Privacy Policy

Introduction

This Privacy Policy explains how Virtus Cybersecurity LLC ("Virtus", "we", "our", or "us") collects, uses, discloses, and protects personal information when you visit our website at virtuscyber.com, submit one of our forms, use our free security tools, or otherwise interact with us online (collectively, the "Site").

This policy covers the Site only. Personal information we process while delivering security services to clients — for example during a penetration test, incident response engagement, or digital forensics investigation — is handled under the terms of the applicable service agreement, not this policy.

Effective date: July 3, 2026

Information We Collect

Information you provide directly

We do not require an account to use the Site. You provide information to us when you choose to fill out a form or contact us:

• Contact form. Your name and email address are required. You may optionally answer three short questions about the problem you are trying to solve, what you have already tried, and your timing, including free-text answers. After submitting, you may optionally share your company name, phone number, and job title.
• Incident report form (Report a Breach). Your name, email address, phone number, and a description of what is happening are required so our team can respond quickly. You may optionally provide your company name, the incident type, whether the incident is ongoing, and additional details. See Confidentiality of Incident Reports below for how we treat this information.
• Breach cost calculator. The calculator runs in your browser and the figures you enter (industry, company size, records at risk, security posture) are not sent to us — unless you request a consultation, in which case your name, email address, optional phone number, and your calculator inputs and results are submitted to us so we can prepare for the conversation.
• Live chat. If you use the chat widget on our Site (provided by Zoho SalesIQ), we receive the contents of your chat and any contact details you share in it.
• Direct communications. If you email or call us, we receive the information you choose to share.

Information collected automatically

• Usage and device data. Like most websites, we and our analytics providers automatically collect information such as your IP address, browser type, operating system, device type, referring pages, the pages you visit, and the dates and times of your visits.
• Cookies and similar technologies. Our analytics providers set cookies and use similar technologies to recognize your browser across visits. See Analytics and Cookies below for the specific services we use and your choices.
• Bot protection. Our forms are protected by Cloudflare Turnstile, which analyzes browser and device signals to distinguish humans from bots. Turnstile does this without showing you puzzles and without building an advertising profile.
• Rate limiting. To prevent abuse of our forms and tools, we temporarily record request counts keyed to your IP address. These records expire automatically after a short period.

Information processed by our free tools

Our website analyzer accepts a URL you submit and inspects that site's public configuration: it fetches the page to read its security headers, performs a TLS handshake to check the certificate, and looks up the domain's public DNS records (SPF and DMARC). We don't send the submitted domain to any third-party data service. Please only analyze domains you own or are authorized to assess.

How We Use Your Information

We use the information described above to:

• Respond to your inquiries, consultation requests, and incident reports, including contacting you by email or phone;
• Understand your security needs so we can recommend suitable services;
• Provide the results of our free tools, such as the website analyzer and breach cost calculator;
• Operate, secure, and improve the Site, including preventing spam, abuse, and fraudulent submissions;
• Understand how visitors use the Site so we can improve its content and performance;
• Comply with legal obligations and enforce our agreements.

Where laws such as the EU or UK GDPR apply, we rely on the following legal bases: your consent (which you may withdraw at any time); performance of a contract or steps taken at your request before entering one (for example, responding to your inquiry); our legitimate interests in operating, securing, and improving the Site and marketing our services; and compliance with legal obligations.

We do not sell your personal information, and we do not use it to send you marketing you have not asked for.

Analytics and Cookies

How your choice works depends on where you are. We use your approximate location, derived from your IP address, only to decide which of the following applies:

• European Economic Area, United Kingdom, and Switzerland: analytics and live chat run only with your consent. The first time you visit, a banner asks whether to enable them. Until you accept, Google Analytics, PostHog, and Zoho SalesIQ are never loaded and set no cookies.
• Everywhere else: analytics and live chat are on by default, and you can turn them off at any time.

Wherever you are, you can change your choice at any time using the "Cookie Preferences" link in the footer, and if your browser sends a Global Privacy Control signal we treat it as a decline. Once you decline, these services are not loaded.

We use the following services to understand how the Site is used and to offer live chat. Each provider processes data on our behalf and has its own privacy policy:

• Google Analytics (Google LLC) — measures page views, traffic sources, and on-site behavior using cookies and similar identifiers. Learn more at Google's Privacy Policy and How Google uses information from sites that use its services. You can opt out with the Google Analytics opt-out browser add-on.
• PostHog (PostHog, Inc.) — product analytics that records page views, page-leave events, and interactions such as form submissions. We have configured PostHog to create person profiles only for identified users; anonymous visitors are not profiled individually. Data is processed on PostHog's US cloud. See the PostHog Privacy Policy.
• Vercel Analytics (Vercel Inc.) — privacy-friendly, aggregate traffic measurement that does not use cookies or track visitors across sites. See the Vercel Privacy Policy.
• Zoho SalesIQ (Zoho Corporation) — powers the live chat widget and may set cookies to maintain your chat session and recognize returning visitors. See the Zoho Privacy Policy.

We also set two strictly necessary cookies of our own: one that remembers your cookie choice, and one that records whether the consent banner applies in your region. They contain no personal information.

In addition to the "Cookie Preferences" link, you can control or delete cookies through your browser settings, and most browsers let you block third-party cookies entirely. Blocking cookies will not prevent you from using the Site, though the chat widget will not be available. You can always reach us by phone or email instead.

How We Share Information

We share personal information only as described below. We do not sell it to anyone.

• Service providers. We use trusted vendors to run the Site, and they process data only to provide their services to us: Vercel (website hosting and analytics), Amazon Web Services (sending email confirmations and notifications), Google and PostHog (analytics, above), Cloudflare (bot protection), Upstash (rate limiting), and Zoho (live chat). Form submissions are delivered to our team by email and routed through our internal tooling (including our internal messaging workspace) so the right people can respond.
• Legal requirements. We may disclose personal information when required to do so by law, or when we believe in good faith that disclosure is necessary to comply with a legal obligation, protect our rights or safety, or respond to lawful requests by public authorities.
• Business transfers. If Virtus is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Site of any change in ownership or in how your personal information is used, along with any choices you may have.

Confidentiality of Incident Reports

We understand that reporting a suspected breach is sensitive. Information submitted through our incident report form is delivered directly to our security team, is treated as confidential, and is used solely to respond to your report and provide incident response assistance. We do not use incident report details for marketing, and access is limited to personnel who need it to help you. A reference number is generated for each report so we can correlate follow-ups.

Data Retention

We keep personal information only as long as we need it for the purposes described in this policy:

• Form submissions and the communications that follow are retained in our correspondence systems for as long as needed to handle your inquiry or engagement, and afterwards as needed to comply with legal obligations, resolve disputes, and enforce agreements. The Site itself does not store your form submissions in a database.
• Rate-limiting records tied to your IP address expire automatically within a short period after your request.
• Analytics data is retained according to each provider's configured retention period.

You may ask us to delete personal information we hold about you at any time — see Your Rights and Choices below.

Data Security

Security is our business, and we apply the same discipline to your data. Measures we use include:

• Encryption of data in transit (TLS) across the Site;
• A strict Content Security Policy and hardened security headers;
• Bot protection and rate limiting on all forms and tools;
• Access controls limiting who can view submissions;
• Regular security review of our own infrastructure.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you need to share highly sensitive incident details, call us at (833) 784-7887 and we can arrange a secure channel.

International Data Transfers

We are based in the United States, and the Site and the service providers listed above process data in the United States. If you access the Site from outside the US, your information will be transferred to and processed in the US, where privacy laws may differ from those in your jurisdiction. Where required, we rely on appropriate safeguards for such transfers, such as our providers' standard contractual clauses or participation in the EU-US Data Privacy Framework.

Your Rights and Choices

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you;
• Correction — ask us to correct inaccurate information;
• Deletion — ask us to delete your personal information;
• Portability — receive your information in a portable format;
• Objection and restriction — object to or ask us to limit certain processing, including processing based on legitimate interests;
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing;
• Non-discrimination — we will never treat you differently for exercising a privacy right.

To exercise any of these rights, email privacy@virtuscyber.com. We will verify your request using the contact details associated with the information (for example, by confirming control of the email address you submitted) and respond within the timeframe required by applicable law. If you are in the EEA or UK, you also have the right to lodge a complaint with your local supervisory authority; residents of US states with privacy laws may appeal a decision by replying to our response.

Do Not Track and Global Privacy Control. We honor the Global Privacy Control (GPC) signal: if your browser sends it and you have not made an explicit choice in our consent banner, we treat it as a decline and do not load analytics or live chat. The older Do Not Track signal has no settled meaning, so we do not respond to it specifically — use the "Cookie Preferences" link in the footer to control analytics.

Children's Privacy

The Site is intended for businesses and professionals and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us at privacy@virtuscyber.com and we will delete it.

Third-Party Links

The Site links to third-party websites and social platforms, including our LinkedIn and X profiles. Those sites operate under their own privacy policies, and we encourage you to review them. This policy applies only to information collected through our Site.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the revised policy on this page and update the effective date above. If a change materially affects how we handle personal information already collected, we will take reasonable steps to notify you, such as a notice on the Site.