Last Updated: August 20, 2026 Effective Date: August 20, 2026
This Privacy Policy explains how Invictus CRM ("Invictus", "we", "us", or "our") collects, uses, protects, retains, and discloses personal information in connection with the Invictus CRM platform, website, applications, and related services (collectively, the "Platform").
Invictus CRM is designed for insurance agencies, managing general agencies ("MGAs"), brokerages, insurance advisors, and related businesses.
This Privacy Policy should be read together with the Invictus CRM Terms of Service and, where applicable, the Invictus CRM Data Processing Agreement.
Invictus CRM is operated by:
Team Invictus Services Inc.
operating as Invictus CRM.
Business address:
8128 128 St, Surrey, BC V3W 7G2
Privacy contact:
support@invictuscrm.com
Website:
invictuscrm.com
For purposes of this Privacy Policy, "Invictus," "we," "us," and "our" refer to the entity responsible for operating the Platform.
Invictus may process personal information in different capacities depending on how the Platform is used.
When you create an Invictus account, manage a subscription, communicate with us, or use our website, Invictus generally acts as the organization responsible for that information.
This may include:
When an insurance agency or other Subscriber enters information about its clients, leads, policyholders, prospects, employees, or other individuals into the Platform, that information is generally provided to Invictus by the Subscriber for the purpose of providing the Platform.
In those circumstances, the Subscriber remains responsible for determining:
Invictus processes such information primarily to provide the services requested by the Subscriber.
Where appropriate, these responsibilities will be further described in an applicable Data Processing Agreement ("DPA").
We collect information necessary to provide, secure, maintain, and improve the Platform.
The information we collect depends on how you interact with Invictus.
When an Agency creates an account, we may collect:
An Agency may enter information into Invictus CRM concerning its customers and prospects.
Depending on how the Agency uses the Platform, Agency Data may include:
The specific information contained in Agency Data is determined by the Agency, not by Invictus.
Insurance records may contain information that is sensitive in nature.
Depending on how an Agency uses the Platform, Agency Data could include information concerning:
Subscribers are responsible for determining whether the collection and use of such information is legally permitted and whether appropriate notices or consents are required.
Invictus applies security measures appropriate to the nature of the information it processes through the Platform.
When you use the Platform, we may automatically receive technical information such as:
This information may be used for security, troubleshooting, analytics, service improvement, and fraud prevention.
When an Agency subscribes to a paid plan, payment information may be processed by our payment service provider, including Stripe.
Depending on the payment configuration, Invictus may receive information such as:
Invictus does not intentionally store complete payment-card numbers where payment processing is handled by Stripe.
If the Platform provides electronic-signature functionality, information associated with a signature transaction may include:
Subscribers are responsible for determining whether electronic signatures are appropriate for their particular transactions and whether applicable legal requirements have been satisfied.
If you contact us, we may collect:
We use this information to respond to requests and improve the Platform.
We may use personal information for the following purposes:
To:
To:
To:
We may use technical and appropriately aggregated or de-identified information to:
We may process information where reasonably necessary to:
Invictus does not sell, rent, or trade Agency Data.
We do not use Agency Data for third-party advertising or marketing unrelated to providing the Platform.
We do not provide one Subscriber with another Subscriber's Agency Data.
Invictus CRM is designed as a multi-tenant platform.
Agency Data is logically associated with the applicable Agency account and access controls are designed to restrict access to authorized Users.
An Agency's Users are not authorized to access another Agency's Agency Data.
Invictus does not intentionally disclose Agency Data between Subscribers.
However, no software system can guarantee that an unauthorized security event will never occur. Invictus therefore maintains security controls, monitoring, access restrictions, and incident-response procedures designed to prevent, detect, and respond to unauthorized access.
Invictus restricts internal access to Agency Data.
Authorized personnel may access Agency Data where reasonably necessary for purposes such as:
Access to sensitive systems should be subject to appropriate authorization and security controls.
Where technically available, privileged access activity may be logged and monitored.
Invictus personnel are expected to maintain confidentiality of information they access.
Invictus uses selected third-party providers to operate the Platform.
These may include:
Google Firebase
Used for certain Platform infrastructure, which may include:
Stripe
Used for:
Resend
Used for:
The actual providers used by the Platform may change over time.
Invictus will maintain appropriate contractual and operational controls for service providers that process personal information on our behalf.
Invictus may use third-party service providers as subprocessors or service providers.
A current list of material subprocessors may be maintained separately and may include:
Client and Subscriber data is stored on Google Cloud infrastructure in the United States — specifically Google's "nam5" multi-region, with data centers in Iowa and Oklahoma, and a backup replica in South Carolina.
By using the Platform, you acknowledge that personal information may be stored and processed outside of Canada, and may be subject to the laws of that jurisdiction, including lawful access by that jurisdiction's authorities.
Invictus takes reasonable steps to select service providers and contractual arrangements appropriate to the nature of information being processed.
Subscribers should consider their own legal and regulatory obligations concerning cross-border processing when deciding what information to place into the Platform.
Invictus uses administrative, technical, and organizational safeguards designed to protect personal information.
Depending on the Platform architecture, these safeguards may include:
Security controls may evolve as the Platform develops.
No online service can guarantee absolute security.
Accordingly, Invictus does not represent that personal information will be completely immune from:
Invictus nevertheless maintains safeguards designed to reduce these risks and responds to identified security incidents in accordance with applicable law and contractual obligations.
Invictus maintains procedures for identifying, containing, investigating, documenting, and responding to privacy and security incidents.
Where Invictus determines that a breach involving personal information requires notification under applicable law or contractual obligations, Invictus will provide notification as required.
Depending on the circumstances, notification may include:
Subscribers remain responsible for fulfilling their own legal and regulatory obligations concerning their clients and affected individuals.
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, to provide the Platform, fulfill contractual obligations, resolve disputes, maintain appropriate business and security records, and comply with legal or regulatory obligations.
Different information may have different retention periods.
For example:
When an Agency cancels or terminates its account, the Agency may have a limited period to export Agency Data.
Unless otherwise agreed:
The exact operational deletion schedule may be described in the applicable DPA or Data Retention Policy.
Depending on the applicable privacy law and the circumstances, individuals may have rights relating to their personal information, including rights concerning:
When information is contained within an Agency's account, the Agency may be the organization primarily responsible for responding to the individual's request.
Invictus may assist the Agency where reasonably necessary and appropriate.
If an individual believes that Invictus directly holds personal information about them, they may contact us using the Privacy Contact information below.
If the information was entered into Invictus by an Agency as Agency Data, we may direct the individual to the applicable Agency.
This reflects the fact that the Agency generally determines why and how its client information is collected and used.
We may need to verify identity before providing access to personal information.
Where processing is based on consent and applicable law provides a right to withdraw consent, an individual may request withdrawal of consent.
Withdrawal of consent may not affect processing that:
Withdrawal may also affect the ability to provide certain Platform services.
If you have concerns about how Invictus handles personal information, please contact our Privacy Officer.
We will:
Individuals may also have the right to contact the applicable privacy regulator.
For British Columbia private-sector privacy matters, this may include the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC).
The Platform is designed primarily for business and professional use and is not intended to be directed toward children.
We do not knowingly design the Platform to collect children's information for marketing purposes.
Subscribers remain responsible for ensuring that their use of the Platform complies with applicable requirements concerning minors.
The Invictus website and Platform may use cookies, local storage, session technologies, analytics technologies, or similar mechanisms necessary for:
The specific technologies used may change.
Where required, Invictus will provide appropriate notices or consent mechanisms.
Invictus may use information that has been aggregated or de-identified so that it is not reasonably capable of identifying a particular individual or Agency.
Examples may include:
Invictus will not intentionally use Agency Data in a manner designed to identify a particular client or Agency when using properly de-identified information.
If Invictus is involved in:
personal information may be transferred as part of the transaction, subject to applicable privacy laws and appropriate safeguards.
Any successor entity may be required to continue protecting personal information in accordance with applicable law and applicable commitments.
Invictus may disclose personal information where reasonably necessary to:
Where legally permitted and reasonably practicable, Invictus will consider providing notice before disclosure.
The Platform may contain links or integrations to third-party websites or services.
Invictus is not responsible for the privacy practices of third parties that operate independently from Invictus.
Users should review the applicable privacy policies of third-party services before providing information to them.
We may update this Privacy Policy from time to time.
When we make material changes, we will provide reasonable notice through the Platform, website, email, or another appropriate method.
The "Last Updated" date at the top of this Privacy Policy indicates when it was most recently revised.
Where applicable law requires additional notice or consent, Invictus will comply with those requirements.
Invictus maintains a privacy management framework intended to support responsible handling of personal information.
This may include:
For questions, complaints, or requests concerning privacy:
Privacy Officer Jagmeet Singh, Founder & CEO Team Invictus Services Inc. Email: support@invictuscrm.com Address: 8128 128 St, Surrey, BC V3W 7G2
When submitting a privacy request, please provide enough information for us to identify the relevant account or issue.
We may request additional information to verify identity or authority before responding to a request involving personal information.
Depending on the circumstances, Invictus may be subject to privacy legislation applicable to the organization, the Subscriber, the individual, or the jurisdiction in which services are provided.
These may include applicable Canadian federal or provincial privacy laws, including British Columbia's Personal Information Protection Act (PIPA) and, where applicable, PIPEDA, as well as other privacy laws that may apply based on the location and activities of the parties.
Nothing in this Privacy Policy is intended to exclude rights that cannot lawfully be excluded.
This Privacy Policy describes Invictus's privacy practices.
The Invictus CRM Terms of Service govern the contractual relationship between Invictus and Subscribers concerning use of the Platform.
Where an Agency has entered into a separate Data Processing Agreement, that DPA may contain additional provisions governing processing of Agency Data.