What is collected, and why.

Short version

The four public pages of this site use Google Analytics to count visits. It is not used anywhere behind a login, it sets no advertising cookies, and nothing is shared with third parties for marketing. Everything else held is what you send deliberately, plus what is needed to keep you signed in.

The project form

Submitting the project form stores your name, email address, and anything else you filled in, along with the campaign parameters in the link you arrived on (utm_source, utm_medium, utm_campaign) and the referring site, if any. Those last four exist so that money spent finding clients can be measured against clients actually found. They are not shared and not used to build a profile of you across other sites.

Analytics

The home page and the Start, Privacy and Terms pages load Google Analytics 4, which counts visits and records which pages were viewed, roughly where in the world the visit came from, and which site referred it. It sets cookies beginning _ga that distinguish one browser from another. Google processes that on behalf of Invariant Systems, LLC under its own terms.

It runs on those four pages and nowhere else. It is not loaded on the sign-in page, anywhere inside the client portal, or anywhere in the admin area — so no page path naming an invoice, a contract or a client organization is ever sent to Google. That is enforced in the code by an allowlist of the four routes above rather than by configuration, so a page added later is excluded until somebody deliberately includes it.

Nothing is sent from a preview or development build, so the figures describe real visitors only. If you would rather not be counted, any browser content blocker stops it, and doing so changes nothing about how the site works for you.

The client portal

If you are given portal access, the account holds your name, email address, and optionally a phone number, together with the contracts, invoices, time records, documents, and messages belonging to your organization. Authentication is handled by Supabase; a session cookie keeps you signed in and is not used for tracking.

Where it lives

Application hosting is Vercel. The database, authentication, and file storage are Supabase, in a United States region. Transactional email is sent through Resend. Card payments are processed by Square, which holds the card details — this site never receives a full card number. Card payments made before 25 September 2026 were processed by Stripe, which keeps its own record of them. Visit counts on the four public pages go to Google Analytics. Each of those providers processes data on behalf of Invariant Systems, LLC and under their own terms.

How long it is kept

Business records — contracts, invoices, time entries — are kept for as long as the law and ordinary accounting practice require, which in Florida means at least seven years for anything with tax consequences. Leads that never become clients are removed once they are plainly stale. Portal accounts are removed on request.

What you can ask for

A copy of what is held about you, a correction, or deletion. Email tj@invariantsys.com and it will be handled directly — there is no ticketing system and no form to fill in. Deletion requests that conflict with a record-keeping obligation will get an explanation of what has to be kept and why.

Changes

If this page changes materially, anyone with a portal account will be told by email rather than being expected to notice a new date at the top.