Privacy Policy

This policy explains how Fortitude Omnis Group Ltd (“OSPulse”, “we”, “us”) handles personal information in connection with the OSPulse product and its website at ospulse.app. We are a company registered in England & Wales (company number 16862154), and we are the controller of the personal data described below.

1. Scope

This policy covers the OSPulse website and the OSPulse subscription. Subscriptions are taken out through Article 14 Signal at article14.fortitude-omnis.group, which has its own privacy policy covering the readiness report and the reserve flow. The same company is the controller for both.

2. Information we collect

• Account and subscription details. When you take out a subscription we collect the work email address, company domain and role you provide, and we create an OSPulse account from them.
• Billing data. Payment is processed by Stripe, which captures and stores your card. Card details never reach our servers and we never see or store your full card number. From Stripe we receive your billing email, the last four digits and card type, the payment status, and Stripe’s own identifiers.
• Dependency and repository data. To provide the service we process the dependency manifests and repository metadata you connect — package names, versions and their history. We use this to produce health scores, exploitation findings and your awareness record. We do not use your dependency data to train models, and we do not share it with other customers.
• Technical request data. When you submit a form we record the IP address and browser user-agent of the request, together with a timestamp, to help prevent abuse and spam.
• Server and access logs. Our hosting provider records standard technical data (IP address, browser type, pages requested, timestamps) to operate and secure the site.
• Correspondence. If you email us, we receive your email address, message, and anything else you include.

This site does not use advertising or cross-site tracking cookies, we do not run third-party analytics that profile you across sites, and we never sell personal data.

3. How we use your information

• To provide the subscription: scanning, scoring, alerting, and maintaining your awareness record.
• To take payment, issue invoices, and manage renewals and cancellations.
• To send service messages about your subscription — renewal notices, billing problems, security notices. These are not marketing and you cannot opt out of them while you hold a subscription.
• To send product updates where you have asked to hear from us.
• To operate, maintain, and secure the website and prevent abuse.
• To respond to enquiries and comply with our legal obligations.

4. Legal bases (UK GDPR)

Where UK/EU data protection law applies, we rely on: performance of a contract for everything needed to run your subscription — your account, your billing data, and the dependency data we process to deliver the service; our legal obligations for keeping billing and tax records; our legitimate interests in running a secure service and preventing abuse; and your consent for marketing email, which you can withdraw at any time without affecting your subscription.

5. Service providers

To deliver the site and communicate with you we rely on a small number of providers:

• Stripe — payment processing and card storage.
• Cloudflare — the commercial backend holding subscription records.
• Web & email hosting — serves the site and maintains access logs.
• Brevo (Sendinblue) — sends product email where you have opted in.
• Google Fonts — fonts are requested from Google’s servers, which may receive your IP address as part of the request.

Each provider processes only the limited data needed to perform its function on our behalf. Some operate outside the UK and EEA; where they do, transfers rely on the provider’s standard contractual clauses or an adequacy decision.

6. Retention

• Account and dependency data — kept while your subscription is active. On cancellation you can export your data; we then delete or anonymise it, except where it forms part of an awareness record (below).
• Your awareness record — the evidential value of a timestamped record depends on it being retained, so we keep it after cancellation rather than deleting it silently. Ask us to delete it and we will, having made clear what you would be giving up.
• Billing records — kept for six years after the end of the relationship, because UK tax law requires it. We cannot delete these on request.
• Server logs — kept for a limited period by our hosting provider.
• Correspondence — kept only as long as needed to handle your enquiry.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, or restrict the processing of your personal data, to object to processing, and to data portability (UK/EU GDPR), or equivalent rights under other laws such as the California CCPA/CPRA. To exercise any right, email us at the address below, and we will respond within one month. Every OSPulse marketing email includes a one-click unsubscribe link. Some data we must keep — billing records for tax, and your awareness record while its evidential value depends on it — and we will say so plainly rather than quietly refusing. You may also complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

8. Security

Account and subscription data is held in access-controlled systems that are not publicly reachable, card data never leaves Stripe, and we apply reasonable technical and organisational measures to protect personal data. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any incident.

9. Children

OSPulse is a business product aimed at engineering organisations. It is not directed at children, and we do not knowingly collect personal data from them.

10. Changes

We may update this policy from time to time. Material changes will be reflected by the “last updated” date above.

11. Contact

Questions or requests about this policy, including data-access or deletion requests, can be sent to privacy@fortitude-omnis.group. Billing questions: billing@fortitude-omnis.group.