fortisOS

fortisOS privacy notice

Last Updated: November 2026

This notice describes the data the fortisOS application at app.fortis.world stores and processes, why, where, and what you can do about it. It covers merchants and their staff, guests who order through a QR menu, and integrations that reach the API or the MCP server on a merchant's behalf.

Who is responsible for your data, and which law applies

This notice is issued by Fortis MENA Digital Solutions LLC, of Office No. TO5-FLR05-05.01.08, World Trade Center, Dubai, UAE. Where fortisOS processes personal data of individuals in the United Arab Emirates, it does so subject to UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL"). For account holders (merchants and their staff), fortisOS is the data controller. For business data entered by a merchant (including a guest's name, table or invoice details), the merchant is the data controller and fortisOS acts as its data processor; guests should look to the merchant's own notice for how that data is used, and this notice covers only what fortisOS as processor does with it on the merchant's instructions. Questions or requests about this notice can be sent to legal@fortis.world, and we aim to respond within 30 days.

Data an account provides

An account holds a name, an email address, a password hash or a linked Google or Fortis sign-in, an optional avatar, interface preferences such as locale and theme, and the memberships, roles and venues it belongs to. A merchant who enrols a device PIN stores that PIN as a hash bound to the device. Sign-in and sign-out events, sessions and API keys are recorded so that access can be reviewed and revoked.

Business data merchants store

Merchants store their catalog, orders, kitchen tickets, shifts, payments, receipts, invoices, tables, staff assignments and reports. Orders may carry a guest's table, a customer name or an invoice party the merchant enters. A guest who orders through a QR menu provides only what the merchant's menu asks for. This data belongs to the merchant; fortisOS processes it to run the venue and does not sell it.

We process account data to perform our contract with the merchant (or prospective merchant) that creates the account, to comply with legal obligations (for example tax record-keeping requirements that apply to payment and billing records), and, for optional features such as marketing communications, on the basis of consent, which can be withdrawn at any time without affecting processing already carried out.

Cookies and local storage

  • A session cookie keeps you signed in; it is HTTP-only and expires with the session.

  • Preference cookies remember locale, theme, the active venue and shift so pages render correctly on the server.

  • A feature-flag cookie keeps the variant of an experiment stable for your device.

  • No advertising or cross-site tracking cookies are set.

Service providers

  • Hosting and database: Amazon Web Services in the Frankfurt (eu-central-1) region, with production backups.

  • Billing: Stripe processes the subscription and the card; fortisOS stores the subscription state and never the card number.

  • Email: transactional mail such as verification, welcome and billing messages is sent through Resend from the fortis.world domain.

  • Error and performance monitoring: Sentry, hosted in the European Union, receives error reports with personal data scrubbed before they leave the application.

  • Bot protection: Cloudflare Turnstile verifies sign-up and sign-in forms where it is enabled.

  • Sign-in providers: Google, when you choose it, and the Fortis platform for merchants migrating from it.

  • Payment terminals and gateways a merchant connects, such as N-Genius or MyFatoorah, receive the payment data those services need.

International data transfers

Several service providers listed above process personal data outside the UAE, including hosting and backups in the EU (AWS Frankfurt), error monitoring in the EU (Sentry), and billing and email providers with infrastructure outside the UAE (Stripe, Resend). Under the UAE PDPL, such transfers require an adequate destination, a bilateral/multilateral agreement, standard contractual clauses or an equivalent safeguard, or another statutory ground such as consent.

How we protect your data

We use technical and organisational measures appropriate to the risk, including encryption of data in transit, hashed storage of passwords and device PINs, role-based access limited to what a session needs, and expiry/revocation of API keys and sessions.

AI agents and API access

An API key or an OAuth grant lets an AI agent or an integration read, and where explicitly delegated change, the business data the account is already authorized for. Keys expire, can be revoked at any time, and every call is authorized again against the live account, memberships and permissions. Business records exclude credentials, personal account state and internal execution data. What an external AI client does with the data it retrieves is governed by that client's own terms. fortisOS itself does not use this data to make automated decisions that produce legal or similarly significant effects on a data subject without human involvement; if that changes, this notice will say so and the UAE PDPL right to object to automated decision-making will be reflected below.

Retention and deletion

Operational records are kept for as long as the business is active, because orders, invoices and payments are financial history. Archiving a business, venue or item removes it from every ordinary listing while retaining the history that references it. Deleting an account removes the sign-in and its personal profile; business records the account created stay attributed to the business. Backups are retained on a rolling schedule and expire automatically. Some records (for example payment, invoicing and tax-relevant data) must be kept for longer under UAE legal and Central Bank record-keeping requirements even after a business or account is closed or archived.

Your choices

You can view and change your profile, preferences, sessions and API keys from the account settings, export the reports the business owns as CSV or PDF, and request access to, correction of, or deletion of personal data through the channels on the contact page. Requests are made from the account they concern. This notice changes when the product does; the date at the foot of the page is the date of the current version. The rights above extend, under the UAE PDPL, to rectification or completion of inaccurate data, restriction of processing, objection to processing, and receiving your data in a portable format; and you may complain to the UAE Data Office if you consider your rights have not been respected.