Privacy Policy

Version 1.2 · Last updated 26 August 2026

The short version. This website has no analytics, no advertising, no tracking pixels and no third-party fonts. It sets its own cookies only to keep the contact form, forum and admin secure. The one third party is the Paddle checkout, and nothing from it loads until you agree at the point of buying. We hold your details only when you send them to us — a message, a launch-notification request, or a purchase — and we delete them on a schedule. Fortan Software itself — the product — stores its data on your server, not ours.

1. Who we are

This website is operated by Flayr FX Limited, a company registered in Scotland (company number SC682689), registered office 15 Glenorchy Terrace, Edinburgh, EH9 2DQ.

For anything in this policy, or to exercise any of the rights described in it, contact support@flayrfx.com. We are the data controller for the personal data described here.

We are registered with the UK Information Commissioner's Office, registration number ZB403112.

2. What we collect

If you use the contact form

Your name, your email address, the topic you picked, your hosting details if you chose to give them, and your message. We also record the time you ticked the consent box and a truncated form of your IP address — the last part is removed, so it identifies a rough network rather than a person.

If you sign in to the support forum

Your display name, your posts, and your email address only if you chose to give one for reply notifications. We record when you agreed to your name being shown.

We do not store your licence key. When you sign in, its signature is verified and the key is then discarded; what is stored is a one-way fingerprint that cannot be turned back into a key. Somebody who obtained a copy of our forum database could not use it to activate an installation or to post as you.

If you ask to be told when the product launches

Your email address, which is stored as an ordinary enquiry and used once — to send you that one message. It is deleted on the same schedule as every other enquiry (see section 6).

If you buy

Paddle, as the merchant of record, handles the payment and passes us your name, email address and billing country so we can issue your licence and provide support. Our licence server then holds your licence record: the key, your name and email, the domain you activate on, and your update entitlement. The download page may ask your name so the licence can be recorded to you. We never see your card details. At checkout you can optionally tick a box to receive product updates by email — leave it unticked and you get transactional email only (your licence and receipt).

Automatically, on every page

Our web host keeps standard server logs — IP address, page requested, time, browser user-agent — as every web server does. We use them only to keep the site running and to investigate abuse, and we do not combine them with anything else. There is no analytics package of any kind on this site.

Cookies

One, and only when you need it. See the Cookie Policy for the detail.

3. Why, and our lawful basis

What	Why	Lawful basis (UK GDPR Art. 6)
Contact form details	To read your message and reply to it	Consent — the tick box. Withdraw it any time and we delete the message.
Forum name and posts	To run a support forum where owners help each other	Consent, given when you create your forum profile.
Forum email address	To tell you when somebody replies to you	Consent, and entirely optional — leave it blank and none is stored.
Licence key fingerprint	To confirm you hold a licence, and to stop one being abused	Legitimate interests — restricting posting to customers is what keeps the forum usable.
Truncated IP, rate-limit records	To stop spam and brute-force attempts	Legitimate interests — keeping the site available and free of abuse.
Server logs	Security and diagnosing faults	Legitimate interests.
Launch-notification email	To send you one email when the product launches	Consent — you asked. One message, then it is an ordinary enquiry on the deletion schedule.
Purchase and licence records	To issue your licence, deliver the download and provide support and updates	Contract — this is the purchase working as described.
Product-update emails	Occasional news about the software, if you opted in at checkout	Consent — the optional tick box. Every such email lets you unsubscribe.

4. What we deliberately don't collect

This is worth stating plainly, because most sites do all of it:

No analytics. No Google Analytics, Plausible, Fathom or anything else. We do not know how many people read this page.
No advertising or remarketing pixels. No Meta pixel, no Google Ads tag, no LinkedIn Insight tag.
No third-party fonts. Our typefaces are served from this server. A Google Fonts link would send your IP address to Google on every page load, and a German court found exactly that to breach the GDPR in 2022.
No session recording, heatmaps or A/B testing.
No mailing list you did not ask for. Contacting us subscribes you to nothing. The only emails beyond replies and receipts are a one-off launch notification if you requested it, and product updates if you ticked the optional box at checkout — both consented, both revocable.
No profiling and no automated decision-making.

5. Data inside the software itself

This is the part people most often get wrong about us, so it is worth being unambiguous: Fortan Software is self-hosted. Your clients, jobs, invoices, budgets and uploaded files live in a MySQL database on your web hosting.

None of it is transmitted to us, mirrored to us, or accessible by us. We could not produce your client list if we were asked to. For that data you are the controller, and your own privacy obligations to your clients are yours to meet.

The exceptions are features you switch on yourself by adding an API key: AI CV tailoring sends the text you submit to Anthropic, and job-board search sends your search terms to whichever boards you configure. Both are off by default, both require you to obtain a key, and each provider's own privacy policy then applies to that transfer.

Your installation contacts our licence server when you activate a licence and when it checks for updates. That exchange carries your licence key, your domain and your version number — no business data of any kind.

6. How long we keep things

What	How long
Contact form enquiries and launch-notification requests	180 days, then deleted automatically by a scheduled task. Sooner on request.
Forum posts	Indefinitely, because a support answer is useful for years. Ask and we will anonymise or remove yours.
Forum profile	Until you ask us to erase it.
Rate-limit records	Hours. Deleted automatically, and hashed rather than stored as an address.
Server logs	As long as our host retains them, typically a few weeks.
Purchase records	Six years, as UK tax law requires. These are held by Paddle as the seller; we see order records, not card details.
Licence records	For the life of the licence — they are what proves you hold one and what your support and updates run on.

We do not sell personal data, and we do not share it for anyone else's marketing. It is disclosed only to:

Our web host, who stores this site and its database on our behalf, under contract.
Paddle.com Market Limited, if you buy. Paddle is the merchant of record and is a data controller in its own right for your payment. We never receive your card details. Paddle's privacy policy.
Our email provider, to deliver messages to and from support@flayrfx.com.
Anyone, in the case of forum posts — the forum is public and indexed by search engines. Do not put anything in a post that you would not put on a billboard.
Authorities, where we are legally required to.

8. International transfers

Our hosting and email are in the United Kingdom or the European Economic Area. Paddle operates internationally and may process your data outside the UK; it relies on the UK International Data Transfer Addendum and Standard Contractual Clauses to do so. If you enable the optional AI features inside the software, that text goes to Anthropic under its own terms.

9. Your rights

Under UK and EU data protection law you may ask us to:

Give you a copy of the personal data we hold about you.
Correct anything inaccurate.
Erase it. For an enquiry that is immediate; for forum posts we will either delete them or replace your name with "A former member", whichever you prefer.
Restrict or object to our processing.
Receive it in a portable format.
Withdraw consent at any time, without affecting anything done before you withdrew it.

Email support@flayrfx.com or use the contact form, choosing "My personal data". We respond within one month and there is no charge. We are a small company — in practice it is usually the same day.

10. Security

The whole site is served over HTTPS.
Passwords are stored only as bcrypt hashes; licence keys only as one-way fingerprints.
Forms are protected against cross-site request forgery, and submissions are rate limited.
Database queries use prepared statements throughout.
A strict Content-Security-Policy blocks third-party scripts, with a single exception for the Paddle checkout — which loads only after you consent.
Configuration files holding credentials are outside the web-served paths and denied by server rules.

No system is perfectly secure. If a breach affects your rights and freedoms we will tell the ICO within 72 hours and tell you without undue delay.

Found a vulnerability? Please tell us at support@flayrfx.com before disclosing it publicly. We will not take legal action against anyone reporting a genuine issue in good faith.

11. Children

This is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16.

12. Changes

If we change this policy we update the version and date at the top. Material changes affecting people whose data we hold will be notified by email where we have one.

13. Complaints

Please raise it with us first — most things are a misunderstanding we can fix in an email. If you remain unhappy you can complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113. If you are in the EEA you may instead complain to your own national supervisory authority.