviewed by a lawyer. It describes how CMCfy works today. Last updated 1 November 2026.
1. Who we are
CMCfy is provided by Accolade Software Products LLC, a Delaware limited liability company ("we", "us"), c/o Harvard Business Services, Inc., 16192 Coastal Hwy, Lewes, DE 19958, United States. We are the controller of the personal data described in this policy. Questions, requests and complaints: sales@cmcfy.com. This policy sits alongside our Terms of Use. Business customers who need a contract for personal data we process for them can use our Data Processing Agreement.
2. The short version
- The CMCfy tools run in your browser. The files, data, projects and reports you work with stay on your computer or in the folder your company picks. We never receive them.
- Text leaves your computer only when you press a CMCfy Writer button and approve the exact text in the "What will be sent" box. It goes once to the writing service, and we keep no copy.
- We hold the little we need to run the business: your contact details, your plan and billing, the emails you send us, and usage counts.
- Website analytics run only if you press Accept on the cookie notice. We do not sell personal data, show advertising or build advertising profiles.
3. What we never receive
Anything you load into or create with the CMCfy tools at app.cmcfy.com: spreadsheets, Word and PDF files, scans, results, calculations, projects, versions, audit trails, lab notebook entries and the reports you export. These are processed in your browser and saved on your own computer or network folder. Every tool page carries a security policy that blocks connections to anywhere except the CMCfy Writer service, and shows a live count of network requests, so your IT team can check this (see Security).
4. What we collect, and why
| What | Where it comes from | Why we use it | Legal basis (EU and UK) |
|---|---|---|---|
| Website and app requests: network (IP) address, browser and device details, page requested, time | Your browser, handled by Cloudflare, our host | To deliver the pages, keep the service secure and stop abuse | Legitimate interests (running a secure website) |
| Website analytics: pages visited, approximate location, device, a random cookie ID | Google Analytics, only after you press Accept | To see which pages are useful and improve the website | Consent, which you can withdraw at any time with "Cookie settings" in the footer |
| Ask CMCfy chat: the questions you type and the answers | You, on the website | To answer your question. The text passes through our server to the writing service and back; we do not store or log it | Legitimate interests (answering visitors' questions) |
| CMCfy Writer: the text you approve in the "What will be sent" box | You, in the tools | To write the draft you asked for. The text and the answer pass through memory only; we do not store or log them | Contract (providing the service you use) |
| Usage counts: number of writing runs per month, against a scrambled access code, account ID or network address | Our server | To apply plan limits and stop abuse. A counter holds only a number and expires after about 40 days | Contract and legitimate interests |
| Contact and correspondence: name, work email, company, job title, what you write to us | You, by email to sales@ or support@cmcfy.com | To answer you, set up trials and plans, give support and keep records of our business dealings | Legitimate interests, or steps before a contract |
| Account (when sign-in launches): name, work email, company, plan, sign-in records | You, and our sign-in provider | To give you access to your plan and keep your account secure | Contract |
| Billing: billing contact and address, company, tax ID, invoices, payment status | You, and our payment provider | To take payment, issue invoices and keep tax and accounting records | Contract and legal obligation |
Please do not put personal data you do not need, such as patient or study-subject identifiers, into text you send with CMCfy Writer or type into the chat. If your company sends personal data through CMCfy Writer, your company decides what is sent and is responsible for it, and our Data Processing Agreement covers that processing.
5. Cookies and browser storage
- Google Analytics cookies (names starting
_ga), on cmcfy.com only, and only after you press Accept. They last up to 2 years in your browser. Declining, or choosing Decline later in "Cookie settings", stops counting and removes them. Advertising features, Google signals and ad personalisation are switched off. If your browser sends a Global Privacy Control signal, we treat it as Decline and do not ask. - Your cookie choice is kept in your browser's local storage so we don't ask again.
- The tools at app.cmcfy.com use no cookies and no analytics. They keep your settings, and any CMCfy Writer access code you enter, in your browser's local storage on your computer. Your projects are saved in the folder you pick.
- The "are you a person?" check (Cloudflare Turnstile), shown only if the chat needs it, does not use advertising or tracking cookies.
- Sign-in (when it launches) uses a cookie to keep you signed in. It is strictly necessary, so it does not need consent.
6. Who we share it with
We share personal data only with the providers below, which process it for us under contract, and when the law requires it (for example a valid court order). If we sell or reorganise the business, the buyer would take on this policy. We do not sell or "share" personal data for advertising.
| Provider | Where | What it does for CMCfy | What it sees |
|---|---|---|---|
| Cloudflare, Inc. | United States (global network) | Hosts cmcfy.com and app.cmcfy.com, protects them from attacks, runs the "are you a person?" check (Turnstile) and keeps the monthly usage counters | Network address, browser details and the pages requested; usage counters keyed by a scrambled (hashed) code |
| Anthropic, PBC | United States | Writes the text for CMCfy Writer and answers questions in the Ask CMCfy chat on the website | Only the text a user approves and sends (CMCfy Writer) or types (chat). Not used to train models |
| Microsoft Corporation (Microsoft 365) | United States | Our email (sales@cmcfy.com and support@cmcfy.com) | The emails you send us and our replies |
| Google LLC (Google Analytics) | United States | Counts visits to the website, only after a visitor presses Accept on the cookie notice | Pages visited, approximate location, device and browser, a random cookie ID |
| Clerk, Inc. (when accounts launch) | United States | Sign-in and user accounts | Name, work email, company, sign-in records |
| Stripe, Inc. (when online payments launch) | United States | Payments, invoices and subscriptions | Name, billing email and address, company, tax ID, payment card details (held by Stripe; we never see the full card number) |
Enterprise customers can connect CMCfy Writer to their own cloud account (for example Anthropic, AWS Bedrock, Azure, Google Vertex, OpenAI or xAI). Text then goes to that provider under the customer's own contract, not through us.
7. International transfers
We are based in the United States, and so are our providers. When we receive personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum and the Swiss amendments) and on our providers' own transfer safeguards, including the EU-US Data Privacy Framework where a provider is certified. Ask us for a copy of the safeguards at sales@cmcfy.com.
8. How long we keep it
- CMCfy Writer and chat text: not kept by us. Anthropic may keep a request for a short period under its own commercial terms to check for misuse, then deletes it; it does not use it to train models.
- Usage counters: about 40 days.
- Website request logs held by Cloudflare: under Cloudflare's own retention, normally a few days. We do not keep our own copies.
- Analytics: no longer than 14 months, then Google deletes it.
- Emails and sales records: while we deal with you and for up to 3 years after our last contact.
- Account data: while your account is open, then deleted within 90 days of closing it.
- Billing and tax records: 7 years, as tax law requires.
9. How we protect it
The main protection is design: the documents and data you work with never reach us. For what we do hold, we use encrypted connections (HTTPS) everywhere, providers with recognised security certifications, two-factor sign-in on our administrator accounts, least-privilege access, and secrets kept out of code. The Trust Center describes our controls in more detail. If a breach affects your personal data, we will tell you and the authorities as the law requires.
10. Your rights
Depending on where you live, you can ask us to tell you what personal data we hold about you and give you a copy, correct it, delete it, limit or object to how we use it, or move it to another service. Where we rely on consent, you can withdraw it at any time. Email sales@cmcfy.com. We may need to confirm your identity, and we will answer within one month (45 days for US state requests). We will not treat you differently for using these rights.
EU, UK and Switzerland. You can also complain to your local data protection authority, for example the authority in the EU country where you live or work, the UK Information Commissioner's Office or the Swiss FDPIC. We would like the chance to resolve it first. We have not yet appointed a representative in the EU or the UK; when we do, we will name them here.
United States. Residents of California and other states with privacy laws have the rights above, and the right to know the categories of personal data we collected in the last 12 months. Those are the categories in section 4: identifiers (name, email, network address), commercial information (plan and billing), internet activity (website use) and professional information (company and job title). We collected them from the sources and for the purposes in section 4 and disclosed them only to the providers in section 6. We do not sell or share personal data for cross-context behavioural advertising, and we do not use sensitive personal information. You may use an authorised agent to make a request.
11. Children
CMCfy is a professional tool for businesses. It is not meant for anyone under 18, and we do not knowingly collect children's personal data.
12. Changes to this policy
We will post any change here with a new date, and list it on the update log. If a change is significant, we will also email customers before it takes effect.
13. Contact
Accolade Software Products LLC, c/o Harvard Business Services, Inc., 16192 Coastal Hwy, Lewes, DE 19958, United States. Email sales@cmcfy.com.