Privacy Policy

This Policy applies to all persons who access or use the Service in any capacity, including Account Holders, Users, and Participants, whether or not they hold an account. Because acceptance of the Terms and this Policy is required before entry to any account, meeting, workspace, session, or file, each person accepts this Policy as a condition of access.

Capitalised terms have the meanings given in the Terms & Conditions.

In this Policy, "Data" means any information, content, communications, media, activity, signals, and derived information that is exposed to, entered into, submitted to, generated by, transmitted through, observed within, captured by, stored by, processed by, or derived from the Service by any means, whether relating to an Account Holder, User, Participant, device, or session, and whether provided intentionally or otherwise.

Data exposed to or passing through the Service may be collected, stored, processed, transformed, and used as described in this Policy.

The Data we process includes, without limitation, information relating to accounts and identity; workspaces, sessions, projects, and files; communications and content created or exchanged through the Service; activity, usage, and interaction within the Service; media and session content; and technical and device information. The specific Data processed depends on how the Service is used and may change as the Service evolves.

We may combine Data, and we may generate new Data from it, including insights, analytics, summaries, and other derived outputs.

We process Data to provide, operate, secure, maintain, and improve the Service; to generate, enrich, and present insights, analytics, and related outputs; to manage accounts, billing, and support; to protect the Service and its users and enforce our terms; and to comply with legal obligations.

Where required by applicable law, our lawful bases for processing include the performance of our contract with you and the provision of features that are integral to the Service you request; our legitimate interests in operating, securing, and improving the Service; compliance with legal obligations; and, where applicable, consent. Processing that is integral to the Service is necessary for the performance of that contract and is not optional to the delivery of the corresponding features.

Depending on the features used, the Service may capture, record, store, process, and transform Data arising within meetings, workspaces, sessions, and files, and may derive insights, analytics, and other outputs from it. All such Data falls within the definition of Data in Section 2 and is handled as described in this Policy.

By accepting the Terms and this Policy as a condition of entry, each User and Participant acknowledges and accepts this processing. Where an Account Holder invites or admits Participants, the Account Holder is responsible, as set out in the Terms, for providing any notices to, and obtaining any consents from, those Participants required under the laws applicable to them.

We use third-party providers to help operate and deliver the Service. Data may be shared with, or processed by, such providers for these purposes. Our current providers include, among others:

1. Hetzner — hosting and infrastructure that supports certain Service features;
2. Google — processing that supports certain Service features;
3. Deepgram — processing that supports certain Service features;
4. Cloudflare — processing that supports certain Service features;
5. and other providers engaged from time to time to support hosting, delivery, communications, analytics, monitoring, and security.

This list may change as the Service and our providers evolve, and we will keep it current. We remain responsible for the acts and omissions of our sub-processors only to the extent we would be liable under the Terms for performing the relevant processing ourselves, and to the extent required by applicable law.

The Service and our providers may store and process Data in, and transfer it to, locations outside your country or the country in which it was collected, including where our infrastructure and providers operate. By using the Service you acknowledge that Data may be processed in such locations, which may have different data-protection laws. Where required by applicable law, we take steps intended to provide an appropriate basis for such processing and transfers.

We retain Data for as long as necessary for the purposes described in this Policy, including to operate and improve the Service, to maintain and generate insights, to meet our legal, accounting, and security obligations, and to establish, exercise, or defend legal claims, and otherwise as permitted or required by applicable law. Retention periods vary according to the type of Data and the purpose for which it is processed.

Subject to applicable law, you may have rights in relation to Data about you, which may include rights to access, correct, delete, restrict, object to, or port such Data, and to withdraw consent where processing is based on consent.

To exercise a right, contact us as described in Section 15.

A person who does not hold an account but whose Data was submitted to or processed by the Service (a Participant) may request deletion of that Data. Because such Data is typically created and controlled through an Account Holder's use of the Service, the requester must specifically identify the Data by providing, at minimum: what the Data is; when it was submitted or created; how it was submitted or collected; the basis on which the requester claims it relates to or is owned by them; and any further information reasonably required for us to identify the Data precisely within our systems and to determine ownership and whether the request qualifies.

We may, where we deem it reasonably necessary to verify, evaluate, or process a request — or where permitted or required by applicable law — inform the relevant Account Holder of the request. We will act on valid requests as required by applicable law after appropriate verification and due process.

We use commercially reasonable technical and organisational measures intended to protect Data. However, no method of transmission, storage, or processing is completely secure, and we do not warrant or guarantee the security of Data, the containment of workspaces or sessions, or that unauthorised access, loss, or alteration will not occur. Where we are legally required to notify a personal-data breach, we will do so in accordance with applicable law.

The Service is not directed to persons under 18, and we do not knowingly process the Data of a person under 18 except through, and under the supervision of, a consenting parent or guardian as described in the Terms. If you believe a minor has used the Service without appropriate consent, contact us and we will take appropriate steps in accordance with applicable law.

The Service does not create biometric identifiers or perform biometric identification of individuals. Insights and analytics are derived from activity and content and are not used to biometrically identify a person. If this changes, we will update this Policy and implement any additional notices, consents, and safeguards required by applicable law before doing so.

We may update this Policy from time to time. Where changes are material, we will take reasonable steps to notify you, for example by posting an updated version with a new effective date. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

For privacy questions or requests, contact privacy@fortal.io, Fortal Virtual Workspaces, RAKEZ Business Zone, Compass Building, Al Shohada Road, Al Nakheel, Ras Al Khaimah, United Arab Emirates. This Policy is governed by the laws of the United Arab Emirates as applicable in the Emirate of Ras Al Khaimah, as set out in the Terms.