Privacy Policy

1. Who We Are

Invictus Energy Solutions, LLC (“Invictus”, “Company”, “we”, “us”, or “our”) is a strategic energy management company headquartered at 520 North Avenue, New Rochelle, NY 10801. We provide energy optimization platforms, facility management tools, and data-driven consulting services to commercial and institutional clients. This Privacy Policy explains how we collect, use, store, share, and protect personal information when you access our platform, website, or engage with our services.

For privacy-related inquiries, contact us at: info@invictusenergyus.com

2. Information We Collect

We collect information in the following categories:

• Identity & Account Data: Full name, email address, job title, organization name, and profile credentials provided during registration or onboarding.
• Facility & Project Data: Energy consumption records, site configurations, project parameters, equipment inventories, and performance benchmarks submitted through the platform.
• Usage & Telemetry Data: Pages visited, features accessed, session duration, click interactions, error logs, and platform performance metrics collected automatically.
• Communication Data: Messages, consultation requests, support tickets, and any correspondence submitted through contact forms or integrated communication tools.
• Technical Data: IP address, browser type, device identifiers, operating system, and referral URLs collected via standard web server logs and analytics.
• Integration Data: Data exchanged through authorized third-party integrations including Microsoft 365, Monday.com, and other connected workflow tools, subject to your organization's authorization.

3. How We Use Your Information

We process personal information for the following purposes:

• Delivering, maintaining, and improving the Invictus platform and associated services.
• Authenticating users and enforcing role-based access controls across the platform.
• Generating energy performance reports, benchmarking analyses, and project proposals.
• Communicating service updates, maintenance notices, and account-related information.
• Responding to consultation requests, support inquiries, and client communications.
• Complying with applicable legal obligations, regulatory requirements, and audit processes.
• Detecting, investigating, and preventing fraudulent activity, security breaches, or unauthorized access.
• Conducting internal analytics to improve platform performance and user experience.

We do not sell personal information to third parties. We do not use personal data for automated decision-making that produces legal or similarly significant effects without human oversight.

4. Legal Basis for Processing

Invictus Energy Solutions, LLC operates exclusively within the United States and processes personal information in accordance with applicable U.S. federal and state law. We collect and use personal information only where we have a lawful basis to do so, including:

• Service delivery: Processing necessary to operate the platform and fulfill our obligations to users and the organization.
• Legitimate business interests: Platform security, fraud prevention, internal analytics, and service improvement.
• Legal compliance: Meeting applicable U.S. federal and New York State legal obligations and responding to lawful requests from authorities.
• Consent: Non-essential cookies and optional analytics where explicit consent is obtained.

5. Data Sharing & Third-Party Processors

We share data only with trusted service providers under strict contractual data processing agreements. Categories of recipients include:

• Cloud Infrastructure: Supabase (managed PostgreSQL and authentication), Vercel (hosting and edge delivery).
• File Storage: UploadThing for secure document and media uploads.
• Workflow Integrations: Monday.com and Microsoft 365 where authorized by your organization.
• Analytics: Privacy-focused analytics tools operating without persistent cross-site tracking identifiers.
• Legal & Compliance: Regulatory bodies, law enforcement, or legal counsel where required by law or to protect our rights.

All third-party processors are contractually bound to process data only as instructed and to maintain appropriate security standards.

6. Data Retention

We retain personal data for as long as necessary to fulfill the purposes outlined in this policy, maintain active service agreements, or comply with legal obligations. Specifically:

• Account and identity data is retained for the duration of the active account plus 12 months following termination.
• Project and facility data is retained per the terms of the applicable client agreement.
• Communication records are retained for up to 3 years for audit and dispute resolution purposes.
• Technical logs and telemetry are retained for up to 90 days unless required longer for security investigations.

Upon expiry of the applicable retention period, data is securely deleted or anonymized.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your data where no overriding legal basis exists for retention.
• Restriction: Request that we limit processing of your data in certain circumstances.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests or for direct marketing.
• Withdraw Consent: Withdraw previously given consent at any time without affecting prior lawful processing.

To exercise any of these rights, contact us at info@invictusenergyus.com. We will respond within 30 days.

8. Security

We implement industry-standard technical and organizational security measures including encrypted data transmission (TLS), encrypted storage, role-based access controls, session management, and regular security reviews. While we take all reasonable precautions, no system is entirely immune to risk. In the event of a data breach affecting your rights, we will notify affected parties in accordance with applicable law.

9. Cookies

We use cookies and similar technologies to operate the platform and, with your consent, for analytics and preference memory. For full details on cookie categories, purposes, and how to manage your preferences, see our Cookie Policy.

10. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated via platform notification or email. Continued use of the platform following notice of changes constitutes acceptance of the updated policy.