Privacy Policy

Last updated: 29 July 2026

I'm Isaac Pullig, and I run Cacti Security LLC on my own. This policy explains exactly what happens to your information when you use this website. It's written plainly, because a security company hiding behind vague legal language would be a contradiction.

1. What I collect

Information you give me

When you submit the contact form, the quote form, or create an account, I store what you enter:

• Contact form: name, email, company, phone, service of interest, and your message.
• Quote form: name, email, company, phone, services needed, company size, timeline, budget range, and any details you provide.
• Account signup: name, email, company, and a password. Passwords are hashed with bcrypt before storage — I never see or store the password itself, and I cannot recover it for you.

All of these fields are optional except the ones marked required on each form. Don't send me anything you'd rather not have stored.

Information collected automatically

I count page views so I can tell which parts of the site are useful. This is done with my own software on my own server — no Google Analytics, no third-party tracking script, no advertising pixel.

For each page view I record the page path, the referring website's domain (not the full URL), the time, and a one-way anonymised visitor identifier. That identifier is a hash of your IP address and browser, combined with a secret that changes every day. It lets me count returning visits within a single day, and becomes permanently unlinkable after that. I do not store your IP address or your full browser string.

If your browser sends a Do Not Track or Global Privacy Control signal, no page view is recorded at all.

2. What I never collect

• No cookies of any kind, so there's no cookie banner to dismiss.
• No advertising or social media trackers.
• No cross-site profiling or data brokers.
• No location data beyond what a referring domain implies.
• No payment details — invoicing happens outside this website.

3. Why I hold it

Only to run the business: to reply to your enquiry, prepare a quote you asked for, keep track of engagements, and understand which pages are worth improving. I do not sell, rent, trade, or share your information with anyone for marketing purposes. Ever.

I will not add you to a mailing list because you filled in a contact form. If I ever start a newsletter, you'll have to ask for it.

4. Where it lives, and who can reach it

Form submissions and account records are stored in a PostgreSQL database hosted by Supabase on servers in the United States. The website itself runs on DigitalOcean. Notification emails are delivered through Apple iCloud Mail. These providers process data on my behalf as infrastructure; they aren't given your information for their own purposes.

Connections to this site are encrypted with TLS, and the connection between the site and its database enforces certificate verification. I'm the only person with access to the database and the admin panel.

5. How long I keep it

Data	Retention
Contact and quote submissions	Up to 3 years from last contact, so I have a record of what we discussed. Deleted sooner on request.
Client account records	While the account is active, and deleted on request.
Anonymous page view counts	Up to 24 months. Not linked to you after the day it was recorded.
Engagement records and reports	As set out in the contract for that engagement, which typically requires longer retention.

6. Your choices

Whatever jurisdiction you're in, I'll honour these:

• See it — ask for a copy of everything I hold about you.
• Correct it — tell me what's wrong and I'll fix it.
• Delete it — ask, and I'll remove it unless a signed contract or the law requires me to keep it.
• Opt out of analytics — enable Do Not Track or Global Privacy Control in your browser and nothing is recorded.

Email [email protected] and I'll respond within 30 days, usually far sooner. There's no form to fill in and no verification hoops — just ask.

7. Children

This is a service for businesses. It isn't directed at anyone under 16, and I don't knowingly collect information from children. If you believe a child has sent me information, email me and I'll delete it.

8. Security testing engagements

If you hire me for penetration testing or a security assessment, that work is governed by a separate signed agreement covering scope, authorisation, confidentiality, and how findings are handled. Assessment findings about your systems are confidential, held only as long as that agreement specifies, and never used as marketing material or a case study without your written permission.

9. Breach notification

If your information is ever exposed in a breach of my systems, I'll tell you directly and promptly — what happened, what was affected, and what I'm doing about it. Practising what I advise clients to do isn't optional.

10. Changes

If this policy changes materially, the date at the top changes and the substance of the change is described here. I won't quietly broaden what I collect.

11. Contact

Cacti Security LLC
Colorado Springs, Colorado, United States
Email: [email protected]
Phone: +1 (720) 628-9365