Privacy Policy

What this policy covers

This policy applies to the Cornerstone GRC marketing website and to enquiries you send us through it.

It does not cover the Cornerstone GRC platform itself. Data our customers hold in the platform — their controls, evidence, risk registers, policies, and personnel records — is governed by the agreement and data processing terms in their contract with us, not by this page.

Information you give us

The demo request form requires your name, work email, organisation, which description best fits you, and whether you are asking about a readiness assessment or the platform. It also offers optional fields: your role, the frameworks you are interested in, your timeline, and any notes you choose to add.

We receive exactly what you type. Nothing is pre-filled from another source, and we do not buy, rent, or enrich contact data from third-party brokers.

If you email us at the address published on this site, we hold whatever you choose to tell us in that correspondence.

Information collected automatically

Our hosting provider keeps standard web server logs as part of serving the site. These record the IP address of the request, the browser user-agent, which pages were requested, and when.

When you submit the demo form, your IP address is held briefly in the server's memory so we can limit how many submissions arrive from one address within a ten-minute window. It is never written to a database, and it is discarded when the window passes or the server restarts.

This site runs no analytics, no advertising pixels, and no third-party tracking of any kind. Fonts and images are served from our own domain, so loading a page does not disclose your visit to anyone else.

Why we use it

We use what you send us for three things:

• To reply to your enquiry and arrange a demonstration.
• To keep the site available and resistant to abuse, which is the only purpose the IP rate limit serves.
• To keep ordinary business records of who we have spoken to, and to meet legal or accounting obligations where they apply.

What we will not do with it

We do not use your details for advertising. We will not add you to a newsletter or marketing list because you asked for a demo. We do not sell, rent, or share personal information with anyone for their own marketing purposes.

Legal basis, if you are in the UK or the EEA

We rely on our legitimate interest in responding to business enquiries and in keeping our own site secure. Where you volunteer information beyond what a reply requires, we rely on your consent, and you can withdraw it at any time.

Who else processes it

We keep the list of companies that touch this data as short as we can. Today it is:

• Railway, which hosts this website and generates the server logs described above.
• Resend, which delivers demo request notifications to our sales inbox.
• Our own email and business systems, where your enquiry lands and is answered.

Disclosure beyond those providers

We disclose personal information outside that list only where the law requires it, where we need to establish or defend a legal claim, or to professional advisers bound by confidentiality. If Cornerstone GRC is ever acquired or merged, enquiry records may transfer as part of the business, and this policy would continue to apply to them until replaced by one no less protective.

Cookies and browser storage

We set no advertising cookies and no analytics cookies.

Your browser may store a single entry recording whether you are viewing the site in light or dark mode. It stays on your device, is never transmitted to us, and clearing your browser storage removes it.

How long we keep it

• Demo enquiries: while we are in contact with you, and for up to 24 months after our last exchange, so we recognise you if you come back. You can ask us to delete yours sooner.
• Server logs: for the period our hosting provider retains them in the ordinary course, which is short and measured in weeks rather than years.
• Rate-limiting records: ten minutes at most, in memory only.

Your rights

Wherever you are, you can ask us to show you what we hold about you, correct it, or delete it. You can also object to how we are using it or ask us to restrict that use, and ask for a copy in a portable form.

If you are in the UK or European Economic Area, these rights come from the UK GDPR and the EU GDPR, and you may also complain to your national data protection authority.

If you are a California resident, you have the right to know what we collect and why, to request deletion or correction, and to be free from discrimination for exercising those rights. We do not sell or share personal information as the CCPA and CPRA define those terms, and we have not done so in the preceding twelve months.

To exercise any of this, email us at the address below. We will respond within 30 days, and we will not charge you for a reasonable request.

Security

The site is served over HTTPS, and demo enquiries are accessible only to the people at Cornerstone GRC who need to act on them.

We describe our platform's security commitments to customers in their contract rather than on this page, so that what we promise is specific to what we are actually providing.

Where your information is processed

Cornerstone GRC is based in the United States, and the providers listed above process this data in the United States. If you contact us from elsewhere, your information is transferred there.

Children

This is a business website. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has sent us information, contact us and we will delete it.

Changes to this policy

If we change this policy we will revise the effective date above. Where a change materially affects how we handle information already given to us, we will say so rather than relying on you to notice.