Privacy Policy

How we collect, use, and protect your information.

Effective Date: March 24, 2026

Bureaucromancy Labs LLC, doing business as B2CMMC ("we," "us," or "our"), operates the b2cmmc.com website and provides the Arcana-GRC software product. This Privacy Policy describes what information we collect, how we use it, and your rights regarding that information.

1. Information We Collect

1.1 Demo Download Form

When you download the Arcana-GRC demo, we collect:

  • First name and last name
  • Work email address
  • Organization or company name
  • IP address (automatically captured by Cloudflare)
  • Country (derived from IP address by Cloudflare)
  • Browser user agent string
  • Page URL at time of download
  • Timestamp of EULA acceptance

1.2 Purchase Transactions

Purchases are processed by Freemius, Inc., a third-party payment processor. We do not directly collect or store payment card information. Freemius handles all payment data subject to their own privacy policy. We receive your name, email, and license details from Freemius to fulfill your order.

1.3 Email Communications

If you contact us at info@b2cmmc.com, we retain the content of your correspondence to respond to your inquiry and for our records.

1.4 Automatically Collected Information

Our website is hosted on Cloudflare Pages. Cloudflare may collect standard web server logs (IP addresses, request timestamps, pages visited) as part of their infrastructure services. We do not use third-party analytics tools, tracking pixels, or advertising cookies on this website.

2. How We Use Your Information

We use the information we collect to:

  • Fulfill demo download requests and deliver the software
  • Maintain a record of EULA acceptances for legal compliance
  • Respond to inquiries and provide customer support
  • Send transactional communications related to your purchase or download
  • Protect against abuse, fraud, and unauthorized access

We do not sell, rent, or share your personal information with third parties for marketing purposes.

3. Arcana-GRC Software (Self-Hosted)

Arcana-GRC is a self-hosted product that runs entirely within your own infrastructure. We do not collect, access, transmit, store, or process any data you enter into Arcana-GRC. All compliance documentation, system security plans, assessment data, and other content remains exclusively on your systems. See Section 8 of the End User License Agreement for details.

4. Data Storage and Security

Download form data is stored in a Cloudflare D1 database. We use industry-standard security measures to protect this information, including:

  • HTTPS encryption for all data in transit
  • Input validation and sanitization on all form submissions
  • Origin validation on API requests as defense-in-depth
  • Bot protection via Cloudflare Turnstile with hostname verification
  • Per-IP rate limiting on the download endpoint

5. Data Retention

We retain demo download records (including EULA acceptance logs) for the duration of our business operations, as these serve as legal records of license agreement acceptance. If you wish to request deletion of your personal information, contact us at info@b2cmmc.com.

6. Third-Party Services

We use the following third-party services:

  • Cloudflare (Pages, Workers, R2, D1) — website hosting, content delivery, and data storage
  • Cloudflare Turnstile — bot protection on our download form
  • Freemius — payment processing and license management
  • Google Fonts — web fonts loaded from Google servers

Each of these services has its own privacy policy governing how they handle data.

7. Cookies

This website does not set first-party cookies for tracking or analytics. Cloudflare and Turnstile may set cookies necessary for security and bot protection. These are functional cookies, not used for advertising or tracking.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Request access to the personal information we hold about you
  • Request correction or deletion of your personal information
  • Object to or restrict processing of your personal information
  • Request a portable copy of your personal information

To exercise any of these rights, contact us at info@b2cmmc.com. We will respond within 30 days.

9. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Continued use of our website after changes constitutes acceptance of the updated policy.

11. Contact

For questions about this Privacy Policy or our data practices, contact us at:

Bureaucromancy Labs LLC / B2CMMC
Email: info@b2cmmc.com
Website: b2cmmc.com