Privacy policy
Last updated · 18 October 2026
The short version: this website sets no cookies and stores nothing on your device. It loads nothing from any third party: no analytics service, no fonts service, no tags, no pixels. We do count visits, on our own servers, in a way that cannot identify you and that honours your browser's privacy signals (section 3). The only personal data we process from this site is what you type into the contact form, plus the technical context of that submission, and we use it for exactly one thing: answering you.
1. Who we are
Cyvantic ("we", "us") operates this website (cyvantic.com) and the Cyvantic security platform (app.cyvantic.com). We are the data controller for the personal data described in this policy. To contact us about privacy, email privacy@cyvantic.com.
2. Cookies and tracking: there are none
cyvantic.com uses no cookies of any kind: no analytics cookies, no advertising cookies, no "strictly necessary" cookies. Nothing is stored on or read from your device: no local storage, no fingerprinting. We host our own fonts and assets, so your visit is not disclosed to any third-party content network, font service or analytics provider. That is why there is no cookie banner: there is nothing to consent to.
The Cyvantic platform at app.cyvantic.com is a separate, sign-in product for our customers; it uses strictly necessary session cookies for authentication only, governed by the agreements customers sign with us.
3. Counting visits, without identifying you
We want to know whether anyone reads this site and which pages they find useful. We do this ourselves rather than hand your visit to an analytics company. When a page loads, your browser sends one request to our own servers carrying:
- the page you are viewing;
- the site that linked you here (its domain only, never the full address);
- any campaign tags in the link you followed (the "utm" parameters some links carry);
- a coarse screen class (phone, tablet or desktop).
Our server adds the country your connection appears to come from, derived from your network address at our edge, and a daily anonymous identifier: a keyed hash of your network address and browser description that we cannot reverse, and that changes every day, so visits cannot be linked from one day to the next. Your network address itself is not stored in these statistics. We keep the statistics for 13 months and use them only to understand how the site is used.
If you go on to create an organisation on the platform, we want to know what brought you, so the links from this site into the platform's sign-up page carry, in the link itself: which button you followed, the page it was on, the domain of the site that referred you to that page, and any campaign tags on the link you arrived by. Nothing is stored on your device to do this; it travels in the address of the link, and you can see it there. And if you create the organisation on the same day as your visit, the platform computes that day's anonymous identifier for its own request and matches it to that day's page views, which tells us the first page you read, the site that sent you, and the pages you read before signing up. Because the identifier changes every day, a visit on an earlier day is never matched: we only ever join a visit and a sign-up from the same day. The sign-up form also asks, optionally, how you heard of us. All of this is recorded against the organisation you created, under the customer agreement.
If your browser sends the Global Privacy Control signal or has Do Not Track enabled, the request is not sent at all, and the links are left exactly as written. Our lawful basis for this counting, where a law like the GDPR applies, is our legitimate interest in understanding how our own website is used, assessed against the minimal and unidentifiable nature of what we process.
4. The contact form: what we collect, and when
The only point at which this site processes data that identifies you is when you send a form: the one-field form that asks for the free posture scan by email address, or the contact form (to ask about the scan, to request the assessment, a quote, a trial, a partnership, to report a security issue, or to ask anything else). At that moment we process:
- What you give us: your name, company, work email address, what you are asking for, the region your organisation is based in if you choose to tell us, and the optional message you write. The one-field form asks only for your email address.
- Where the form was: for the one-field form, the page it was on, the domain of the site that referred you to that page, and any campaign tags on the link you arrived by, so we know what brought the request.
- Technical context of the submission: your network address, browser user-agent string, browser language, the page origin, and a timestamp. We collect these for security and abuse prevention: this is a security company's contact form, and we treat it accordingly.
Simply browsing the site identifies you to nobody.
5. Why we process it
- Answering your request: assessing it, replying to you, and arranging what you asked for. These are the steps you have asked us to take ahead of any contract (where laws like the GDPR apply, that is the "pre-contract" basis).
- Sending you the scan link: when you register for the free scan by email address, we email you the link to start, and if you have not started after three days, one reminder with the same link. Both are about the thing you asked for and carry no promotion. Every one of them has a link that deletes your registration at once.
- Security and abuse prevention: the technical context above, under our legitimate interest in protecting our systems and the integrity of the form.
We do not use your data for marketing lists, we do not sell it, and we will not add you to a newsletter you did not ask for. You will hear from us about what you asked, and that is all.
6. Where it lives, and who processes it
Form submissions are stored in our platform's tamper-evident audit record and delivered to our team by email. Visit statistics are stored in our platform's database. Our infrastructure runs on Amazon Web Services in the European Union (Ireland); Amazon acts as our processor. No other party receives data from this website.
7. How long we keep it
We keep form submissions for as long as they are relevant to your request and no longer than 24 months, unless you become a customer (in which case the customer agreement governs) or you ask us to remove them sooner. A registration for the free scan is kept until you create an organisation (it then forms part of your customer record) or use the link in the email to delete it, and in any case no longer than 12 months. Visit statistics are kept for 13 months.
8. Your rights
Depending on where you live, data-protection law (the GDPR is one example) gives you rights over your personal data, typically to access, correct and delete it, to restrict or object to our processing of it, and to receive a copy in a portable form. We honour these requests wherever you are writing from: email privacy@cyvantic.com and we will act on it. You may also have the right to complain to your local data-protection authority.
9. Changes
If we change how this site handles data, we update this policy first and describe the change honestly, including any consent mechanism the law then requires. The "last updated" date above always tells you when this policy last changed. On 18 October 2026 we added section 3 (visit counting) and the new fields on the contact form.