Privacy Policy

Effective date: October 20, 2026

1. Who we are and what this policy covers

Vanguard Management Solutions, Inc. ("VMGTS," "we," "us," or "our") operates vmgts.com. This policy explains how the public website, its Contact form, its job application form, the staff-only Insights admin, and our LinkedIn posting handle information. It does not describe employee-portal, customer-system, or contract-specific processing.

2. Information you provide through the Contact form

When you submit the Contact form, we store the following in the VMGTS application database: first name, last name, email address, organization, selected topic, and message. We also store submission and delivery metadata, such as a submission identifier, timestamps, delivery status, selected transport, and a provider message identifier when available.

Please use the Contact form only for ordinary business inquiries. Do not submit classified information, controlled or regulated data, account credentials, or other sensitive information through this general-purpose form.

3. Job applications

When you apply for a position on the website, we collect your first name, last name, email address, phone number, résumé (PDF or Word file), your answers to the posting's application questions, and a record of the consent you give, with the time it was given. We also keep submission identifiers and timestamps. Résumé files are checked for malware before they are stored.

We use application information to review your candidacy, contact you about the position, and meet our legal and recordkeeping obligations as an employer and federal contractor. Authorized VMGTS personnel involved in hiring can see your application.

4. Turnstile security verification and IP handling

We use Cloudflare Turnstile to reduce automated abuse. Turnstile runs browser-side challenges and processes signals about the visitor or browser environment. When the form is submitted, our server sends the Turnstile token and the request IP address to Cloudflare's Siteverify service for validation.

The VMGTS application does not store the raw Turnstile token or raw IP address in the Contact database or application logs. For rate limiting, it retains only a 32-byte HMAC digest derived from the IP address, together with the security-window start, attempt count, and last-attempt time. The digest is used only to recognize repeated requests within a short window; it is not the Contact submission record.

Cloudflare processes Turnstile data under its own practices. See the Cloudflare Turnstile Privacy Addendum and Cloudflare Privacy Policy.

5. Cookies

The public pages of vmgts.com do not use advertising or analytics cookies. The Contact form uses Cloudflare Turnstile, which may use browser storage or cookies to tell people from automated traffic (see section 4). The staff-only admin area sets strictly necessary cookies that keep an authorized VMGTS employee signed in; visitors to the public site never receive them.

6. Staff sign-in

Authorized VMGTS staff sign in to a private area of the website with their VMGTS Microsoft 365 accounts to publish Insights articles. For each sign-in we store a session record with the employee's name, work email, Microsoft account identifiers, and sign-in times. A session ends after 12 hours, or 2 hours without use, and its record is then deleted. We do not use Microsoft sign-in for website visitors.

7. LinkedIn

VMGTS publishes its own Insights articles to the VMGTS company page on LinkedIn through LinkedIn's official API. We send LinkedIn only the article's post text, title, summary, image, and web address. We do not send LinkedIn any information about website visitors, and we do not collect information from LinkedIn about its members. Links to LinkedIn take you to LinkedIn, whose Privacy Policy applies there.

8. How we use information

We use Contact information to receive, route, review, respond to, and maintain a record of business inquiries; deliver the inquiry to the responsible VMGTS mailbox; recover or reconcile delivery failures; protect the forms and website from misuse; and comply with applicable legal obligations. We use application information as described in section 3. We do not sell personal information.

9. Service providers and disclosures

• Amazon Web Services. The website, its database, and its email delivery run on Amazon Web Services. After the database stores a valid Contact submission, our application uses Amazon Simple Email Service to email it to the VMGTS mailbox configured for the selected topic. The email includes the submitter's name, email (as Reply-To), organization, selected topic, message, submission identifier, and submission time. See the AWS Privacy Notice.
• Cloudflare Turnstile. Cloudflare receives browser-side challenge signals and, through Siteverify, the Turnstile token and request IP address to validate a submission and help prevent abuse.
• Microsoft (Entra ID). When a VMGTS employee signs in to the admin area, Microsoft confirms their identity and role to the website. See the Microsoft Privacy Statement.
• LinkedIn. Receives the Insights articles VMGTS chooses to post, as described in section 7.
• VMGTS personnel and advisors. Authorized people may access an inquiry or application when needed to review, respond, operate the service, protect VMGTS or others, or meet legal obligations.

We may also disclose information when required by applicable law or a valid legal process, or when reasonably necessary to protect rights, safety, and the integrity of our services.

10. Logs and security

The application is designed so its operational logs do not contain raw Contact-form fields, rendered email bodies, raw IP addresses, Turnstile tokens, or raw provider errors. Operational records may include non-content metadata such as a submission identifier, transport name, template name, and outcome.

We use administrative, technical, and organizational safeguards intended to protect information. No system or transmission method can be guaranteed to be completely secure.

11. How long we keep information

• Contact submissions and their delivery records: 3 years from submission, then deleted.
• Job applications, including résumés and answers: 2 years from submission, then deleted.
• Staff sign-in sessions: deleted when the session ends.
• Database backups: automatic backups cover the previous seven days and are then overwritten, so deleted information leaves the backups within seven days.

We keep information longer only when the law requires it or when it is needed for a legal claim or investigation.

12. Your choices and requests

To ask about, correct, or request deletion of information you have given us, email info@vmgts.com. We may need to verify your identity and authority, and we will respond as applicable law requires. Some information may need to be kept for the reasons in section 11.

13. Children's information

The website is not directed to children under 13, and we do not knowingly collect their information.

14. Third-party sites and services

The website may link to third-party sites or use third-party services. Their privacy practices are governed by their own notices. Review those notices before providing information directly to them.

15. Changes and contact

If we change this policy, we will post the revised version here with its new effective date.

Vanguard Management Solutions, Inc.

10560 Main Street, Suite PS140, Fairfax, VA 22030

info@vmgts.com