Privacy Policy

Last updated: 10 July 2026

1. Who we are

Phantom Cybersecurity ("we", "us") provides penetration testing, managed defence, and compliance readiness services. This policy explains what personal information we collect through phantomcybersecurity.in, why we collect it, and the choices you have. It applies to this website only. Client engagements are governed by separate written agreements with their own confidentiality and data handling terms.

2. Information we collect

We collect information in three ways:

• Contact form. When you submit an inquiry we collect your name, work email, company, company website (optional), the service you need, your timeline, your message, and your consent confirmation.
• Email correspondence. If you write to us directly, we hold the contents of that correspondence.
• Analytics, only with your consent. If you allow analytics, we collect anonymous usage data: the pages you view, where you click (as positions on the page), how far you scroll, your viewport width, and the site you arrived from (its address only). This is linked to a random, anonymous id in your browser, not to your identity. We do not collect your name, your email, anything you type, or your IP address through analytics. Nothing is collected if you decline, or if your browser sends a Do Not Track or Global Privacy Control signal. Our cookie policy lists the full detail.
• Technical logs. Our hosting and database providers record standard server logs, such as IP address, browser type, and pages requested, for security and reliability. These are operational logs, not marketing analytics.

3. How we use your information

• To respond to your inquiry and prepare a scoping call or proposal.
• To prioritise requests marked as urgent or incident related.
• To maintain the security of this website and our systems.
• To meet legal and regulatory obligations.

We do not sell your information. We do not add you to a mailing list. We contact you only about the inquiry you sent us.

4. Legal basis

We process your inquiry data on the basis of your consent, given through the checkbox on the contact form, and our legitimate interest in responding to a request you initiated. You can withdraw consent at any time by writing to us. Our optional analytics is processed only on the basis of your separate consent, given through the analytics banner, and you can withdraw it at any time by declining, by enabling Do Not Track or Global Privacy Control, or by clearing this site's data.

5. Where your information lives

Contact form submissions are stored in a managed database service (Supabase) and transmitted over encrypted connections. Email correspondence is held with our email provider. Access is restricted to the people who need it to respond to you, following the same least privilege principle we apply in our client work.

6. Retention

We keep inquiry data for up to 24 months so we can pick up conversations that resume later. If an engagement follows, related information is retained per the engagement agreement. You can ask us to delete your inquiry data at any time and we will do so unless the law requires us to keep it. Anonymous analytics data is kept for up to 180 days and then deleted.

7. Sharing

We share personal information only with the service providers named above, acting on our instructions, and with authorities where the law requires it. We never trade or sell it.

8. Your rights

Subject to applicable law, including India's Digital Personal Data Protection Act, 2023 and, where it applies, the EU General Data Protection Regulation, you may request access to, correction of, or deletion of your personal information, and you may withdraw consent. Write to hello@phantomcybersecurity.in and we will act on verified requests promptly.

9. Security

We protect your information with encryption in transit, restricted write-only database access from this website, least privilege access internally, and defined retention. If we ever become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

10. Children

This website is intended for businesses and is not directed at children. We do not knowingly collect information from anyone under 18.

11. Changes to this policy

If we change this policy, we will update it here with a new date. Material changes will be noted clearly at the top of the page.