Privacy Policy

This Privacy Policy describes how Fortanixor Technologies F.Z.C (“Fortanixor,” “we,” “us,” or “our”) processes personal data when it acts as a controller. That includes when you visit our website, request a demo, sign up for an account, attend an event, apply for a job, or otherwise interact with us. It covers our own practices across the FortAuth, FortVoice, and FortAgent products and this website (together, the “Services”).

It does not govern personal data that our enterprise customers submit to, or route through, the platform to serve their own end users (“Customer Data”). For Customer Data, the customer is the controller and determines how it is used; Fortanixor acts only as a processor under a data processing agreement and processes that data on the customer’s documented instructions. If you are an end user of a business that uses Fortanixor and have questions about how your data is handled, please contact that business and refer to its privacy policy.

Who is responsible. The controller for the personal data described here is Fortanixor Technologies F.Z.C (Ajman Free Zone licence 43083), B.C. 1306219, Ajman Free Zone C1 Building, Ajman Free Zone, Ajman, United Arab Emirates. You can reach us at privacy@fortanixor.com or on +971 50 138 9092; our company details are on the Legal information page.

This policy is provided in layers: the sections below can be read in full, and region-specific rights are summarized under “Your privacy rights.” If there is a conflict between this policy and a written agreement you have with us, that agreement controls for the data it covers.

We practice data minimization and collect only what is needed to provide, secure, and improve the Services. We collect personal data in three ways: information you provide, information collected automatically, and information we receive from third parties.

Information you provide to us

• Account and profile data: name, work email, phone number, organization, job title, and login identifiers created when you register or are provisioned by an administrator.
• Communications: the contents of demo requests, sales inquiries, support tickets, survey responses, and any messages you send us.
• Event and marketing data: details you share when you register for a webinar or event or subscribe to updates.
• Recruitment data: information in job applications, such as your CV, work history, and correspondence, where you apply to work with us.

Information we collect automatically

• Authentication and security data: passkey public keys, device and platform attestations, and sign-in event metadata such as timestamps, results, IP address, and risk signals. FortAuth is phishing-resistant by design: private keys and biometrics are bound to the user’s device and are never transmitted to or stored by Fortanixor.
• Device and connection data: IP address, browser type and settings, operating system, device identifiers, language, and referring URLs.
• Usage and telemetry: pages and features viewed, actions taken, dates and times of access, performance metrics, and diagnostic logs used to keep the Services reliable and secure.
• Cookies and similar technologies: as described in the “Cookies” section and our Cookie Policy.

Information from third parties

• Identity and SSO providers: limited profile information when you or your organization sign in through a connected identity provider or single sign-on.
• Business and marketing partners: contact and firmographic data from partners and publicly available sources, used to qualify and improve outreach.
• Integrations you connect: data from the CRM, telephony, or other tools your organization chooses to connect to the platform.

We do not intentionally collect special categories of personal data through the Services, and we ask that you not submit such data except where strictly necessary and lawful.

We use personal data for the following purposes:

• To provide the Services: to create and manage accounts, authenticate users, deliver features, and provide customer support.
• To secure the Services: to authenticate identities, enforce access, monitor for and prevent fraud, bots, abuse, and identity threats, and to investigate incidents.
• To operate and improve: to understand how the Services are used, debug and improve performance, and develop new features.
• To communicate: to send administrative messages, respond to your requests, and, where permitted, send marketing communications you can opt out of at any time.
• To comply with law: to meet our legal, regulatory, tax, and contractual obligations, and to establish, exercise, or defend legal claims.
• With your consent: for any other purpose disclosed to you at the time we collect the data or for which you later provide consent.

We do not sell personal data. We do not use Customer Data to train foundation models, and we do not use personal data for cross-context behavioral advertising. Where we de-identify or aggregate data, we maintain it in a form that cannot reasonably be used to re-identify you and do not attempt to re-identify it.

We disclose personal data only in the following circumstances:

• Service providers and subprocessors: vendors that host, support, or help us operate the Services under contract, such as cloud infrastructure, analytics, customer support, and email delivery providers. They may process personal data only on our instructions and are bound to confidentiality and security obligations no less protective than those in this policy.
• Affiliates: entities within the Fortanixor group, for the purposes described in this policy.
• Professional advisors: auditors, lawyers, bankers, and insurers where necessary to obtain their services or protect our rights.
• Legal and safety: authorities, regulators, or other parties where we believe disclosure is required by law or necessary to protect the rights, property, or safety of Fortanixor, our customers, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, in which case personal data may be transferred subject to confidentiality and the terms of this policy.
• With your direction or consent: when you ask us to share your data or otherwise consent.

The providers that receive data from this website

• Google (Google LLC, United States): Google Tag Manager and Google Analytics 4 for usage measurement, and Google reCAPTCHA, which checks our forms for spam and abuse.
• Microsoft (Microsoft Corporation, United States): Microsoft Clarity for session recording and heatmaps. Form fields are masked, so what you type into our forms is not recorded.
• Apollo (Apollo.io, United States): identifies the organisation a visit appears to come from, and is the CRM where demo requests are recorded.
• Hostinger (Hostinger International, European Union): hosts the website on a server we operate, which processes the connection data (such as IP address) needed to serve each page, and is our email provider, which delivers form submissions to our team.

A current list of the subprocessors used for the products themselves is available on request, and we provide advance notice of material changes so customers can review them under their agreements.

Our website uses cookies and similar technologies for security, analytics, and preferences. As a security company we take a restrained approach: we do not use them to build advertising profiles or sell personal data, and we limit third-party tags to what is necessary to run and measure the site. Analytics, session recording and company-level identification stay off until you accept them in the cookie banner, wherever you are. You can change your choice at any time through the Cookie settings link in the footer of every page. You can also clear or block cookies in your browser at any time. For the categories we use and how to manage them, see our Cookie Policy.

The legal basis we rely on depends on the purpose and on where you are:

• Answering a demo request, contact message or guide request: your request, and the steps needed to respond to it before any contract (contract basis). Where the law of your country requires consent for this, submitting the form with this notice in front of you is the consent we rely on, and you can withdraw it at any time.
• Providing the Services to customers: performance of our contract.
• Website analytics, session recording and company-level identification: your consent, given in the cookie banner before any of them run. You can withdraw it at any time through Cookie settings.
• Protecting our forms and Services from spam, fraud and abuse: our legitimate interest in keeping them secure in the EEA, the UK and Switzerland, and the processing necessary to protect the Services where the local law provides for it.
• Meeting legal, tax and regulatory duties: legal obligation.
• Marketing email: your consent, or an existing business relationship where local law allows it, with an unsubscribe link in every message.

United Arab Emirates. The UAE Personal Data Protection Law does not recognise legitimate interests as a basis, so for visitors in the UAE we rely only on consent, performance of a contract or steps taken at your request before one, and legal obligation.

Turkey. Under KVKK, we process your data on these grounds: steps needed to answer your request or to enter into a contract with you, and performance of that contract (Article 5(2)(c)); compliance with our legal obligations (Article 5(2)(ç)); keeping our forms and Services secure, as our legitimate interest, provided it does not harm your fundamental rights (Article 5(2)(f)); and your explicit consent, given in the cookie banner, for website analytics, session recording and company-level identification (Article 5(1)). We collect data electronically, through our website forms, cookies and similar technologies, and email.

For enterprise deployments, the customer determines the legal basis for Customer Data as the controller.

We keep personal data only as long as the purpose needs it, then delete it or irreversibly anonymise it:

• Demo requests, contact messages and guide requests: up to 24 months after our last exchange with you, in our mailbox and CRM. If you become a customer, for the length of the relationship and then as the law requires.
• Google Analytics: event data is kept for up to 14 months; its cookies last up to 2 years.
• Microsoft Clarity: session recordings are kept for 30 days and heatmap totals for up to 13 months; its cookies last up to 1 year.
• Apollo company identification: up to 24 months.
• Your cookie choice: stored in your browser until you change it or clear your browser data.
• Hosting and security logs: up to 12 months, to investigate incidents.
• Job applications: up to 12 months after the hiring decision, unless you agree to us keeping it longer.
• Customer account data: for the term of the contract and up to 90 days after it ends, unless the law requires longer.

Enterprise customers can configure retention windows for logs and event data and can request export or deletion of Customer Data at the end of their term.

Where permitted, we may send you marketing communications about our products and events. You can opt out at any time by using the unsubscribe link in our emails or by contacting us. This will not affect administrative or security messages related to your account. You can also manage cookie and tracking preferences as described above.

Depending on where you live, you may have some or all of the following rights over your personal data:

• Access: to know what personal data we hold about you and receive a copy.
• Correction: to correct inaccurate data or complete incomplete data.
• Deletion: to request that we delete your personal data, subject to legal exceptions.
• Restriction and objection: to restrict or object to certain processing, including direct marketing.
• Portability: to receive certain data in a structured, machine-readable format.
• Withdraw consent: where processing relies on consent, to withdraw it at any time.
• Opt out of sale or sharing: we do not sell or “share” personal data for cross-context behavioral advertising, but you retain this right where it applies.
• Non-discrimination: to not be discriminated against for exercising your rights.

Region-specific rights, and the regulator you can complain to:

• EEA, UK and Switzerland: the GDPR (and the UK and Swiss equivalents) applies. You can complain to your local data protection supervisory authority.
• United Arab Emirates: the Personal Data Protection Law applies. You can complain to the UAE Artificial Intelligence and Data Authority, which took over the UAE Data Office’s role in June 2026.
• Saudi Arabia: the Personal Data Protection Law applies. You can complain to the Saudi Data & AI Authority (SDAIA) and may claim compensation for harm caused by a breach.
• Turkey: under KVKK Article 11 you may also learn the third parties, in Turkey or abroad, to whom your data is transferred; ask that any correction or deletion be passed on to them; object to a result against you that comes solely from automated analysis; and claim compensation for damage caused by unlawful processing. Apply to us first; we answer within 30 days. If you are not satisfied, you can complain to the Personal Data Protection Board (KVKK).
• Jordan: the Personal Data Protection Law applies. You can complain to the Personal Data Protection Unit at the Ministry of Digital Economy and Entrepreneurship.
• Qatar: the Personal Data Privacy Protection Law applies. You can complain to the National Cyber Security Agency (NCSA).
• Bangladesh: the Personal Data Protection Act 2026 applies. You can complain to the data protection authority set up under that Act.
• United States: residents of certain states may have rights under applicable state privacy laws.

To exercise your rights, contact privacy@fortanixor.com. We may need to verify your identity before responding, and you may use an authorized agent where the law allows. Where Fortanixor acts as a processor, we will refer your request to the relevant controller. If we decline a request, you may have the right to appeal.

• Email privacy@fortanixor.com with the subject line “Complaint” and what went wrong. Nothing else is needed to start.
• We confirm receipt within 5 business days, and may ask you to verify your identity before sharing any personal data.
• We reply in full within 30 days. If a complex case needs longer, we tell you why and when to expect the answer.
• If you are not satisfied with our answer, you can take the complaint to the regulator for your country listed above. You do not have to come to us first, except where your local law says so.

We protect personal data with a Zero Trust, defense-in-depth security program that includes encryption in transit and at rest, least-privilege access, continuous monitoring, and independent testing. While no method of transmission or storage is completely secure, we maintain an incident-response plan and will notify affected parties and regulators as required by law. For more detail, see our Security page.

Fortanixor is headquartered in the United Arab Emirates and operates across multiple regions, so your personal data may be processed in countries other than your own, including countries whose laws differ from those where you live. Where personal data is transferred across borders, we implement appropriate safeguards, such as standard contractual clauses or the transfer mechanisms your local law provides, and enterprise customers can pin Customer Data to a specific region to meet data residency and sovereignty requirements.

Our website and communications may link to third-party sites and services that we do not control. This policy does not apply to those third parties, and we are not responsible for their content or privacy practices. We encourage you to review the privacy policies of any third-party services you use.

Our Services are intended for organizations and their authorized users, not for children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this policy as our Services, technology, and legal obligations evolve. We will post the revised version here with a new “last updated” date and, where changes are material, provide additional notice. Your continued use of the Services after an update takes effect constitutes acceptance of the revised policy.

If you have questions about this policy or wish to exercise your rights, contact us at privacy@fortanixor.com, or write to us at B.C. 1306219, Ajman Free Zone C1 Building, Ajman Free Zone, Ajman, United Arab Emirates. If you are not satisfied with our response, you can complain to the regulator for your country listed under “Your privacy rights.”