Privacy Policy

Last Updated: September 29, 2026 Effective Date: August 20, 2026

This Privacy Policy explains how Invictus CRM ("Invictus", "we", "us", or "our") collects, uses, protects, retains, and discloses personal information in connection with the Invictus CRM platform, website, applications, and related services (collectively, the "Platform").

Invictus CRM is designed for insurance agencies, managing general agencies ("MGAs"), brokerages, insurance advisors, and related businesses.

This Privacy Policy should be read together with the Invictus CRM Terms of Service and, where applicable, the Invictus CRM Data Processing Agreement.

1. WHO WE ARE

Invictus CRM is operated by:

Team Invictus Services Inc.

operating as Invictus CRM.

Business address:

8128 128 St, Surrey, BC V3W 7G2

Privacy contact:

support@invictuscrm.com

Website:

invictuscrm.com

For purposes of this Privacy Policy, "Invictus," "we," "us," and "our" refer to the entity responsible for operating the Platform.

2. OUR ROLE IN HANDLING PERSONAL INFORMATION

Invictus may process personal information in different capacities depending on how the Platform is used.

2.1 Information about our Subscribers and Users

When you create an Invictus account, manage a subscription, communicate with us, or use our website, Invictus generally acts as the organization responsible for that information.

This may include:

• account information
• contact information
• authentication information
• billing information
• technical information
• support communications
• Platform usage information

2.2 Agency Data

When an insurance agency or other Subscriber enters information about its clients, leads, policyholders, prospects, employees, or other individuals into the Platform, that information is generally provided to Invictus by the Subscriber for the purpose of providing the Platform.

In those circumstances, the Subscriber remains responsible for determining:

• what information it collects
• why it collects it
• whether it has appropriate authority or consent
• how it uses the information
• whether its use of the Platform complies with applicable law

Invictus processes such information primarily to provide the services requested by the Subscriber.

Where appropriate, these responsibilities will be further described in an applicable Data Processing Agreement ("DPA").

3. INFORMATION WE COLLECT

We collect information necessary to provide, secure, maintain, and improve the Platform.

The information we collect depends on how you interact with Invictus.

3.1 Account Information

When an Agency creates an account, we may collect:

• Agency name
• business name
• administrator name
• email address
• telephone number
• business address
• User names
• User email addresses
• login credentials
• authentication information
• account preferences
• subscription information
• other information necessary to establish the account

4. AGENCY DATA

An Agency may enter information into Invictus CRM concerning its customers and prospects.

Depending on how the Agency uses the Platform, Agency Data may include:

• names
• addresses
• telephone numbers
• email addresses
• dates of birth
• occupation
• policy information
• insurance information
• beneficiary information
• client notes
• financial information
• documents
• forms
• electronic signatures
• communications
• lead information
• policy records
• renewal information
• task and workflow information
• other information entered by the Agency

The specific information contained in Agency Data is determined by the Agency, not by Invictus.

5. SENSITIVE PERSONAL INFORMATION

Insurance records may contain information that is sensitive in nature.

Depending on how an Agency uses the Platform, Agency Data could include information concerning:

• health
• finances
• insurance coverage
• beneficiaries
• identification
• employment
• family circumstances
• other sensitive matters

Subscribers are responsible for determining whether the collection and use of such information is legally permitted and whether appropriate notices or consents are required.

Invictus applies security measures appropriate to the nature of the information it processes through the Platform.

6. INFORMATION WE COLLECT AUTOMATICALLY

When you use the Platform, we may automatically receive technical information such as:

• IP address
• browser type
• device type
• operating system
• approximate location derived from technical information where appropriate
• pages or features accessed
• login events
• authentication events
• timestamps
• error information
• performance information
• security events
• other technical information necessary to operate and secure the Platform

This information may be used for security, troubleshooting, analytics, service improvement, and fraud prevention.

7. BILLING INFORMATION

When an Agency subscribes to a paid plan, payment information may be processed by our payment service provider, including Stripe.

Depending on the payment configuration, Invictus may receive information such as:

• billing name
• billing address
• subscription plan
• transaction information
• payment status
• invoice information
• last four digits or limited payment-card information where provided by the payment processor
• other information required to administer the subscription

Invictus does not intentionally store complete payment-card numbers where payment processing is handled by Stripe.

8. ELECTRONIC SIGNATURE INFORMATION

If the Platform provides electronic-signature functionality, information associated with a signature transaction may include:

• signer name
• email address
• signature
• timestamp
• document information
• authentication information
• transaction history
• audit information
• other information necessary to administer the signature process

Subscribers are responsible for determining whether electronic signatures are appropriate for their particular transactions and whether applicable legal requirements have been satisfied.

9. INFORMATION FROM SUPPORT AND COMMUNICATIONS

If you contact us, we may collect:

• your name
• email address
• account information
• support requests
• correspondence
• attachments
• technical information
• screenshots
• troubleshooting information
• other information you choose to provide

We use this information to respond to requests and improve the Platform.

10. HOW WE USE PERSONAL INFORMATION

We may use personal information for the following purposes:

10.1 Providing the Platform

To:

• create accounts
• authenticate Users
• provide CRM functionality
• store Agency Data
• process requests
• maintain account settings
• provide integrations
• provide electronic-signature functionality
• provide customer support
• perform other services requested by Subscribers

10.2 Billing

To:

• process subscriptions
• administer trials
• process payments
• issue invoices
• manage renewals
• process cancellations
• address failed payments

10.3 Security

To:

• detect unauthorized access
• investigate suspicious activity
• prevent fraud
• protect accounts
• monitor security events
• maintain audit logs
• investigate vulnerabilities
• protect the Platform and its users

10.4 Service improvement

We may use technical and appropriately aggregated or de-identified information to:

• understand Platform usage
• improve performance
• identify errors
• develop features
• improve reliability
• plan future products

10.5 Legal obligations

We may process information where reasonably necessary to:

• comply with applicable law
• respond to lawful requests
• comply with court orders
• protect legal rights
• investigate fraud
• enforce our agreements
• protect the safety and security of our services

11. WE DO NOT SELL AGENCY DATA

Invictus does not sell, rent, or trade Agency Data.

We do not use Agency Data for third-party advertising or marketing unrelated to providing the Platform.

We do not provide one Subscriber with another Subscriber's Agency Data.

12. DATA SEPARATION BETWEEN AGENCIES

Invictus CRM is designed as a multi-tenant platform.

Agency Data is logically associated with the applicable Agency account and access controls are designed to restrict access to authorized Users.

An Agency's Users are not authorized to access another Agency's Agency Data.

Invictus does not intentionally disclose Agency Data between Subscribers.

However, no software system can guarantee that an unauthorized security event will never occur. Invictus therefore maintains security controls, monitoring, access restrictions, and incident-response procedures designed to prevent, detect, and respond to unauthorized access.

13. ACCESS BY INVICTUS PERSONNEL

Invictus restricts internal access to Agency Data.

Authorized personnel may access Agency Data where reasonably necessary for purposes such as:

• providing support requested by a Subscriber
• troubleshooting a technical problem
• investigating security incidents
• maintaining or improving the Platform
• preventing fraud or abuse
• complying with legal obligations
• protecting the Platform

Access to sensitive systems should be subject to appropriate authorization and security controls.

Where technically available, privileged access activity may be logged and monitored.

Invictus personnel are expected to maintain confidentiality of information they access.

14. THIRD-PARTY SERVICE PROVIDERS

Invictus uses selected third-party providers to operate the Platform.

These may include:

Google Firebase

Used for certain Platform infrastructure, which may include:

• authentication
• hosting
• databases
• file storage
• application infrastructure
• related services

Stripe

Used for:

• subscription billing
• payment processing
• invoices
• payment-related services

Resend

Used for:

• transactional email
• account notifications
• system communications
• related email functionality

Anthropic

Used for:

• AI-assisted processing of documents a user chooses to upload (for example extracting details from a statement or form)

Sentry

Used for:

• error monitoring and diagnostics

Google Workspace APIs (Gmail and Google Calendar)

Used for:

• sending email from a user's own Gmail address and syncing their calendar, only when the user connects these services — see section 37

The actual providers used by the Platform may change over time.

Invictus will maintain appropriate contractual and operational controls for service providers that process personal information on our behalf.

15. SUBPROCESSORS

Invictus may use third-party service providers as subprocessors or service providers.

A current list of material subprocessors may be maintained separately and may include:

16. INTERNATIONAL PROCESSING

Client and Subscriber data is stored on Google Cloud infrastructure in the United States — specifically Google's "nam5" multi-region, with data centers in Iowa and Oklahoma, and a backup replica in South Carolina.

By using the Platform, you acknowledge that personal information may be stored and processed outside of Canada, and may be subject to the laws of that jurisdiction, including lawful access by that jurisdiction's authorities.

Invictus takes reasonable steps to select service providers and contractual arrangements appropriate to the nature of information being processed.

Subscribers should consider their own legal and regulatory obligations concerning cross-border processing when deciding what information to place into the Platform.

17. SECURITY SAFEGUARDS

Invictus uses administrative, technical, and organizational safeguards designed to protect personal information.

Depending on the Platform architecture, these safeguards may include:

• encryption during transmission
• encryption at rest where supported
• authentication
• multi-factor authentication
• access controls
• logical separation of Agency environments/data
• least-privilege principles
• logging
• monitoring
• backups
• vulnerability management
• security updates
• incident-response procedures
• administrative controls

Security controls may evolve as the Platform develops.

18. NO GUARANTEE OF ABSOLUTE SECURITY

No online service can guarantee absolute security.

Accordingly, Invictus does not represent that personal information will be completely immune from:

• cyberattacks
• unauthorized access
• malicious activity
• hardware failures
• software vulnerabilities
• third-party failures
• other security incidents

Invictus nevertheless maintains safeguards designed to reduce these risks and responds to identified security incidents in accordance with applicable law and contractual obligations.

19. PRIVACY BREACHES AND SECURITY INCIDENTS

Invictus maintains procedures for identifying, containing, investigating, documenting, and responding to privacy and security incidents.

Where Invictus determines that a breach involving personal information requires notification under applicable law or contractual obligations, Invictus will provide notification as required.

Depending on the circumstances, notification may include:

• the nature of the incident
• categories of information affected
• affected systems
• known or reasonably suspected consequences
• containment measures
• remediation measures
• recommended actions

Subscribers remain responsible for fulfilling their own legal and regulatory obligations concerning their clients and affected individuals.

20. DATA RETENTION

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, to provide the Platform, fulfill contractual obligations, resolve disputes, maintain appropriate business and security records, and comply with legal or regulatory obligations.

Different information may have different retention periods.

For example:

• active account information may be retained while an account remains active
• billing records may be retained as required for accounting and tax purposes
• security logs may be retained for security and investigation purposes
• Agency Data may be retained according to the applicable subscription and data-deletion terms

21. AGENCY DATA AFTER CANCELLATION

When an Agency cancels or terminates its account, the Agency may have a limited period to export Agency Data.

Unless otherwise agreed:

• the Agency should request an export within 30 days
• Invictus may subsequently delete Agency Data from active systems
• backup copies may remain temporarily under ordinary backup-retention cycles
• information required to be retained by law may be retained for the applicable period

The exact operational deletion schedule may be described in the applicable DPA or Data Retention Policy.

22. INDIVIDUAL PRIVACY RIGHTS

Depending on the applicable privacy law and the circumstances, individuals may have rights relating to their personal information, including rights concerning:

• access
• correction
• accuracy
• consent
• withdrawal of consent in appropriate circumstances
• complaints
• other rights provided by applicable law

When information is contained within an Agency's account, the Agency may be the organization primarily responsible for responding to the individual's request.

Invictus may assist the Agency where reasonably necessary and appropriate.

23. ACCESS AND CORRECTION REQUESTS

If an individual believes that Invictus directly holds personal information about them, they may contact us using the Privacy Contact information below.

If the information was entered into Invictus by an Agency as Agency Data, we may direct the individual to the applicable Agency.

This reflects the fact that the Agency generally determines why and how its client information is collected and used.

We may need to verify identity before providing access to personal information.

24. WITHDRAWAL OF CONSENT

Where processing is based on consent and applicable law provides a right to withdraw consent, an individual may request withdrawal of consent.

Withdrawal of consent may not affect processing that:

• is required or permitted by law
• is necessary to fulfill a contract
• is necessary for legitimate operational purposes where permitted
• has another lawful basis

Withdrawal may also affect the ability to provide certain Platform services.

25. PRIVACY COMPLAINTS

If you have concerns about how Invictus handles personal information, please contact our Privacy Officer.

We will:

• receive the complaint
• acknowledge the request where appropriate
• investigate the issue
• review relevant records
• communicate the outcome where appropriate
• take corrective action where necessary

Individuals may also have the right to contact the applicable privacy regulator.

For British Columbia private-sector privacy matters, this may include the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC).

26. CHILDREN

The Platform is designed primarily for business and professional use and is not intended to be directed toward children.

We do not knowingly design the Platform to collect children's information for marketing purposes.

Subscribers remain responsible for ensuring that their use of the Platform complies with applicable requirements concerning minors.

27. COOKIES AND SIMILAR TECHNOLOGIES

The Invictus website and Platform may use cookies, local storage, session technologies, analytics technologies, or similar mechanisms necessary for:

• authentication
• security
• maintaining sessions
• remembering preferences
• performance
• analytics
• improving the Platform

The specific technologies used may change.

Where required, Invictus will provide appropriate notices or consent mechanisms.

28. DE-IDENTIFIED AND AGGREGATED INFORMATION

Invictus may use information that has been aggregated or de-identified so that it is not reasonably capable of identifying a particular individual or Agency.

Examples may include:

• number of active accounts
• feature usage statistics
• system performance metrics
• aggregate error rates
• general Platform trends

Invictus will not intentionally use Agency Data in a manner designed to identify a particular client or Agency when using properly de-identified information.

29. BUSINESS TRANSFERS

If Invictus is involved in:

• a merger
• acquisition
• financing
• corporate reorganization
• sale of assets
• similar transaction,

personal information may be transferred as part of the transaction, subject to applicable privacy laws and appropriate safeguards.

Any successor entity may be required to continue protecting personal information in accordance with applicable law and applicable commitments.

30. LEGAL DISCLOSURES

Invictus may disclose personal information where reasonably necessary to:

• comply with a court order
• comply with applicable law
• respond to lawful government requests
• enforce our agreements
• investigate fraud
• protect our rights
• protect the security of the Platform
• protect users or other persons

Where legally permitted and reasonably practicable, Invictus will consider providing notice before disclosure.

31. THIRD-PARTY WEBSITES AND SERVICES

The Platform may contain links or integrations to third-party websites or services.

Invictus is not responsible for the privacy practices of third parties that operate independently from Invictus.

Users should review the applicable privacy policies of third-party services before providing information to them.

32. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time.

When we make material changes, we will provide reasonable notice through the Platform, website, email, or another appropriate method.

The "Last Updated" date at the top of this Privacy Policy indicates when it was most recently revised.

Where applicable law requires additional notice or consent, Invictus will comply with those requirements.

33. PRIVACY ACCOUNTABILITY

Invictus maintains a privacy management framework intended to support responsible handling of personal information.

This may include:

• privacy policies
• privacy procedures
• information inventories
• data-flow assessments
• security safeguards
• privacy impact assessments
• vendor management
• incident-response procedures
• employee and contractor confidentiality obligations
• retention and deletion procedures
• periodic review of privacy practices

34. CONTACT OUR PRIVACY OFFICER

For questions, complaints, or requests concerning privacy:

Privacy Officer Jagmeet Singh, Founder & CEO Team Invictus Services Inc. Email: support@invictuscrm.com Address: 8128 128 St, Surrey, BC V3W 7G2

When submitting a privacy request, please provide enough information for us to identify the relevant account or issue.

We may request additional information to verify identity or authority before responding to a request involving personal information.

35. APPLICABLE PRIVACY LAWS

Depending on the circumstances, Invictus may be subject to privacy legislation applicable to the organization, the Subscriber, the individual, or the jurisdiction in which services are provided.

These may include applicable Canadian federal or provincial privacy laws, including British Columbia's Personal Information Protection Act (PIPA) and, where applicable, PIPEDA, as well as other privacy laws that may apply based on the location and activities of the parties.

Nothing in this Privacy Policy is intended to exclude rights that cannot lawfully be excluded.

36. RELATIONSHIP WITH THE TERMS OF SERVICE

This Privacy Policy describes Invictus's privacy practices.

The Invictus CRM Terms of Service govern the contractual relationship between Invictus and Subscribers concerning use of the Platform.

Where an Agency has entered into a separate Data Processing Agreement, that DPA may contain additional provisions governing processing of Agency Data.

37. GOOGLE SERVICES AND THE INVICTUS FOR GMAIL EXTENSION

Connecting Google services is optional. Each advisor decides whether to connect them, and can disconnect at any time from their Profile in the Platform or at myaccount.google.com/permissions. When a service is disconnected, the stored connection tokens are deleted.

37.1 Invictus for Gmail (Chrome extension)

• When the user clicks the extension icon while viewing an email, the extension reads that one email (sender name and address, recipients, subject, date and message text) to pre-fill the forms the user chooses to save — a lead, meeting, task, or saving the email to a client's timeline.
• When the user presses Send in Gmail (if automatic saving is switched on; it can be turned off in the extension's settings), the extension reads the recipients, subject and new message text of that email. If a recipient is one of the user's own clients or leads in the Platform, the email is saved to that record's timeline; otherwise the information is discarded and not stored.
• The extension does not read the mailbox in the background and does not track browsing. It sends data only to the user's own Invictus CRM account, authenticated by a personal key that is stored by Invictus only as a one-way hash and can be cancelled at any time.

38. GOOGLE API SERVICES USER DATA POLICY — LIMITED USE

• Google user data is used only to provide and improve the user-facing features described in section 37.
• Google user data is not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to users.
• Google user data is not used for advertising and is not sold.
• No person at Invictus reads Google user data unless the user gives permission (for example for support), it is necessary for security purposes, or it is required to comply with applicable law.
• Google user data is not used to develop, improve or train generalized artificial intelligence or machine learning models.