Privacy Policy

1. Scope and controller

This Privacy Policy covers the fortseal.com website, the customer portal, the vendor portal, and the in-app support console (together, the "Service"). It does not cover the FortSeal vault itself, which runs on infrastructure you own or control; see Section 2. FortSeal is owned and operated by Gossip Apps LLC, a Texas limited liability company, which is the controller of the personal information described here.

2. The vault software does not send us your data

FortSeal runs on the operator's own hardware. Files are sealed client-side before they ever reach your server, and the server stores ciphertext only. We never receive customer file contents, file names, keys, keystores, passwords, or recovery shares, and we have no technical means to obtain them.

The software does not phone home. License checks are performed offline: the server verifies a cryptographic signature in your license file against our public key on your own machine. No network request is made to us to check, activate, or renew a license, and the software sends us no usage telemetry, crash reports, or analytics of any kind.

3. What we collect

Checkout and billing. When you buy a subscription we receive the company name, email address, and seat count you enter at checkout. Our payment processor, Stripe, handles your card details under its own privacy policy; we receive back the last four digits, card brand, billing country, and receipts, never the full card number.

Account and license records. We keep the subscription record, the license files we issue, the Terms version and timestamp you accepted, and a log of billing events (charges, renewals, cancellations).

Support requests. When you open a support request from the admin console we receive the message you write, the email address you give, your license summary, your server version, and the public IP address of the server that sent it. We never receive file contents or file names.

Vendor and support portal access. Sign-in to the customer portal and vendor portal uses one-time emailed links rather than passwords or session cookies; we log when a link is requested and used.

Marketing site. The marketing site sets no cookies and runs no analytics. Cloudflare, which sits in front of the site for CDN and DDoS protection, and DigitalOcean, which hosts the site and the billing service, each process standard connection metadata (IP address, timestamps, request path) as part of delivering the request; neither is instructed to build an advertising or tracking profile from it.

4. How we use it

We use this information only to run your subscription, issue and renew licenses, answer support requests, prevent fraud and abuse, and meet our legal and tax obligations. Marketing email is never sent without your consent, and every marketing email carries an unsubscribe link.

5. Sharing

We share personal information only with the following processors, each for the purpose named, and with law enforcement or courts when legally required:

• Stripe, payment processing and card data.
• Resend, delivery of license, receipt, welcome, and support-notification email.
• DigitalOcean, hosting for the website and the billing service, in the United States.
• Cloudflare, CDN, DNS, and DDoS protection in front of the website.

We do not sell personal information and do not share it for cross-context behavioural advertising. We do not use any advertising network or third-party analytics.

6. Retention

• Account and subscription data: for as long as you are a customer, plus 30 days.
• Terms acceptance records: 7 years, as legal evidence of acceptance.
• Payment and billing records: 7 years, for tax and accounting law.
• Support requests: 2 years from the last activity on the ticket.
• Portal magic-link logs: 90 days.

When you ask us to delete data we are not legally required to keep, we remove it from live systems immediately and from backups on the next backup rotation.

7. Security

Connections to the website and the billing service use TLS in transit. Access to customer and payment records is limited to the people who need it to run the Service. No method of transmission or storage is perfectly secure. If a breach affecting your personal information occurs, we will notify you as required by Texas Business and Commerce Code Section 521.053 and other applicable law.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of the personal information we hold about you, to restrict or object to certain processing, and, in California and Texas, to opt out of the sale or sharing of personal information or of targeted advertising and profiling (we do not sell or share personal information as described in Section 5, so there is nothing to opt out of today) and to non-discrimination for exercising these rights.

• California (CCPA/CPRA): the rights above, plus the right to know what categories of information we collect and the right to designate an authorized agent. We honor Global Privacy Control signals as an opt-out preference signal.
• Texas (TDPSA): the rights above, plus the right to appeal a decision. If you appeal and we decline, you may respond within 45 days and appeal within 60 days of our response; if we still decline, you may complain to the Texas Attorney General.
• EEA/UK (GDPR): the rights above, plus the right to lodge a complaint with your local supervisory authority.

To exercise any of these rights, email [email protected]. We respond within 45 days and may need to verify your identity first.

9. Children

FortSeal is a business product and is not directed to children. We do not knowingly collect personal information from anyone under 13, and no one under 18 may hold an account. If we learn otherwise, we delete the account and the data we hold about it.

10. International transfers

The website and billing service are hosted in the United States. Where we receive personal information from the EEA or UK through our processors, we rely on those processors' standard contractual clauses. A Data Processing Addendum is available on request; email [email protected].

11. Cookies and Do Not Track

The marketing site, the customer portal, and the vendor portal set no cookies. We honor Global Privacy Control as an opt-out signal where it applies; browsers' Do Not Track setting has no standard meaning and we do not currently respond to it separately.

12. Changes

We may update this Privacy Policy. The version date at the top changes when we do, and we will notify subscribers by email of material changes at least 14 days before they take effect, the same way we notify Terms changes.

13. Contact

Privacy questions and rights requests: [email protected].