Last updated September 21, 2026
Who this covers
This policy explains how Art of Vector (“we”) handles personal information collected through this website. It does not cover the data we handle during a security engagement. That is governed by the engagement agreement, rules of engagement, and NDA you sign with us, and it is kept separate from website data.
What we collect
We collect only what the features you use require.
- Assessment requests. When you submit the request form: organization name, professional email address, the service you selected, and the scope details you write.
- Client portal accounts. If you sign in to the portal: your name, email address, and account identifiers, handled by our authentication provider, plus the report requests you make.
- Booking. If you choose to load the scheduling calendar, Cal.com receives what you enter there (typically name, email, and a time).
- Technical data. Our hosting provider processes standard request data (IP address, browser type, pages requested, timestamps) to serve the site and keep it secure.
- Saved preferences. Accessibility and privacy choices stored in your browser only. See Cookies and browser storage.
We do not run analytics, advertising, or cross-site tracking on this website. We do not sell personal information.
How we use it
- To respond to your request, ask scoping questions, and prepare rules of engagement and an NDA.
- To run the client portal and deliver the reports you ask for.
- To keep the website secure, prevent abuse, and fix faults.
- To meet legal obligations and keep records of our engagements.
Why we may process it
Where data protection law such as the GDPR or UK GDPR applies, we rely on taking steps at your request before entering into an agreement (assessment requests), our legitimate interests in operating and securing the site and responding to business enquiries, compliance with legal obligations, and your consent where we ask for it (for example, loading a third-party embed).
Cookies and browser storage
- Sign-in cookies from our authentication provider are set when you use the client portal. They are necessary for it to work.
- Local storage remembers your accessibility choices (
aov-a11y) and your privacy choices (aov-privacy) on your device. Nothing is sent to us. - Third-party embed. The Cal.com calendar can set its own cookies. It does not load until you choose to load it.
You can change or clear these at any time in Your Privacy Settings, or through your browser.
How long we keep it
We keep assessment requests and related correspondence for as long as needed to respond and, if an engagement follows, to keep records of it. Requests that do not lead to an engagement are deleted or anonymized within a reasonable period. Portal account data is kept while the account is active. Hosting logs are kept for a short, rolling period. You can ask us to delete your information sooner.
How we protect it
Data is sent over encrypted connections, access is limited to people who need it, and we test our own systems the way we test others. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you find a weakness in this website, please follow our responsible disclosure policy.
International transfers
Our providers may process data in countries other than your own. Where required, we rely on recognized transfer mechanisms such as standard contractual clauses to protect it.
Your rights
Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, restrict or object to its use, receive a portable copy, and withdraw consent you gave. You may also complain to your data protection authority.
To exercise a right, contact us through the contact page. We may need to verify your identity first, and we will respond within the time the law allows.
Children
This website is for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16.
Changes to this policy
We may update this policy as the site or the law changes. The date at the top shows the latest revision. Significant changes will be highlighted on this page.
Contact
Questions about privacy: use the contact page and mark your message “Privacy”.