Last updated 9 November 2026.
The short version
- The personal data you choose to give us is what you type into the contact form or send to info@todosec.com.
- Form messages go to Apollo or Formspree, depending on which form you use. We use them to answer you.
- We have not set an automatic deletion date. Your inquiry stays until we delete it, and we delete it when you ask.
- Our own scripts set no cookies and use no browser storage.
- Cloudflare Web Analytics counts page views without cookies.
What the contact form collects
The contact page has two forms, and you only ever fill in one.
The basic form shows first. The Apollo form replaces it once Apollo reports that its form has loaded, unless you have already started using the basic form. Under the Apollo form, "Trouble sending? Use the basic form" brings the basic form back.
The Apollo form
Apollo (Apollo.io) hosts this form and shows it in a frame on our page. It asks for:
- Name and email (required).
- Company.
- Service interest, picked from a list.
- Message (required).
It also has a hidden field, probe_nonce, which we set up for our own delivery checks. Our page never fills it in for visitors.
A submission creates or updates a contact record in our Apollo account. Apollo's form builder can add data from Apollo's own database to that record; we turned that off. Contact enrichment, phone enrichment and form auto-fill are off, and the form's credit limit is 0. The form's allowed domains are todosec.com and qa.todosec.com.
The form includes a Google reCAPTCHA check against spam. It runs inside Apollo's frame, so Google receives data about the check under its Privacy Policy and Terms of Service. This site is protected by reCAPTCHA, and Google's Privacy Policy and Terms of Service apply.
The frame loads as soon as you open the contact page, whichever form you end up using. Apollo therefore receives the browser request for it, which carries your IP address, your browser's user agent and our domain as the referrer. The frame is sandboxed: it cannot navigate our page, and our page passes it no tracking parameters.
The basic form
Formspree receives the basic form and emails the submission to our inbox. With JavaScript turned off, your browser posts the form straight to formspree.io, and any page Formspree shows next is Formspree's.
| Field | Required | Why we ask |
|---|---|---|
| Name | Yes | To address you in our reply. |
| Yes | To reply to you. | |
| Company | No | To understand the organization the work is for. |
| Service interest | No | To route your inquiry to the right service. |
| Message | Yes | Your question, up to 1,000 characters. |
| A hidden spam trap | No | Invisible to people and left empty. Formspree ignores a submission that fills it in. |
Prefer no form at all? Email info@todosec.com directly.
Why we collect it
We use your inquiry to reply to you, to scope the work you asked about, and to follow up on that conversation. Nothing else.
Where your inquiry is stored and for how long
- Apollo: the contact record stays in our Apollo account until we delete it. We have not configured automatic deletion.
- Formspree: Formspree keeps submission history for as long as our Formspree plan allows. Its account limits page lists 30 days on the free plan and longer on paid plans.
- Our mailbox: the email Formspree sends us stays there until we delete it.
We have not set a fixed retention period. To have your inquiry deleted, see Deletion and questions.
Analytics
Cloudflare adds its Web Analytics script to our pages as it serves them. The script reports page views, the page path, the site you came from, your country, device type and browser, and page load times.
Cloudflare says Web Analytics does not collect or use visitors' personal data, uses no cookies or localStorage and does not fingerprint visitors. It does not log query strings, keeps unsampled data for 7 days, then keeps aggregated data that we can view for six months.
We do not run any other analytics, advertising or social-media tracker. Our Content-Security-Policy lets scripts load only from todosec.com and Cloudflare's analytics domain.
Server logs
Every request to todosec.com passes through Cloudflare, which serves and protects the site under its privacy policy. Cloudflare checks each request's country, network and user agent against our blocking rules.
Cloudflare fetches our pages from Amazon S3. S3 accepts those requests only from Cloudflare's network, and it keeps server access logs in a private bucket of ours. Each log line records the time, the file requested, the requesting address (a Cloudflare server, not your device), and the user-agent and referrer headers Cloudflare passes on from your browser. We have not configured an expiry on that bucket, so the logs stay until we delete them.
Cookies and browser storage
Our pages and scripts set no cookies and use no localStorage, sessionStorage or IndexedDB. When we checked on 9 November 2026, responses from todosec.com set no cookies.
Cloudflare challenges requests for a few paths no visitor needs, such as /.env. Passing a challenge stores Cloudflare's cf_clearance cookie.
The Apollo form runs in its own frame on Apollo's domain, and the reCAPTCHA check inside it runs on Google's. Those providers can set their own cookies there. Google says reCAPTCHA sets a necessary cookie, _GRECAPTCHA, for its risk analysis. Using the basic form or email keeps your inquiry out of Apollo, but it does not stop the frame from loading. To keep the frame from loading at all, block app.apollo.io with a content blocker; the basic form then stays on the page and still works.
Services your browser contacts
Our Referrer-Policy tells your browser to send other sites only our domain name, https://todosec.com, as the referrer, never the full page address. The site also blocks access to your location, camera and microphone.
| Address | Provider | What it does |
|---|---|---|
| app.apollo.io | Apollo | Hosts the Apollo form frame on the contact page. |
| formspree.io | Formspree | Receives the basic form. |
| static.cloudflareinsights.com | Cloudflare | Serves the Web Analytics script. |
| cloudflareinsights.com | Cloudflare | Receives the Web Analytics page-view report. |
| fonts.googleapis.com | Google Fonts | Allowed by our security policy. No page loads from it; our fonts come from todosec.com. |
| fonts.gstatic.com | Google Fonts | Allowed by our security policy. No page loads from it. |
| cdnjs.cloudflare.com | Cloudflare cdnjs | Allowed by our security policy. No page loads from it. |
Your choices
- Email us instead of using a form.
- Use the basic form or email to keep your inquiry out of Apollo, and block app.apollo.io if you would rather not load Apollo's frame and Google's reCAPTCHA at all.
- Block the analytics script with any content blocker. The site works without it.
- Ask us for a copy of your inquiry, a correction or its deletion.
Deletion and questions
Email info@todosec.com from the address you used. We then delete your inquiry from Apollo, from Formspree and from our mailbox.
You can also contact the providers directly: Apollo at privacy@apollo.io (Apollo privacy policy) and Formspree at team@formspree.io (Formspree privacy policy).
Report a security issue with this site to the same address.
Changes to this notice
When we change the contact form, its providers or what our pages load, we update this page in the same change and move the date at the top.