Privacy and personal data protection policy

Last updated: October 3, 2026

This English version is provided for convenience. In case of discrepancy, the French version prevails.

1. Who we are

Forteresse AI is a French simplified joint-stock company (SAS) with a share capital of €10,000, registered with the Paris Trade and Companies Register under number 941 859 944, whose registered office is located at 77 rue du Cherche-Midi, 75006 Paris, France.

Forteresse AI designs and operates a business process automation platform based on artificial intelligence, and provides the related consulting and support services.

Forteresse AI is the controller of the personal data described in this policy.

Contact: www.forteresse.ai/en/getintouch

2. Our Data Protection Officer

Forteresse AI has appointed a Data Protection Officer, registered with the French data protection authority (Commission nationale de l'informatique et des libertés, CNIL) under designation number DPO-176666.

Data Protection Officer: Mr. Eric Cholet

Email: dpo@forteresse.ai

Postal address: Forteresse AI, Data Protection Officer, 77 rue du Cherche-Midi, 75006 Paris, France

The Data Protection Officer is your point of contact for any question about the processing of your data and for exercising your rights.

3. Scope of this policy

This policy describes how Forteresse AI processes the personal data of the people it deals with: visitors to the website and people who send us a request, business contacts we reach out to, our clients' representatives, users of our platform and job applicants.

It does not apply to data that our clients entrust to us as part of their projects, for which Forteresse AI acts as a processor and not as a controller. This specific case is described in section 11.

4. What data we process, for what purposes and on what legal basis

4.1 Requests and appointments made through our website

When you send us a request or book a demo through our website, we process your name, your email address, where applicable your phone number, your company and your job title, the content of your message and the date of the appointment you choose. Purpose: to respond to your request, organize the appointment (invitation and video conference link) and follow up on our exchanges. Legal basis: our legitimate interest in responding to the requests we receive, and the performance of pre-contractual measures when your request concerns our services (Articles 6.1.f and 6.1.b GDPR). Retention period: three years from our last exchange.

4.2 Business development

We process the business contact details of people working for companies that may be interested in our services: last name, first name, business email address, business phone number, job title, company, and the history of our exchanges. Purpose: to present our services and manage the business relationship. Legal basis: our legitimate interest in developing our business with professionals (Article 6.1.f GDPR). Our messages relate to your professional role, and you can object to them at any time, without giving a reason, by simple request. Retention period: three years from our last contact.

4.3 Client relationship and performance of contracts

We process the data of the representatives designated by our clients: professional identity, business contact details, job title, company, and exchanges related to the performance of the contract. Purpose: to manage the contractual relationship, run projects and provide support. Legal basis: the performance of the contract entered into with your company or of pre-contractual measures (Article 6.1.b GDPR). Retention period: the duration of the contractual relationship, then five years from its end.

4.4 Platform user accounts

We process the data of the users designated by our clients to access the platform: last name, first name, business email address, login, role and permissions, creation and last login dates. Purpose: to create and manage accounts, manage permissions and ensure access traceability. Legal basis: the performance of the contract entered into with the client you work for (Article 6.1.b GDPR). Retention period: the duration of the contract with your company; accounts and related data are deleted within thirty days of its termination.

4.5 Accounting and financial obligations

We process the data contained in accounting documents: identity and business contact details, billing data, business bank details and payment history. Purpose: to prepare and keep our accounting records and meet our legal obligations. Legal basis: compliance with the legal obligations to which we are subject (Article 6.1.c GDPR). Retention period: ten years from the end of the financial year concerned.

4.6 Job applications

We process the data you send us as part of a job application: identity, contact details, education and professional background, résumé, cover letter and interview notes. Purpose: to review your application and run the recruitment process. Legal basis: the performance of pre-contractual measures taken at your request and our legitimate interest in building our teams (Articles 6.1.b and 6.1.f GDPR). Retention period: two years from our last contact if your application is not successful. Your data is deleted without delay upon simple request.

4.7 Security of our systems

We process technical connection data: login, IP address, timestamp, action performed, and information about the device and the session. Purpose: to secure our systems and our platform, detect and analyze security events, and ensure access traceability. Legal basis: our legitimate interest in securing our systems and the data entrusted to us, and our security obligation under Article 32 GDPR. Retention period: from thirty days to twelve months depending on the type of log (platform audit log twelve months, application logs thirty days, infrastructure logs thirty to ninety days, traces of calls to artificial intelligence models six months).

5. Where the data comes from

The data we process comes mainly from you: you provide it when you contact us, book a demo, subscribe to our services or apply for a job.

As part of our business development, we may also collect business contact details from publicly accessible professional sources or at professional events. In that case, we inform you of this processing the first time we contact you.

6. Who has access to your data

Your data is accessible only to the partners of Forteresse AI, who are authorized to access it strictly to the extent necessary for their duties. Forteresse AI is made up of two people and has no other staff.

We do not sell or rent your data, and we do not share it with any third party for commercial purposes.

We use the following service providers, who act as processors on our behalf and on our instructions:

• Google Workspace, for our email, our calendar (appointments and video conferences), our document storage and our sales follow-up, where requests sent from the website are recorded. Data at rest and in transit is configured to be stored in Europe.
• Scaleway, for hosting our corporate website, our platform, our clients' environments and our technical logs. Data is hosted in France. The website does not store the messages you send us: they are forwarded to our email and our sales follow-up.
• Qonto, a payment institution located in France, and our chartered accountants, located in France, for our accounting, payroll and tax obligations.

Your data may also be disclosed to authorized authorities and bodies when required by law.

7. Where your data is stored, and transfers

Your personal data is hosted and stored within the European Union.

Forteresse AI has chosen an architecture based on two strictly localized environments: data about our contacts, clients, users and applicants is stored in our Google Workspace environment, whose data regions are set to Europe for data at rest and in transit; our website, our platform data and the data our clients entrust to us are hosted in France, with Scaleway.

Should we use a service provider established outside the European Union in the future, the transfer would be governed by the appropriate safeguards provided for in Chapter V of the GDPR, in particular standard contractual clauses adopted by the European Commission, and this policy would be updated accordingly.

8. Security of your data

Forteresse AI implements appropriate technical and organizational measures to protect your data against unauthorized destruction, loss, alteration, disclosure or access.

These measures include restricting access to authorized people only on a least-privilege basis, two-factor authentication on our accounts, encryption of data in transit, encryption of workstations, isolation of our clients' environments, access logging, regular backups, and an information security policy that is reviewed periodically.

9. Cookies

Our website does not use any cookies or other trackers: it does not store any information on your device, does not set any third-party, audience measurement or advertising cookies, and does not load any script or font from a third-party service.

10. Your rights

In accordance with Regulation (EU) 2016/679 and the French Data Protection Act, you have the following rights over your data:

• The right of access, which allows you to obtain confirmation that your data is being processed and to receive a copy of it.
• The right to rectification, which allows you to have inaccurate or incomplete data corrected.
• The right to erasure, which allows you to have your data deleted in the cases provided for by the regulations.
• The right to restriction of processing, which allows you to have it frozen in certain situations.
• The right to object, which allows you to object to processing based on our legitimate interest and, in particular, to object at any time and without giving a reason to business development messages.
• The right to withdraw your consent at any time, for processing based on consent.
• The right to data portability, which allows you to receive the data you have provided to us in a structured, machine-readable format and to ask for it to be sent to another controller.
• The right to set instructions regarding what happens to your data after your death.

To exercise these rights, send your request to our Data Protection Officer at dpo@forteresse.ai or by post to the address given in section 2. We may ask you to prove your identity if we have reasonable doubts about it.

We respond to your request within one month of receipt. This period may be extended by two months if the request is complex or if we receive a large number of requests; in that case, we inform you within the initial one-month period and explain the reasons for the extension.

If, after contacting us, you consider that your rights have not been respected, you can lodge a complaint with the Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at www.cnil.fr.

11. Data our clients entrust to us

When a client entrusts us with personal data as part of an automation project, Forteresse AI acts as a processor within the meaning of Article 28 GDPR. This is not always the case and depends on the nature of each project.

In that case, our client determines the purposes and means of the processing and is responsible for it. Forteresse AI acts only on its documented instructions, under a data processing agreement entered into with it.

This processing takes place in environments hosted in France. When a project involves personal data, processing that uses artificial intelligence runs on inference services hosted in France, excluding any model provider established outside the European Union.

If your data is processed by Forteresse AI in this context and you wish to exercise your rights, please contact directly the controller that collected your data. We will pass on to our client any request we receive in this respect.

12. Changes to this policy

Forteresse AI may amend this policy to reflect changes in its processing, its service providers or the applicable regulations.

The version in force is the one published on the forteresse.ai website, with its last update date shown at the top of the document. In the event of a substantial change affecting your rights, we will inform you by any appropriate means.