Privacy notice

Last updated: 29 October 2026 (version 1)

Fortalan is a brand of the sole proprietorship (obrt) named in the legal line at the foot of this page and on our legal notice, owned and run by one person in Zagreb, Croatia. In this notice, "we" and "us" mean the owner and the business.

This notice explains which personal data we handle, why, for how long, and what you can do about it. It covers:

• people at businesses we write to about our services;
• people who reply to us, write to us or use the contact form on this site;
• our clients and the people we work with at client companies;
• visitors to this site and to the private demo pages we send;
• people whose names happen to appear on the public store pages we capture.

In short

• We write only to companies, one email at a time. Each email is prepared for one store and is reviewed, edited and sent by the owner himself.
• We use only contact addresses and contact forms that a company publishes on its own website, such as info@ or a role address like partnerships@. We do not buy lists, guess addresses, use email-finder tools or keep the names of staff.
• Our emails contain no tracking pixels and no tracked links.
• If you do not reply, we delete our outreach record 12 months after our last email. Demo videos are deleted within 90 days.
• You can object at any time: reply "no thanks" and we will not contact you again.

Your right to object to direct marketing

You can object at any time, free of charge and without giving a reason, to our use of your data for direct marketing.

To object, reply "no thanks" to any of our emails (any other words that say you do not want to hear from us work too), or write to hello@fortalan.com. We stop all marketing to you at once, and in any case within two business days. We delete the outreach data we hold about you and any demo made for your store. We keep only a short entry on our do-not-contact list (the email address or domain, the company name, the date and how you objected) so that we never contact you again. We check that list before every email we write.

You can also object, on grounds relating to your particular situation, to any other use of your data that we base on legitimate interests. We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.

Who is responsible for your data

The controller is:

• the owner of the business below, which uses the brand Fortalan
• Business: the sole proprietorship (obrt) named in the legal line at the foot of this page and on the legal notice
• Address: Ulica Miroslava Kraljevića 11C, 10360 Sesvete, Zagreb, Croatia
• OIB: given in the legal line at the foot of this page and on the legal notice
• Email: hello@fortalan.com

We have not appointed a data protection officer, because the law does not require one for what we do. Please send any question about this notice or about your data to hello@fortalan.com.

What we process and why

1. Businesses we contact about our services

This part covers data we do not collect from you directly but find on a business's own website.

We look for online stores that could benefit from an AI shopping assistant and write to them by email. We write only to companies, never to sole traders, and only in countries whose e-marketing rules allow a business email of this kind. Each store gets one email and at most one follow-up. We send every email by hand from our own mailbox, not through a bulk email service.

What we record

• the store's name, website, country and legal form;
• the contact address we use: a general company address (such as info@ or hello@), a role address the company itself publishes (such as partnerships@ or sales@), or the address of its contact form;
• where we found it: the page address, the date and a screenshot of that page;
• the emails we send, any reply and the outcome.

We also note public facts about the store as a business, such as its shop platform, the size of its catalogue, published company figures and how well it fits our offer. These describe the company, not people.

A general company address is usually not personal data. A role address can be, when one person reads it.

What we do not keep: names of owners, directors or staff, personal email addresses, phone numbers or social media profiles. We use no email-finder tools, purchased lists or data brokers. When our tools read a store's contact or legal page, they also see the other addresses published there. Addresses that belong to a person (with a name or initials) are discarded at once: we keep only how many there were.

Where it comes from: publicly accessible sources, namely the store's own website (its contact page, imprint or legal notice, terms or footer). When the store's own pages do not show its legal form clearly, we check the public company register entry the store refers to. We do not copy the names of directors or owners from it.

Why:

• to offer our services to stores that we think would benefit from them;
• to be able to show where we found the address and why we were allowed to write;
• to make sure we never write again to a business that said no.

Legal basis: legitimate interests. Our interest is to find business clients. The store has an interest in hearing about a relevant offer. We keep the impact small: published company addresses only, one email and at most one follow-up, no tracking, short retention, and an objection that works at once. You can ask us for a summary of our assessment of these interests.

When we tell you: in our first email, which says where we found the address and links to this notice, and in any case within one month of finding the address. If we have not written to a business within that month, we delete the contact address and the screenshot and keep only facts about the company. If we decide to write later, we look the address up again on the store's website.

2. People who reply or write to us

When you reply to one of our emails, use the contact form on this site or write to hello@fortalan.com, we receive your email address, your message and anything else you choose to send. The contact form also asks for your name and your store's web address.

Why and legal basis: to answer you and continue the conversation you started (legitimate interests). If you ask for a demo or an offer, we use the data to prepare it. If you are asking for yourself, for example as a sole trader, the basis is a step you asked for before a contract (contract); otherwise it is legitimate interests.

You do not have to give us any data, but we need an email address to reply. The form shows which fields are required.

3. Clients

When a business becomes our client, we process:

• the names, work email addresses, phone numbers and roles of the people we work with there, which we get from them or from their company;
• our contract, correspondence, project and support records;
• billing details: company name, address, tax number, invoices and payments.

Why and legal basis:

• to perform our contract: contract, where the client is a natural person such as a sole trader. For the people we work with at a client company, the basis is our legitimate interest in performing the contract with that company;
• to issue invoices, keep accounting records and meet Croatian tax and e-invoicing rules: legal obligation;
• to establish, exercise or defend legal claims: legitimate interests.

We need billing details to issue invoices, which the law requires.

When we run an assistant on a client's store, the client decides how its shoppers' data is used. We process that data only on the client's instructions, under a data processing agreement, and the client's own privacy notice covers it.

4. Visitors to this site and to demo pages

When you open this site or a demo page, your browser sends standard technical data to our hosting provider: your IP address, the date and time, the page requested and your browser's user agent. Without it the page cannot be delivered. Our hosting provider uses this data only to deliver the pages and keep them secure (legitimate interests: running a safe website). We keep no access logs, and we do not use this data to identify you or to see who opened a demo.

Our pages load nothing from other websites: no analytics, advertising or social media trackers, and no fonts or scripts from other services.

5. Names that appear on store pages we capture

Screenshots and copies of public store pages can show names that the store itself has published, for example a director named in its imprint or a customer's first name next to a review. We do not extract, list, use or contact these people, we leave such details out of demo videos, and the captures are deleted together with the record or demo they belong to (see "How long we keep data"). We hold no contact details for these people and do not want to collect any, so we inform them through this notice. The legal basis is the same as for the record or demo the capture belongs to: legitimate interests.

Our emails

Our emails contain no tracking pixels, no open tracking and no tracked or redirected links, and we never ask for read receipts. We load no images from our servers into emails: an email either has no images or carries them inside the message itself, so opening an email tells us nothing. The link to a demo is unique because the demo was made for one store only. It controls access and the expiry date; we do not record or count who opens it.

Demo videos

Before writing to a store, or when a store asks for one, we record a short demo of our assistant on that store's website.

• What is recorded: the store's public pages as any visitor sees them, opened in our own browser, with our assistant placed on top. Nothing on the store's website is changed, and we use no access to its systems.
• What the assistant uses: a small sample of the store's public product data, such as product names, prices, categories and short descriptions.
• No shoppers or staff in the video: we avoid pages that show customer reviews with names or photos, staff photos, live chat or account areas, and we leave any such details out of the video. The shopper in the video is us, following a script.
• Copies of pages: to build the product sample, our tool keeps temporary copies of the public pages it reads. They contain whatever the store shows publicly, which can include names next to reviews. We do not extract or use those details, and we delete the copies together with the sample.
• Private link: the video is sent only to the store, through an unlisted link made for that store. The link expires 60 days after we send it.
• Deletion: we delete the video in all its versions, its still images, the product sample and the page copies within 90 days of sending (or of making the demo, if we never send it), and at once if the store asks (reply "delete") or objects.
• No public use: we never publish a demo or use it in a portfolio, case study or advertisement without the store's written permission.

More detail: How our demos are made.

Cookies

This site does not use cookies, pixels or similar technologies to recognise or track you.

Your theme choice. The site follows your device’s light or dark setting. If you switch the theme with the button at the top of the page, your browser keeps that one choice on your device, in its local storage under the name “fortalan-theme”, so that the next page opens in the theme you chose. It is never sent to us, and it is removed when you switch back to your device’s setting or clear this site’s data in your browser.

We do not use analytics, advertising or social media cookies. If that ever changes, we will ask for your consent first and update this notice.

Who receives your data

Only the owner works with these records. These service providers process data for us, only on our instructions and under data processing terms:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Gmail): our mailbox, for sending and receiving email, including the messages sent through the contact form.
• Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States: hosts this website and our private demo pages, stores the demo videos in its EU storage region, and runs the contact form, which passes your message to our mailbox.
• OpenRouter, Inc. (United States), which passes our requests to Google's Gemini models, and Anthropic, PBC (United States, Claude): AI models that read public store pages and screenshots for us and help draft emails. They see what those pages show, including any address or name published there. The model behind the demo assistant receives only product data, the page on screen and our scripted questions.
• Our bookkeeping and e-invoicing service providers: invoicing and accounting for clients.

Where the law requires it, we pass data to public authorities, for example invoice data to the Croatian Tax Administration (Porezna uprava) under the fiscalisation and e-invoicing rules. When we need advice on a legal or tax question, we share the data that question needs with our lawyer or accountant, who are bound by confidentiality.

We do not sell or rent personal data, and we do not share it with anyone for their own marketing.

Transfers outside the European Economic Area

• Google Ireland Limited runs our mailbox. Google may process mailbox data in the United States through Google LLC, which relies on its certification under the EU-US Data Privacy Framework (Art. 45 GDPR, Implementing Decision (EU) 2023/1795) and on standard contractual clauses (Art. 46(2)(c) GDPR, Decision (EU) 2021/914).
• Cloudflare, Inc. is a company in the United States. Transfers to it rely on its certification under the EU-US Data Privacy Framework (Art. 45 GDPR, Implementing Decision (EU) 2023/1795) and on the European Commission's standard contractual clauses in our agreement with it (Art. 46(2)(c) GDPR, Decision (EU) 2021/914).
• OpenRouter, Inc. and Anthropic, PBC are companies in the United States; transfers to them rely on the standard contractual clauses in their data processing terms (Art. 46(2)(c) GDPR, Decision (EU) 2021/914)

You can ask us for a copy of these safeguards at hello@fortalan.com. The Commission lists its adequacy decisions on its website, and the standard contractual clauses are published in EUR-Lex.

How long we keep data

Your rights

You have the right to:

• access the personal data we hold about you and get a copy;
• rectification of data that is wrong or incomplete;
• erasure of your data, apart from what the law requires us to keep or what we need to establish, exercise or defend legal claims. After an objection we keep only the do-not-contact entry, so that we can respect it;
• restriction, so that we only store your data while a question about it is settled, for example whether it is accurate;
• data portability: to receive the data you gave us under a contract with you in a common machine-readable format, or to have it sent to someone else;
• object, as described in "Your right to object to direct marketing" above;
• not be subject to automated decisions. We make no decisions about you based solely on automated processing, including profiling. We use software, including AI models, to research public information about stores and to help draft emails, but the owner reviews every lead and writes and sends every email himself.

We do not rely on consent for anything in this notice. If we ever ask for your consent, you can withdraw it at any time, as easily as you gave it.

How to use your rights: write to hello@fortalan.com or to our postal address. It is free. We reply without undue delay, and at the latest within one month of receiving your request. If a request is complex, or we receive many, we can extend this by up to two more months; we will tell you within the first month and explain why. If we are not sure that a request comes from you, we ask for something that confirms it, for example a reply from the address concerned.

Complaints

If you think we have used your data unlawfully, please tell us at hello@fortalan.com so that we can put it right. The Croatian authority also asks people to write to the controller first. You always have the right to complain to a data protection authority.

The authority responsible for us is the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP):

• Ulica Metela Ožegovića 16, 10000 Zagreb, Croatia
• azop@azop.hr, +385 1 4609 000
• azop.hr, with an English page on how to lodge a complaint

You can also complain to the authority of the EU or EEA country where you live or work, or where you think the problem happened. The European Data Protection Board lists all of them. In the United Kingdom you can complain to the ICO, and in Switzerland you can report a concern to the FDPIC.

Changes to this notice

We update this notice when our services or the law change. The date at the top shows the current version. If we want to use your data for a new purpose, we will tell you before we start. We keep earlier versions and will send one on request.