Website privacy notice

Who is responsible?

This notice covers the public website fortus.ca, including its contact form, product waitlists, privacy preferences and optional website analytics. NorthStar and Preview applications have separate notices and consent arrangements; visiting this site does not activate application tracking.

The controller is Solutions TI Fortus inc., a Québec corporation. Our privacy officer is Ahmad Chababibi. Write to privacy@fortus.ca or to: Privacy Officer, Solutions TI Fortus inc., 106–1615 boulevard Jules-Poitras, Montréal, Québec H4N 1Z2, Canada. Telephone: +1 514 447-9914.

Information and purposes

• Website delivery and security: Cloudflare processes IP addresses, request URLs, browser/network headers and security signals to serve the site, prevent abuse and diagnose delivery failures. These necessary operations occur even if optional tracking is refused.
• Inquiries: your name, email, selected topic, message and limited product/locale context are sent through Resend to our business mailbox. We use them to respond, discuss a requested service and keep a correspondence record. Do not send client files, immigration records or sensitive personal information through this form.
• Waitlists: email, optional name, chosen product, language, market, plan/billing preference where selected, signup time and email-consent version are stored in Cloudflare D1. We use them to manage early access and send the launch updates you requested. No payment information is collected on this site.
• Privacy choices: we keep an opaque browser token, consent version, choices, time and broad legal region, together with minimal deletion records. We do not put your IP, user agent, name or email in this consent ledger. The server uses Cloudflare’s country/region signal without retaining precise location.
• Optional analytics: only after permission, PostHog receives a random website identity, permitted page paths, product-interest clicks, fixed demo actions, and successful inquiry or signup events. Form contents, names, emails, arbitrary query strings and URL fragments are excluded. We do not link this identity with application accounts.
• Optional replay: only after permission, PostHog can record interaction sequences on public marketing pages. Text and inputs are masked; contact/waitlist pages, forms, embedded editable demos and private applications are excluded. Console logs, network bodies and canvas recording are disabled. Pages opened with query strings or fragments are excluded from replay.

We do not sell personal information, share it for cross-context behavioural advertising, run targeted advertising, or use this website data for decisions producing legal or similarly significant effects. The site is directed to business users, not children; we do not knowingly collect children’s information.

Your choices and legal grounds

Analytics and replay are off until you opt in, everywhere. You may allow either category independently. Rejecting them does not prevent access, inquiries or waitlist signup. Use Privacy choices in any footer to withdraw, change categories or request deletion of linked website data. Withdrawal stops future collection and queues deletion for the previous tracking identity; renewed permission uses a new identity. Requests already transmitted may finish processing.

We remember your choice for 180 days and ask again when it expires or when we materially change optional purposes. We honour Global Privacy Control as a refusal of all optional website tracking, including when a previous choice allowed it. If consent cannot be verified, optional collection stays off.

Where the GDPR or UK GDPR applies, consent is our basis for optional analytics, replay and requested marketing emails; steps at your request before a contract, or our legitimate interest in answering business correspondence, support inquiries. Our legitimate interests in securely operating the website and demonstrating privacy choices support necessary security and consent records, subject to your rights. Legal obligations may require limited records. In Canada/Québec we seek meaningful consent where required and use applicable statutory exceptions only for their permitted purposes.

Joining a product waitlist is a separate, explicit choice to receive that product’s launch/early-access emails. An inquiry alone does not subscribe you. You can unsubscribe using an email’s link or by contacting us. We do not make optional analytics a condition of email updates.

Providers and international processing

We disclose information only to staff who need it, contracted service providers for the purposes below, and authorities or professional advisers where legally required or needed to protect rights. A business reorganisation may involve a successor under appropriate safeguards and notice where required.

• Cloudflare: website hosting, delivery, security, Workers and D1. Its network operates globally. The separate privacy-receipt/deletion database uses D1’s EU jurisdiction. The existing waitlist database has no contractual EU-only jurisdiction setting. Website execution and network transit can occur outside the EU and Canada.
• Resend: inquiry-email delivery, with processing in the United States.
• Hostinger: our business mailbox and correspondence. We do not represent the mailbox as Canada-only or EU-only; its specific storage/backup location has not been verified.
• PostHog: optional analytics and replay use the EU service at eu.i.posthog.com, with primary data storage in Frankfurt, Germany. EU hosting does not mean every support operation, network transit or subprocessor is confined to the EU. PostHog and its delivery providers necessarily receive connection information such as IP addresses; our configuration disables IP-based geographic enrichment. We do not enable AI, advertising destinations or other optional PostHog products for this site.

Fonts are served directly by Fortus, without a browser connection to Google Fonts. External links open third-party services governed by their own notices.

Processing outside Québec/Canada can make information subject to foreign laws and lawful government access. Our provider assessment and contracts address confidentiality, security, purpose limits and transfers. Where EEA, UK or Swiss transfer rules require them, applicable adequacy decisions or contractual safeguards (such as standard contractual clauses and the UK addendum) must cover the transfer; choosing EU storage alone is not a transfer safeguard. Contact our privacy officer for details or a copy of relevant safeguards, with confidential terms redacted.

Retention and deletion

• Browser choices: 180 days; explicit language/market preferences up to one year. The cookie notice lists each storage item.
• Optional analytics: we schedule each tracking identity for deletion no later than 12 months after its creation, so some later events are removed earlier. Withdrawal or a browser erasure request schedules earlier deletion.
• Replay: a 30-day retention setting applies to new recordings when collection is enabled. Earlier erasure requests also include recordings.
• Consent evidence: minimal versioned receipts are retained for three years from the choice. Tracking locators are removed after verified deletion and a 30-day late-arrival check period. Unfinished deletion obligations remain until resolved.
• Waitlists: entries are removed on withdrawal or no later than 12 months after signup. Necessary evidence of email-consent/withdrawal may be retained separately for legal compliance; it is not permission to continue sending.
• Inquiries: routine correspondence is reviewed for deletion after 12 months without substantive contact. Records that become part of a client engagement, dispute or legal obligation follow the applicable business retention requirements.
• Hosting and email delivery records: provider security/delivery logs and recovery copies follow the applicable service configuration and provider lifecycle, rather than the browser’s consent timer.

Deletion is asynchronous. A queued request, a hidden report or an expired reporting window is not proof of physical erasure. PostHog may process deletions during scheduled off-peak cycles. We check provider completion and remaining records before marking a job complete. Recovery copies may persist until their provider cycle expires; data restored from a recovery copy must have outstanding deletion instructions reapplied. We cannot promise immediate erasure from every backup. We will explain a lawful retention exception or processing delay when responding to a request.

Requests and complaints

Contact privacy@fortus.ca to request access, correction, deletion, portability, restriction, withdrawal or to object, as applicable. Describe the request and your relationship with Fortus. We may ask for proportionate verification, but please do not send identity documents unless we establish a secure need. An authorised representative may act with suitable proof.

The browser deletion control covers website analytics and replay linked to its current privacy token. Clearing cookies or using another browser can remove that link; it does not itself erase server data. Contact us for help locating information without sending unnecessary sensitive details. A browser request does not delete an inquiry, waitlist signup or product account.

We acknowledge and assess requests promptly, apply the relevant legal deadline, and explain any permitted extension, refusal and appeal route. There is normally no charge. You may complain to us or the appropriate regulator; you do not have to complain to us first where the law permits direct recourse.

Regional rights

All regional sections remain available to everyone. Your language, selected pricing market and our approximate location signal do not decide which law or rights apply.

Canada and Québec

You may request access and correction, withdraw consent subject to lawful limits, challenge our practices and, where applicable, obtain computerised information in a structured commonly used format or request cessation of dissemination/de-indexing. We normally respond to access requests within 30 days, subject to lawful extensions. Québec complaints may be made to the Commission d’accès à l’information; federal PIPEDA matters may be raised with the Office of the Privacy Commissioner of Canada.

EEA and United Kingdom

Where applicable, you have rights of access, rectification, erasure, restriction, portability and objection, including an unconditional objection to direct marketing. Consent can be withdrawn without affecting earlier lawful processing. We generally respond within one month, with any permitted extension explained within that period. You can complain to your EEA supervisory authority or the UK Information Commissioner’s Office.

Switzerland

Subject to the Swiss Federal Act on Data Protection, you may request information, correction, deletion and, where applicable, delivery or transfer of your data, and challenge unlawful processing. Contact the Federal Data Protection and Information Commissioner for regulatory concerns.

United States

Where an applicable state law covers Fortus and your request, rights may include knowing/accessing categories and specific information, correction, deletion, portability, opting out of sale, sharing, targeted advertising or certain profiling, and appealing a refusal. We do not sell/share data for advertising, use sensitive information for unrelated inferences, or discriminate for exercising rights. Global Privacy Control refuses optional tracking site-wide. Email us with “Privacy appeal” to challenge a decision; we will explain the applicable appeal and regulator route. Deadlines vary; many state access/deletion requests have a 45-day initial period with a permitted extension. California residents can consult the California Privacy Protection Agency. The categories, sources, purposes and recipients described above also describe our website practices during the preceding 12 months, to the extent this website operated.

Changes to this notice

We preserve dated versions below. Material new optional purposes require renewed permission before collection. We will make material changes prominent on the site and provide direct notice where required. These website arrangements do not replace product-specific notices.