Privacy · Last updated 17 July 2026
What we collect, and what we don’t.
We sell security. It would be strange to be careless with yours. This page describes exactly what this website collects, who processes it, and how to have it deleted — in plain language, because that’s the whole point.
Who we are
Invictus Cybersecurity LLC, San Antonio, Texas. For anything on this page, contact contact@invictuscybersecurity.tech or 726-263-0724.
What we collect
When you fill in a form. Our report forms ask for your name, email and company. Our contact form additionally offers optional fields for your company website, phone number, area of interest, and a message. Optional means optional — leave them blank and the form still works.
When you just visit. We use Google Analytics, which sets cookies and records things like the pages you view, roughly where you are, and what browser you use. We use it to understand which pages are useful. We do not use it to build a profile of you or to advertise to you.
Two things most sites don’t tell you. This site loads fonts through the Google Fonts API, which means your IP address reaches Google’s servers when a page loads. Our forms use Google reCAPTCHA to block spam, which also processes your IP and interaction data. Both are Google services governed by Google’s policies, not ours.
When you book a call. Our “Book a discovery call” buttons hand you over to Calendly — they are ordinary links, not an embedded widget, so Calendly sets nothing on this site and sees nothing about you unless you click through. Once you’re there, Calendly collects your name, email, timezone and anything you type into the booking form, and drops the meeting into our Google Workspace calendar. Browsing this site without booking involves Calendly not at all.
Why we collect it
To send you the VM3 paper if you asked for it, to reply to your enquiry, and to occasionally send field notes about the VM3 model. That’s the entire list.
Who else touches it
Four companies process your information on our behalf. We chose each one deliberately, and you can read their own security documentation rather than take our word for it.
- Proton Mail — our email provider, and the one we care most about. Enquiries and form submissions arrive as email in a dedicated mailbox we monitor only for enquiries — not a personal inbox. Proton is Swiss-based, offers end-to-end and zero-access encryption, and is built so the provider itself cannot read stored message contents. We use it because we would rather our clients’ security questions sat somewhere that cannot mine them. Read Proton Mail’s security model.
- Webflow — hosts this site and stores form submissions in their dashboard. Read Webflow’s security page.
- Google — Analytics, Fonts and reCAPTCHA, as described above. Read Google’s security overview and their privacy policy.
- Calendly — our scheduling tool. Only involved if you actually book a call. It takes your name, email, timezone and anything you type into the booking form, and writes the meeting into our Google Workspace calendar. Read Calendly’s security page and their privacy notice.
Being straight with you: Proton protects your message in transit and at rest, but a form submission still passes through Webflow before it reaches us, and Google sees your IP for fonts and spam filtering. Encryption at one hop is not encryption everywhere. If you want to reach us without any of that, email contact@invictuscybersecurity.tech directly, or ask us for a PGP key.
We do not sell your information. We do not share it with anyone beyond the four above. We do not send it to advertisers or data brokers. If that ever changes, this page changes first.
How long we keep it
We keep enquiry data — what you put in a form, plus our correspondence about it — for 24 months from our last contact with you, then delete it. If you ask us to delete yours sooner, we will, and we’ll confirm when it’s done. If you become a client, engagement records are governed by our agreement and by ordinary business and tax obligations rather than by this window.
Your choices
- Ask us what we hold about you — we’ll tell you.
- Ask us to correct or delete it — we will.
- Unsubscribe from field notes — every message has a link, and you can also just reply and ask.
- Block analytics cookies in your browser — the site works fine without them.
Email contact@invictuscybersecurity.tech for any of the above. There is no form to fill in and no ticket to raise.
Client engagement data
This page covers the website only. Data we handle during a paid engagement — your findings, configurations and evidence — is governed by the agreement and NDA we sign with you, not by this page.
Changes
If we change this policy we’ll update the date at the top. We won’t make a material change quietly.