Privacy Policy – Tholos Core

Effective September 7, 2026 — Version 1.0

PRIVACY POLICY

For visitors to the Site and recipients of our business communications.

Operator	____________________________________Invariant Systems LLC (“the Firm,” “we,” “us”)
Website	____________________________tholoscore.com (the “Site”)
Contact; mailing address	Email: ____________________________victor@tholoscore.com <br>Address: _________1500 N Grant St, Ste N, Denver, CO 80203
Effective date; last updated	Effective: ______________September 7, 2026 Last updated: ______________ Version: 1.0

The Short Version

We collect only what you give us through the Site and our business correspondence, plus basic analytics about Site usage, and business contact information from public and professional sources for business-to-business outreach. We do not sell personal data. We do not share personal data for cross-context behavioral advertising. And by architecture, not just by promise: our software platform, Tholos Core, runs entirely inside our customers’ own Salesforce environments and transmits no customer data — and no telemetry — to us at all. The sections below say the same things in full.

1 — Scope of This Policy

1.1. What This Policy Covers. This Policy describes how we handle personal information of visitors to the Site, people who correspond with us, and business contacts we reach in sales and marketing. It applies to the Site and to our marketing and business-development communications.

1.2. What This Policy Does Not Cover. This Policy does not govern: (a) data we access or process for clients in the course of a professional-services engagement, which is governed exclusively by the applicable services agreement and its confidentiality terms; or (b) data processed by the Tholos Core platform, which executes inside the customer’s own Salesforce environment under the customer’s license agreement and never reaches us (Section 4). Where a contract between us and your organization addresses data, the contract governs.

2 — Information We Collect

2.1. Information You Provide. Contact and inquiry details you submit through forms or email (name, business email, company, role, message contents); responses you choose to return in our discovery materials; scheduling information you provide when booking a call; and the contents of our business correspondence.

2.2. Information Collected Automatically. Standard technical data when you visit the Site: IP address, browser and device type, pages viewed, referring page, and timestamps, collected through server logs and the analytics cookies described in Section 6.

2.3. Information from Other Sources. Business contact information about professionals and companies — such as name, title, company, and business email — gathered from public and professional sources (for example, company websites, professional networking profiles, and business directories) for business-to-business outreach. Section 7 describes how to opt out of that outreach permanently.

3 — How We Use Information

We use the information above to: respond to inquiries and provide requested information; schedule and conduct meetings; perform and administer engagements your organization enters with us; send business-to-business communications about our services and platform, with opt-out honored per Section 7; operate, secure, and improve the Site; comply with law and enforce agreements; and protect our rights and the rights of others. We do not use personal information collected under this Policy to train artificial-intelligence models.

4 — Tholos Core and Client Data

4.1. The Architecture. Tholos Core is a native Salesforce application that installs and executes entirely within a customer’s own Salesforce environment. All of its processing and storage occurs inside that environment. The platform transmits no customer data, telemetry, diagnostics, or usage data to us or to any infrastructure operated by or for us; its own telemetry persists inside the customer’s environment. Any external connections it makes are limited to systems the customer itself designates and credentials, solely to bring data into the customer’s environment.

4.2. Consequence. Because of that architecture, we do not receive, host, store, or process our customers’ business data through the platform, and this Policy therefore has almost nothing to say about it: it never arrives. Where our personnel are separately given access to a client environment during a consulting engagement, that access is governed by the engagement contract and its confidentiality terms, not by this Policy.

5 — How We Share Information

We share personal information only: (a) with service providers who process it on our behalf and under our instructions — such as website hosting, email, scheduling, and analytics providers — for the purposes above; (b) with our professional advisors under duties of confidentiality; (c) as required by law, legal process, or to protect rights, safety, and security; and (d) in connection with a merger, financing, reorganization, or sale of all or part of our business or assets, in which case personal information may be transferred to the successor as a business asset, subject to this Policy or an equivalent one. We do not sell personal information, and we do not share it for cross-context behavioral or targeted advertising.

6 — Cookies and Analytics

The Site uses essential cookies needed for it to function and analytics cookies that help us understand aggregate Site usage. You can control cookies through your browser settings, and the Site will continue to function if you block non-essential cookies. Where applicable law requires it, we honor opt-out preference signals such as the Global Privacy Control, and we treat such signals as an opt-out of any covered sharing as practicable. The Site does not respond to legacy “Do Not Track” headers, for which no standard has been adopted.

7 — Marketing Choices

Every marketing and outreach message we send identifies us and includes a way to opt out. To stop receiving marketing or business-development communications, reply with a request, use any unsubscribe mechanism provided, or email us at the address above; we will honor the request promptly and add you to a permanent suppression list. Opting out of marketing does not affect communications your organization requests or that relate to an active engagement.

8 — Your Rights and Choices

8.1. Requests We Honor. You may request access to, correction of, or deletion of personal information we hold about you, and may object to or ask us to restrict certain processing, by contacting us at the address above. We honor such requests as a matter of policy where practicable, subject to information we must retain for legal, security, or contractual reasons, and we will not discriminate against you for making a request. We may take reasonable steps to verify your identity before acting.

8.2. State Privacy Laws. United States state privacy laws — including the Colorado Privacy Act and similar laws of other states — grant residents specific rights against businesses that meet those laws’ applicability thresholds, and several apply mainly to data about individuals acting in a personal or household capacity rather than business contact data. To the extent any such law applies to us and to you, you may exercise the rights it provides (which may include access, correction, deletion, portability, opt-out of sale, sharing, targeted advertising, or profiling, and the right to appeal a refusal) through the contact above, and we will respond within the time and in the manner that law requires, including our appeal process where required.

9 — Retention; Security; International; Children

9.1. Retention. We keep personal information only as long as needed for the purposes described above, to comply with legal obligations, to resolve disputes, and to enforce agreements, and then delete or de-identify it in the ordinary course.

9.2. Security. We maintain commercially reasonable administrative, technical, and organizational safeguards designed to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9.3. International Visitors. We are a United States business, our services are directed to businesses in the United States, and information we collect is processed in the United States, where privacy laws may differ from those of your jurisdiction. If you access the Site from elsewhere, you understand your information will be processed in the United States as described in this Policy.

9.4. Children. The Site is intended for business users and is not directed to children. We do not knowingly collect personal information from anyone under eighteen (18), and we will delete any such information we learn we have collected from a child under thirteen (13) consistent with law.

10 — Changes; Contact

We may update this Policy from time to time; the “last updated” date above reflects the current version, and material changes will be posted on the Site. Questions, requests, and complaints may be directed to the email or mailing address in the table above.