Privacy Policy

Accred Consulting’s website

This policy covers accredproducts.com and the Accred apps. Accred Consulting’s website, www.accredconsulting.com, with its contact form and fit check, is covered by the Accred Consulting privacy notice. Accred Products, LLC publishes both.

This public site

accredproducts.com has no advertising tags or tracking cookies. It uses Cloudflare Web Analytics to count page views and measure how fast pages load; Web Analytics sets no cookies or other browser storage and does not track you across sites. Our hosting provider, Cloudflare, also processes standard request data (such as IP address and browser type) to deliver and protect the site. Links to Hub and Assess open those apps, which have their own sign-in. The optional setup assistant is described in the next section.

Setup assistant on this site

The Accred setup assistant on this site answers questions about the Accred apps and how to get started. It is optional and runs only when you open it and send a question. What you type, together with the earlier messages in that conversation, is sent to Anthropic, PBC, which runs the AI model that writes the answers as our service provider. Accred does not store the content of these conversations.

To prevent abuse and control cost, we count how many questions come from each network address and each conversation, in Cloudflare. The address is stored only as a keyed hash that changes every day, never in readable form. Counters expire within 24 hours, and expired counters are deleted the next time the assistant is used. We may also use Cloudflare Turnstile to check that a person, not an automated program, is asking.

Under its commercial terms, Anthropic deletes these messages within 30 days unless they are flagged for a usage policy violation (then kept for up to 2 years), and does not use them to train its models. Your browser keeps the conversation in session storage for that tab, so it survives moving between pages; it is removed when you close the tab or choose Clear conversation.

Please do not enter passwords, keys, payment details, or personal or confidential information about anyone. Answers are generated by AI and can be wrong; the pricing page, the legal pages, and the Accred team are the authority.

What we collect in the apps

• Account data: name, email address, organization, role, and sign-in records.
• Customer Data your organization adds or connects: client, project, ticket, time, and billing records; migration plans and run results; the mail, files, and other content you migrate with Migrate or back up with Protect; device inventory; assessment answers and evidence; phishing simulation and training results that Accred Aware reads from Microsoft Defender (each person’s name, email address, department, and whether they clicked, reported, or finished training), and the recipients you choose for a simulation you launch from Aware, which Aware passes to Microsoft Defender (Aware keeps how many recipients there were, not their addresses); and Microsoft 365 directory and configuration data read with your consent.
• Billing data: billing contact and plan details. Card payments are handled by Stripe; we never see or store full card numbers.
• Usage and security data: audit log entries, error logs, and request metadata used to run and protect the Services.

How we use it

• To provide, secure, and support the Services your organization uses.
• To send service messages such as sign-in links, invitations, and notifications you turn on.
• To bill for paid plans and keep business records.
• To improve reliability and fix problems.

We do not sell personal data, share it for cross-context behavioral advertising, or use Customer Data to train AI models.

AI features

Assess summaries send the text needed for that request to a large language model through OpenRouter. Requests are made only when you use the feature, and the providers involved are listed on our Subprocessors page. The Consult assistant uses the same route but is available only to Accred staff; customer users cannot use it.

Who we share it with

We share personal data only with the service providers listed on our Subprocessors page, under contracts that protect it; with Microsoft and other services your organization chooses to connect; when the law requires it; or as part of a merger or sale of our business, with notice to you.

Legal bases (EEA and UK)

For account and billing data we rely on contract and legitimate interests (running and securing the Services). For Customer Data we act as a processor for your organization, which determines its legal basis.

Where data is stored and transfers

Data is stored with Supabase and Cloudflare, primarily in the United States. During a migration, Accred Migrate also stages files briefly in Accred’s Microsoft Azure storage in the United States. Accred Connect traffic passes through the Connect relay, which Accred runs on a DigitalOcean server in the United States. Where we transfer personal data from the EEA, UK, or Switzerland, we use the European Commission’s Standard Contractual Clauses and the UK Addendum.

Retention

We keep personal information only as long as we need it for the purposes in this policy, then delete it, unless the law requires us to keep it longer (for example, invoices and other tax records). You can ask us to delete it sooner.

Account data and Customer Data are kept while your organization uses the Services and deleted within 30 days after it stops, unless the law requires us to keep them longer. Billing records are kept as long as tax law requires.

Accred Protect backups also roll off on their own. Your organization picks a retention period of 30, 90, or 365 days, or 7 years (365 days unless you change it). A backed-up version of an item is deleted once it has been replaced or deleted in Microsoft 365 for longer than that period; the latest version of an item that still exists is kept. Retention runs once a day, and stored content that no remaining version uses is permanently deleted after a 24-hour grace period.

Cookies and storage

The apps use strictly necessary browser storage to keep you signed in and remember your selected organization. On this public site, only the setup assistant uses browser storage: session storage for your conversation in that tab. We do not use advertising or analytics cookies.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict processing, and to complain to a data protection authority. California residents have the rights in the CCPA/CPRA, and we will not discriminate against you for using them. If your data is in an organization’s workspace, we will pass your request to that organization and help it respond. To make a request, email hello@accredconsulting.com.

Security and children

Our safeguards are described on the Security page. The Services are for businesses and are not directed to anyone under 18; the Terms of Service require users to be at least 18.

Changes and contact

We will post changes here and update the date above; for material changes we will also notify organization owners. Questions: hello@accredconsulting.com, Accred Products, LLC, St. Petersburg, Florida.