Privacy Policy

1. Controller

The data controller, or equivalent organization responsible for personal data, for the SaaSOS store, marketing site, and customer portal is ForthFox Solutions, sole proprietorship / individual trade name, 224, Apple Square Beside Lajamni Chowk, Mota Varachha, Surat, Gujarat 394101, India. Contact: support@saasos.app · +91 90331 66590.

If you deploy SaaSOS Runtime for your own customers, you are the controller for that deployment. We do not access your self-hosted customer data unless you request support and grant access.

2. Data we collect

We collect data from you, your browser or device, payment and authentication providers, and campaign links that brought you to the site. Please do not submit another person's personal data, confidential production data, or sensitive personal data in project specifications or support materials unless it is necessary and you are authorized to do so.

• Account and identity data: name if provided, email, authentication method, account status, and identifiers returned by Google or GitHub if you choose an enabled social sign-in option.
• Purchase and license data: order identifiers, coupon use, policy acceptance, license keys, entitlement dates, invoices, transaction status, and download events.
• Payment data: payment and fraud-prevention references returned by Stripe or Razorpay. Those providers collect payment details directly; we do not store full card numbers.
• Portal and project data: product names, descriptions, domains, support email, requirements or specifications you submit, planned modules, project decisions, and limited prompt or generation history.
• Communications: support requests, email correspondence, attachments or diagnostic information you choose to provide, and records of our response.
• Technical and security data: IP address, user agent, timestamps, request and error logs, sign-in events, policy-acceptance records, and other events needed to secure and operate the site and portal.
• Session marketing attribution: UTM parameters, click IDs, and landing page may be stored in the browser for the session so checkout and conversion measurement can attribute the visit. This is separate from optional analytics or advertising scripts.
• Optional measurement data: analytics or advertising events processed by Google Analytics or Meta Pixel when those tools are configured and consent is required and obtained.
• Necessary cookies and local storage used for authentication, session, security, checkout integrity, session attribution, and recording your cookie choice. See the Cookie Policy for details and controls.

3. Purposes and legal bases

We use personal data to create and secure accounts, process checkout, deliver licenses and downloads, provide portal tools and support, send service messages, keep business and tax records, prevent fraud and abuse, troubleshoot and improve the service, enforce our terms, and establish or defend legal claims.

Where applicable law requires a legal basis, we rely on performance of a contract for accounts, purchases, delivery, and requested support; legal obligations for tax, accounting, and lawful requests; legitimate interests for security, fraud prevention, service improvement, and operating our business; and consent for non-essential cookies, analytics, or marketing pixels where required. We consider and balance relevant privacy impacts when relying on legitimate interests.

4. Processors and sharing

We disclose data only as needed to operate the business: Stripe and Razorpay process payments; SendGrid or a configured SMTP provider sends receipts, sign-in links, and support messages; hosting and infrastructure providers, including Hostinger where used, store application data and operational logs; and professional advisers may receive limited information when reasonably necessary.

Google or GitHub processes account identifiers if you choose an enabled social sign-in option. Google Analytics and Meta Pixel process optional measurement or advertising events only when configured and when consent is required and obtained. Cloud storage, content-delivery, or similar infrastructure providers may be used if our deployment is reconfigured. We do not currently use a third-party CAPTCHA service or a separate third-party error-monitoring service.

We do not sell personal information for money. Optional advertising technologies may be considered a sale, sharing, or targeted advertising under some laws. Where those laws apply, you can opt out by choosing necessary cookies only or withdrawing your cookie consent. We may also disclose information when required by law, in a business reorganization subject to appropriate protections, or when reasonably necessary to protect rights, safety, and security.

5. International transfers

ForthFox Solutions operates from India. Payment, email, hosting, authentication, and optional analytics providers may process data in India, the United States, or other countries where they or their service providers operate. Privacy protections and government-access rules may differ between countries.

Where applicable law restricts an international transfer, we use an available lawful mechanism and safeguards appropriate to the transfer, which may include adequacy decisions or regulations, contractual protections, and transfer-risk review. The mechanism used depends on the relevant locations, provider, and applicable law.

6. Retention

We keep personal data only for as long as reasonably needed for the purposes described above. The period depends on the type of record, whether your account or license remains active, and legal, accounting, tax, fraud-prevention, security, support, contractual, and dispute-resolution needs.

You may request deletion of eligible personal data by emailing support@saasos.app. We may retain or de-identify records where permitted or required, and will explain any material limit that applies to your request.

• Account, portal project, license, and entitlement records may be kept while the account or license is active and for a reasonable period afterward to provide access, verify rights, and resolve disputes.
• Purchase history, invoices, policy acceptance, and payment references may be kept for the period required by tax, accounting, consumer, and financial-record obligations.
• Support conversations and diagnostic materials are kept while handling the request and afterward when needed for follow-up, service improvement, or claims.
• Security, authentication, and download logs are kept for a limited period based on operational and fraud-prevention needs. One-time download tokens expire on a short schedule.
• Session attribution is stored for the browser session. Cookie consent is kept until it is cleared or replaced. Optional analytics and advertising providers apply their own retention settings.

7. Your rights

Depending on your location and applicable law, you may have some or all of the following rights:

Send a request to support@saasos.app and describe the right you want to exercise. We may ask for information reasonably needed to verify your identity, authority, and account. We will respond within the period required by applicable law. Some rights have exceptions, and a particular right may not apply to our business or to the data involved.

You can withdraw optional cookie consent through the controls described in the Cookie Policy. You can unsubscribe from any marketing email using its unsubscribe link. Account, purchase, security, and support messages are service communications rather than marketing.

• Access or know what personal data we hold, how we use it, and the categories of sources and recipients.
• Correct inaccurate or incomplete personal data.
• Delete or erase eligible personal data.
• Restrict processing or object to certain processing, including direct marketing.
• Receive eligible data in a portable format where the right applies.
• Withdraw consent at any time, without affecting processing that was lawful before withdrawal.
• Opt out of a sale, sharing, or targeted advertising where applicable. We do not sell personal information for money; use the cookie controls for optional advertising technologies.
• Exercise applicable rights without unlawful discrimination or retaliation.
• Use an authorized agent, nominate another person, or appeal a refused request where applicable law provides that option.
• Lodge a complaint with the privacy or data-protection regulator for your location.

8. Children

The store and portal are intended for adults and business buyers, not children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided personal data, contact us so we can investigate and delete it where appropriate.

9. Security

We use reasonable technical and organizational measures appropriate to the nature of the service. These include HTTPS in transit, authenticated sessions, password hashing where passwords are enabled, access controls, server-side authorization, least-privilege operational access where practical, payment-webhook verification, short-lived download links, security and audit logging, and encryption for protected configuration secrets where applicable. Payments are handled by established payment providers.

No method of transmission or storage is completely secure, and these measures are not a guarantee against every incident. See the Security page for practices and responsible-disclosure contacts.

10. Contact, complaints, and changes

For privacy requests, questions, or complaints, email support@saasos.app, call +91 90331 66590, or write to ForthFox Solutions, sole proprietorship / individual trade name, 224, Apple Square Beside Lajamni Chowk, Mota Varachha, Surat, Gujarat 394101, India. We will review privacy complaints and explain our response. You may also contact the competent privacy regulator where applicable.

Policy version 2026-07-30, effective 30 July 2026. We may update this Policy as our services, providers, or legal obligations change. We will post the updated version here and provide additional notice for material changes where appropriate.

11. Practical data-flow disclosure

• Marketing pages may receive basic request logs from the hosting provider.
• Portal accounts store identity, entitlement, order, support, download, and project records needed to provide the account and portal tools.
• Stripe or Razorpay processes payment details and returns transaction references; we do not store full card numbers.
• Google or GitHub receives authentication requests only if its optional sign-in method is enabled and you choose it.
• Optional analytics and marketing providers receive events only when configured and consent is required and obtained.
• Self-hosted Runtime deployments are controlled by the buyer, not ForthFox Solutions.

Mandatory consumer and privacy rights

Nothing in these documents limits any non-waivable right you have under applicable consumer, privacy, or other mandatory law. Where mandatory law conflicts with these terms, that mandatory law controls for the affected right only.