Privacy Policy

1. Who We Are

Fortiris LLC ("Fortiris," "we," "us," or "our") operates the trading risk analytics platform available at fortiris.app. This Privacy Policy describes how we collect, use, store, and share information when you use our platform and services (collectively, the "Service").

For privacy questions or requests, contact us at: [email protected]

2. Information We Collect

2.1 Information You Provide

When you create an account and use the Service, you may provide:

• Account information: email address, name, and any profile information from OAuth providers (Google).
• Trading data: trade history, account performance data, and connection credentials (encrypted) for platforms you connect.
• Payment information: billing details processed by Stripe. We do not store card numbers — Stripe handles all payment data.
• Communications: any messages you send to our support team.
• Journal notes: trade notes you enter in the platform.

2.2 Information Collected Automatically

When you use the Service, we automatically collect:

• Usage data: pages visited, features used, and actions taken within the platform.
• Technical data: IP address, browser type, operating system, device type, and time zone.
• Log data: server logs, error reports, and performance data collected via Sentry.
• Cookies and similar technologies: session authentication tokens and preferences stored in your browser.

2.3 Information from Third Parties

When you connect trading platforms, we receive trade history and account metadata from those platforms via their APIs or your manual exports. We treat this data as your data under Section 3.

If you sign in with Google, we receive basic profile information (name, email, profile picture) from Google in accordance with your Google account settings.

3. How We Use Your Information

We use your information to:

• Provide and operate the Service, including computing risk scores and analytics.
• Authenticate your identity and maintain account security.
• Process payments and manage your subscription via Stripe.
• Send transactional emails (account verification, billing receipts, subscription alerts).
• Provide customer support and respond to your inquiries.
• Monitor and improve platform reliability and performance using Sentry error tracking.
• Generate anonymized, aggregated insights about trading patterns (no individual identification).
• Comply with legal obligations and enforce our Terms of Service.

We do not use your individual trade history or personal data to train AI models without your explicit, separate consent. The Fortiris AI Coach analyzes your data in real-time within your session but does not feed your data into model training pipelines.

4. How We Share Your Information

We do not sell your personal data or trading data to any third party. We share data only in these limited circumstances:

4.1 Service Providers

We share data with trusted service providers who help us operate the Service, under strict data processing agreements:

• Clerk — identity and authentication management
• Stripe — payment processing (never receives trade data)
• Railway — backend cloud infrastructure (US-based servers)
• Vercel — frontend hosting
• Sentry — error monitoring (error events only, no trade data)
• Resend — email delivery (transactional and notification emails)
• Anthropic — AI processing for the AI Coach feature (your prompts and context are processed per-session; see AI Coach section below)
• Google Cloud Platform — AI inference for the Fortiris Coach feature (self-hosted inference runtime)
• Cloudinary — media asset storage

4.2 AI Coach Data Processing

When you use the Fortiris AI Coach, a structured summary of your risk metrics and recent trade data is sent to Anthropic's API to generate responses. This data includes your risk scores, aggregated performance metrics, and recent trade summaries — not raw trade IDs or personally identifying broker account details.

Anthropic processes this data under their Privacy Policy. Anthropic does not use API inputs for model training by default (as of our last review).

4.3 Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

4.4 Business Transfers

If Fortiris is acquired, merges with another company, or sells substantially all of its assets, your information may be transferred to the acquiring entity. We will notify you via email and/or a prominent notice on the Service before your data is transferred and becomes subject to a different privacy policy.

4.5 Business Workspace Data Sharing

If you are a subscriber or student in a Fortiris Business workspace, the workspace owner may request permission to view limited analytics (Stability Score, drawdown summary, at-risk status, and snapshot timing) derived from your trading account. This access requires your explicit consent via an approval flow. You may revoke consent at any time.

5. Data Retention

We retain your personal data and trading data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data is retained for the lifetime of your account plus 90 days after deletion.
• Trade history is retained for the lifetime of your account plus 90 days after deletion.
• Billing records are retained for 7 years as required by US tax law.
• Server logs are retained for 30 days.
• Error logs (Sentry) are retained for 90 days.

You can request deletion of your account and all associated data at any time (see Section 7).

6. Data Security

We implement industry-standard security measures to protect your data:

• All data is transmitted over HTTPS with TLS encryption.
• Sensitive credentials are encrypted at rest.
• Authentication is handled by Clerk with industry-standard JWT verification.
• Database access is restricted to application-level service accounts.
• We do not store payment card numbers — all payment data is handled by Stripe.

No security system is 100% impenetrable. In the event of a data breach that affects your personal data, we will notify you in accordance with applicable law.

7. Your Rights and Choices

7.1 Access and Portability

You can request a copy of the personal data we hold about you by emailing [email protected]. We will respond within 30 days.

7.2 Correction

You can update your account information directly in the Settings panel. For corrections to data we hold that you cannot update yourself, contact [email protected].

7.3 Deletion

You can request deletion of your account and all associated personal and trading data by emailing [email protected]. We process deletion requests within 30 days, subject to legal retention requirements (e.g., billing records retained for 7 years).

7.4 Opt-out of Marketing

We may send you product updates and announcements. You can unsubscribe at any time using the unsubscribe link in any marketing email. Transactional emails (billing, security alerts) cannot be opted out of while your account is active.

7.5 California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to opt out of sale (we do not sell personal information), and the right to non-discrimination for exercising privacy rights.

To exercise these rights, contact us at [email protected]. We will respond within 45 days.

8. Cookies

Fortiris uses the following types of cookies and similar technologies:

• Session cookies: required for authentication (managed by Clerk). These are necessary for the Service to function.
• Preference cookies: store your display preferences (dark mode, sidebar state).
• Analytics: we do not use third-party analytics cookies (no Google Analytics, no Facebook Pixel).

You can configure your browser to block cookies, but this will prevent authentication from working.

9. Children's Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected data from a minor, contact us at [email protected] and we will delete it promptly.

10. International Users

Fortiris is based in the United States. If you access the Service from outside the United States, your data will be transferred to and processed in the United States, where data protection laws may differ from those in your country. By using the Service, you consent to this transfer.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or a prominent notice in the Service at least 14 days before taking effect. The "Effective date" at the top of this page reflects the date of the most recent revision.

12. Contact Us

For privacy questions, data requests, or to exercise your rights: