Fornax Privacy Policy

Last Updated: October 29, 2026

1. Who we are and what this covers

Fornax OpSuites LLC (“Fornax”, “we”) is an Arizona company. We build websites, dashboards, and phone and texting tools for small trade businesses. We also contact businesses to offer them. This policy says what personal information we collect, why, who handles it, how long we keep it, and what you can ask us to do.

Our role depends on whose information it is.

• We decide how it is used for visitors to fornaxopsuites.com, people at businesses we research and email, and the owners and staff of our clients. See sections 2 to 4.
• We act for our client for people who use a client’s website, quote form, phone line, or texts, usually homeowners. The client business decides how that information is used. See section 5.

2. Visitors to our own websites

• No cookies. fornaxopsuites.com sets no cookies. We run no advertising scripts and no third-party analytics. Fonts and images come from our own site.
• Counting visits. We count visits without cookies. For each page view we record the page address (without anything after a ”?”), the name of the website that sent you (for example “google.com”, never the full link), and the day. We also count a short fixed list of actions: taps on our main buttons, such as “Become a client”, and sent forms. For these we record only the action’s name, the page, and the day. We never record what you type.
• Daily totals only. We do not record your IP address, browser, device, or any ID for these counts. They cannot follow one person from page to page or day to day. If your browser sends Global Privacy Control or Do-Not-Track, nothing is counted.
• Access log. Our server writes one line per page request: the time, the page (no query string), the response code, a broad browser family such as “browser” or “googlebot”, and the referring site’s name. It does not record your IP address. Counting requests are not written to this log. Our host keeps the log for its standard period. We keep no copy.
• Forms. If you use our Start form, we receive what you type: name, business, trade, area, team size, email, and optionally phone, website, current CRM, and notes. We use it to reply and, if you ask, to build your site.
• Checkout. Payment happens on Stripe’s hosted page, not ours. Stripe’s own privacy policy and cookies apply there.

Our hosts, such as Railway and Cloudflare, may keep their own network logs, which can include IP addresses. We do not see or use them.

3. People at businesses we research and contact (prospects)

We build demo websites for trade businesses and email the owner. To do this we collect business information from public sources: the business name, phone, address, website, services, hours, and Google place identifiers.

To email a business we use a contact address published on the business’s own website. We do not buy email lists.

• How we use it: to build the demo, decide whether the business fits, write to the owner, and record replies.
• Limits on email. We send a business at most three emails. We keep the record so we know we have already written and what the business said.
• Demos are not public. They are hidden from search engines, marked “Preview by Fornax, not published by” the business, and deleted 14 days after we create them unless the owner buys. See our Demo Notice below.
• AI. A drafting model may write demo text from the public facts. A model may read a reply you send us so we can sort it, for example “not now” or “please stop”. See section 6.
• Google data. We keep only Google’s place identifier and refresh the rest before we write.
• Opting out. Every email has an unsubscribe link. Clicking it, or replying “stop” or “unsubscribe”, stops all messages from Fornax to that address. This covers every Fornax domain and has no end date, unless you later ask to hear from us again. “Not now” pauses our emails but is not a permanent opt-out unless you say stop. We keep a record that you opted out so we never contact you again. We send no sales texts to prospects.

4. Our clients’ owners and staff

• Account information: names, business email, phone, role, sign-in details (passwords are held by our sign-in provider, not by us in readable form), sign-in activity, and device information for security alerts.
• Business information you give us to build and run your site: services, service area, hours, logo, photos, licence and insurance details you confirm, and prices you choose to show.
• Billing: handled by Stripe. We keep invoice records. We never see full card numbers.
• Support: tickets, emails, and files you send.
• Texts and alerts: if you turn them on, we text you lead alerts and sign-in codes you request. Reply STOP to stop alert texts. You can use email or app alerts instead.
• Calls with us: we do not record calls. If we ever do, we ask first and say so on the recording.

5. People who contact our clients (end customers)

When you visit a client’s website, send its quote form, call or text its number, or are its customer, that business collects your information and we process it for them. Contact the business first with any request. If you contact us, we pass your request to the business and help it answer.

• Forms: what you type, such as name, phone, email, ZIP or address, the job you need, your message, and photos you choose to send. We remove location data from photos before they appear on a website.
• Visit counting on client sites: no cookies and nothing saved on your device. We record the page, the referring site, whether you tapped call or sent the form, and page speed. We do not record your IP address or browser string. If your browser sends Global Privacy Control or Do-Not-Track, the visit is not recorded. Single visit records are kept 90 days. After that only daily totals remain.
• Calls: for a business using Fornax Phone we record call details only: the calling number, time, length, and whether it was answered. Calls are not recorded.
• Texts: texts go out only in the business’s name and only to people who ticked a “text me” box naming that business. The one exception is a single missed-call text-back to the caller who just called. STOP ends texts at once. Texts you send and receive are stored so the business can see the conversation. Mobile numbers and text opt-in information are not shared with third parties or affiliates for marketing.
• Dashboard: the business keeps notes, job status, quotes, and payment status about you in its dashboard.
• Records the business uploads: a business may photograph or upload its own customer records so we can import them. Photos of paper records are read and not stored.
• Tools the business connects: if the business connects its own CRM, accounting software, or Google Business Profile, we send or receive what that business chooses.

We never sell this information. We never use it for our own marketing. We never combine one person’s records across businesses. We never try to identify anonymous visitors. We never use it to train AI models.

6. Artificial intelligence

We use AI models from Anthropic and Cloudflare (Workers AI) for set tasks. They draft website text from business facts. They check draft sites. They read files a client uploads to import its customer list. They answer a client’s questions about its own data (“Ask Fornax”, when switched on). They guide a Website buyer through moving their site. They sort replies to our sales emails. For each task we send the provider only the text or file it needs. We use these providers under terms that do not allow them to train their models on what we send. No AI decides anything with a legal or similarly significant effect on you. Details are in Schedule 5 of our Terms.

7. Who handles information for us

• Service providers (subprocessors), listed in section 16. They may use the information only to provide their service to us.
• The client business, for end-customer information (section 5).
• Tools a client connects (section 5).
• Legal reasons: to follow the law or valid legal process, to protect rights and safety, or to enforce our terms.
• Business transfer: if Fornax is sold or merged, information moves to the new owner under this policy, and we tell affected clients.

We do not sell personal information. We do not share it for cross-context behavioural advertising.

8. Security

We use encrypted connections (TLS) everywhere. We keep each client’s data separate with row-level database controls. We encrypt stored connection keys. We limit administrator access to the founder, with two-step sign-in, and log administrator access to client data. No system is perfectly secure. More detail is in our Security Statement.

9. Cookies and similar tools

• fornaxopsuites.com: no cookies, as in section 2.
• Checkout: Stripe sets its own cookies on its payment page, under its own policy.
• Dashboard: we keep what is needed to keep you signed in and remember your settings on your device. We do not use it for advertising or tracking. The map loads street-map tiles from OpenFreeMap, which sees your device’s IP address as any website would. It receives no customer information.
• Client websites: no cookies and no third-party tracking.
• Changes: if we ever add a cookie or a third-party script, we update this notice first and, where the law requires, ask for consent before it loads.

10. How long we keep information

11. Your rights

Wherever you live in the US, you may ask us for a copy of the personal information we hold about you. You may ask us to correct it or delete it. You may ask us to stop any sale or sharing (we do neither). We will not treat you differently for asking. We offer these to everyone, whether or not a state law requires it.

• How to ask: email support@fornaxopsuites.com with the subject “Privacy request”, or use the link in our emails. An authorised agent may ask for you with your signed permission.
• Checking it is you: we match your request to information we already hold, for example the address you write from. We do not ask for a government ID unless the law requires it.
• Timing: we confirm within 10 business days and answer within 45 days. If we need more time, up to 45 more days, we tell you why.
• If we say no, we explain why. Reply “appeal” and we answer within 45 days.
• Dashboard deletion: if a client asks to delete its business from the dashboard, there is a 14-day cooling-off period first.
• Copies: a person with no account gets a copy by email on request.
• End-customer data belongs to the client business. We forward the request and help it answer.
• Global Privacy Control: we treat it as an opt-out of sale and sharing, and our counters skip your visit.

12. Children

Our services are for businesses. We do not knowingly collect information from children under 13. If we learn we have, we delete it.

13. If there is a data breach

If personal information we hold is acquired without permission in a way that puts it at risk, we investigate promptly. For information we control, we notify affected people without undue delay and within 72 hours of confirming a breach (Arizona law allows up to 45 days; we hold ourselves to 72 hours). Where more than 1,000 people must be notified, we also notify the Arizona Attorney General, the Arizona Department of Homeland Security, and the three national credit bureaus. For information we process for a client, we notify the client without undue delay and within 72 hours of confirming it, and help it notify its customers.

14. Where data is stored

Our main database is hosted in the United States (California, US West). Some providers, such as our content-delivery network, serve data from many countries. Our service is for US businesses.

15. Changes and contact

We post changes here with a new date. For a material change we email clients at least 30 days before it applies.

Fornax OpSuites LLC, support@fornaxopsuites.com.

16. Subprocessor list

“Client data” means information about clients’ end customers. “Account data” means our clients’ and prospects’ business and contact details. In use means handling real data now. Planned means chosen but not yet handling real data. We give 30 days’ notice before adding one that handles client data.

Services that receive no client data: Google Places (public business facts for prospect research), DataForSEO (search ranking data), OpenFreeMap (map tiles loaded by your browser), and ntfy.sh (our own uptime alerts).

Tools a client connects itself, such as HubSpot, QuickBooks, Google Business Profile, or its own phone system, are the client’s own vendors.

17. Demo notice and takedown

We build sample websites for trade businesses before the business has agreed to anything, from public facts. Every demo follows these rules.

• What it holds: the business’s public name, phone, city, services, and hours. Images are our own illustrations and stock or, where used, the business’s own logo or photos shown from its website or held as temporary copies deleted with the demo. A demo never shows licence numbers, owner or staff names or faces, “licensed”, “insured”, “bonded”, award claims, ratings, reviews, or outcome promises. We never alter a logo.
• Marked: a banner on every page says “Preview by Fornax, not published by” the business. A “Demo” mark, the sentence “Nothing is kept unless you approve”, and a “Remove this demo” link appear on every page.
• Not public: a noindex tag on every page, no sitemap, no social preview images, and a long random address on a Fornax demo domain.
• How long: a demo the business does not approve is deleted 14 days after creation, with any temporary image copies.
• Removal: click “Remove this demo” or email support@fornaxopsuites.com with the demo address. We take it down within 1 business day. We record the takedown so the same facts are not used again. If you ask us to stop contacting you, we add you to our permanent do-not-contact list.
• Copyright: to report infringement, use the same link or email, subject “Copyright”.