FittingsOS Privacy Policy

Controller of website, marketing, and account-administration data. Montes Software LLC, a California limited liability company doing business as FittingsOS is the business that operates fittingsos.com and the FittingsOS Software. For personal information we collect from you on the public website (including quote-request forms), for operator account identifiers we create to authenticate you, and for security logs of our own systems, we determine the purposes and means of processing and act as a “business” under the California Consumer Privacy Act as amended by the CPRA (“CCPA”) and as a controller under other applicable laws.

Processor / service provider as to Customer Data. Job records, quality records, employee time, customer and vendor files, and other shop content that a Customer organization stores in FittingsOS (“Customer Data”) are processed by Provider on behalf of that Customer. As to Customer Data, the Customer is the controller / “business,” and Provider is a processor / “service provider.” The Data Processing Agreement at /dpa governs that processing. Employee privacy requests about Customer Data should be directed to the employer first. We will not respond to a data-subject request about another company’s Customer Data except to redirect the requester, unless legally required.

No personal guaranty; no individual party. Members, managers, officers, employees, and contractors of Provider are not parties to this Policy in their individual capacities.

This Policy covers: (a) the public website at https://fittingsos.com and related public pages; (b) quote and custom-project inquiry forms; (c) hosted sign-in, invites, password reset, and email multi-factor authentication; (d) account identifiers and audit logs Provider maintains to operate the Software; and (e) Customer Data only to the extent Provider hosts it and only as a service provider, as described in the Data Processing Agreement.

This Policy does not cover: (a) a Customer’s own privacy practices toward its employees, contractors, suppliers, or customers; (b) data that never leaves a Customer-controlled shop origin (including export-controlled technical data, gold NC programs, and machine tapes that stay off the public cloud); (c) third-party sites we link to; or (d) job-shop manufacturing of physical fittings — FittingsOS is software, not a machine shop.

Do not submit export-controlled technical data, prints, NC programs, classified information, government ID numbers, health information, or another person’s biometric identifiers on a public form. Public forms are not a controlled channel.

If you are a California resident, this section is our notice at collection under CCPA. We collect the categories below for the purposes stated. We do not sell personal information. We do not “share” personal information for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes that require a right to limit under CCPA, other than as permitted to provide the Software and secure our systems.

Identifiers: name, work email, work telephone, company name, username, IP address, device and browser identifiers. Collected from you, your employer (when they invite you), and automatically from your device. Used to respond to inquiries, authenticate, secure the service, and communicate about the Software.

Commercial information: the content of a quote or custom-project inquiry, subscription or seat status if a Customer has an Order Form. Used to evaluate and respond to inquiries and to perform a contract.

Internet / electronic activity: pages viewed on the public site, sign-in success or failure, approximate location derived from IP, user-agent, security and abuse-prevention events. Used for security, rate-limiting, debugging, and operating the website.

Professional / employment information: title, company, shop role, training-completion records a Customer stores. Used to operate Authorized User accounts and, as to Customer-stored records, only as a service provider.

Inferences: we do not build consumer marketing profiles. We may flag abusive or automated traffic.

Sensitive personal information we may process only if a Customer or user chooses to enable a feature: account login credentials (stored as one-way password hashes, never recoverable plaintext); optional biometric unlock templates a shop enrolls (face or passkey material as implemented — we do not require biometrics); email multi-factor codes (short-lived). We do not require Social Security numbers, driver’s licenses, financial account numbers, precise geolocation, or health data for core FittingsOS use. Do not submit those on a public form.

You provide: name, company, work email, phone, and free-text notes on a quote or custom-project form; username, password, and typed legal name on sign-in and Terms acceptance; optional title and company on the signature card; content you or your shop store as Customer Data.

Your organization provides: invites (email, intended username, roles, shop); seat and role assignments; Customer Data the shop elects to store.

Automatic collection: IP address, user-agent, timestamps, referring URL, cookie or similar identifiers required to keep a session, Turnstile challenge tokens on hosted sign-in when enabled, and security logs.

Service providers: our subprocessors (listed on /security and in the Data Processing Agreement) may process identifiers as needed to host the UI, tunnel the API, send transactional email, or provide DNS and WAF. They are not permitted to sell your information.

We use personal information to: (a) operate, maintain, and secure the website and Software; (b) respond to quote and custom-project inquiries and follow up at the email you give us; (c) authenticate Authorized Users, enforce seats, and keep an audit trail of click-wrap acceptance; (d) send transactional messages (invites, password reset, email MFA) when outbound email is enabled; (e) detect, prevent, and investigate abuse, fraud, and security incidents; (f) comply with law and enforce our Terms; (g) improve reliability of the public site (aggregated or de-identified where practicable); and (h) process Customer Data solely to provide the Software to that Customer, as a service provider.

We do not use public-site inquiry data to train public large-language models. Cloud AI features in the Software are off by default and must not receive gold NC, production G-code, prints, or export-controlled technical data.

A quote request submitted on the public form is an inquiry. It is not an offer, not a sales order, not a shop ticket, and not a contract to machine parts.

We disclose personal information to: (a) service providers / subprocessors that host or operate the Software under contract (currently including, as applicable, Vercel for the shop UI, Cloudflare for DNS, WAF, API tunneling, and Turnstile, GitHub for source control and CI, Tailscale for remote access as applicable, and Resend for transactional email when outbound email is enabled); (b) the Customer organization that invited you, which can see your account activity inside that shop; (c) professional advisors under confidentiality; (d) a successor in a merger, financing, or sale of assets, subject to this Policy; and (e) authorities when we believe disclosure is required by law or to protect rights, safety, or security.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not disclose personal information to data brokers.

The current subprocessor list and status (in use / as applicable / planned) is published at /security. Material additions that process personal information will be reflected there. As to Customer Data, the Data Processing Agreement’s subprocessor mechanism also applies.

We use cookies and similar technologies that are reasonably necessary to operate the site and Software: httpOnly session cookies for hosted sign-in; CSRF tokens; and limited local or session storage (for example, a Terms-acceptance cache on the device, a marketing-lead copy of a form you just submitted, and accessibility preferences). These are not used to run a third-party advertising network on fittingsos.com.

You may block cookies in your browser. If you block session cookies, hosted sign-in will not work. Public pages remain readable.

We do not currently operate a non-essential advertising cookie banner because we do not run third-party ads on the public site. If that changes, we will update this Policy and, where required, obtain consent.

On the hosted shop UI, a notice asks before optional page-view analytics. Necessary session cookies stay on so sign-in and the shop book keep working if you choose necessary cookies only.

Quote and custom-project inquiries: retained as long as needed to respond and for a commercially reasonable period thereafter for operational and legal records (typically not more than twenty-four (24) months unless a longer period is required by a dispute, audit, or law).

Account identifiers, Terms-acceptance records, and security logs: retained for the life of the account and a commercially reasonable period after (Terms-acceptance rows are append-only evidence and are retained so we can show what instrument was signed).

Transactional email logs: retained as needed to prove send/fail-closed status; message bodies of invites and MFA codes are not kept as recoverable plaintext codes.

Customer Data: retained according to the Customer’s configuration and the Data Processing Agreement / exit schedule. When Provider hosts Customer Data, deletion or return on termination follows the DPA, except for backup or legal-hold copies as described there.

We may keep de-identified or aggregated information that is not personal information.

We implement administrative, technical, and organizational measures designed to protect personal information, described in more detail at /security and in the Data Processing Agreement. Those pages are posture statements, not certifications.

FittingsOS is not SOC 2 certified, not ISO 27001 certified, and not HITRUST certified. We do not claim AS9100 or Nadcap. No security measure is perfect. You are responsible for the security of accounts your organization issues, for shop-origin systems you control, and for not placing export-controlled technical data on the public cloud.

If you are a California resident, subject to CCPA exceptions, you may request: (a) to know the categories and specific pieces of personal information we have collected about you as a business; (b) to delete personal information we hold as a business; (c) to correct inaccurate personal information; (d) to opt out of sale or sharing (we do not sell or share, and this is a standing representation); and (e) not to be discriminated against for exercising CCPA rights.

Authorized agents may submit requests as CCPA allows; we will verify identity and authority before acting. We will not fulfill a request that would compromise the security of another user, a Customer’s Customer Data, or our systems, or that is manifestly unfounded.

Residents of other U.S. states with consumer privacy laws (including, as applicable, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and similar) may have comparable rights of access, deletion, correction, and appeal. We will honor applicable state law. Because FittingsOS is a B2B product, many records about shop employees are Customer Data under the employer’s control.

To exercise rights as to data we hold as a business (website inquiries, your operator account with us), email security@fittingsos.com from the address we have on file, or use the public contact form with the subject “Privacy request.” We will not require you to create an account solely to submit a privacy request about website data. We may need to verify your identity.

To exercise rights as to Customer Data your employer stored in FittingsOS, contact your employer. We will redirect you.

FittingsOS is offered from the United States to commercial shops. We do not presently target consumers in the EEA or UK. If you are in the EEA or UK and nonetheless use the site, our legal bases are: performance of a contract or steps at your request (inquiries, accounts); legitimate interests in securing and operating the service; and compliance with law. International transfers, if any, are to the United States. You may have rights of access, rectification, erasure, restriction, objection, and portability under GDPR, and the right to lodge a complaint with a supervisory authority. Contact security@fittingsos.com.

The website and Software are not directed to children. You must be at least eighteen (18) years of age to agree to the Terms of Service and to use the Software. We do not knowingly collect personal information from children under 16. If you believe we have, contact security@fittingsos.com and we will delete it.

Optional biometric or passkey unlock is a shop-configured feature. Do not enroll another person’s face, fingerprint, or passkey without a lawful basis and notice to that person. Provider does not sell biometric information. A Customer that enables biometrics is responsible for its own biometric policy, notices, and consents. Provider is not the shop’s employer.

Provider is not your Empowered Official. Classification under ITAR, EAR, or other export laws is the Customer’s responsibility. Export-controlled technical data, gold NC programs, and machine tapes are not to be placed on the public website or public forms and, in the product architecture, are intended to remain on the Customer/shop origin — off the public cloud.

Do not paste export-controlled technical data into a quote form, a support email to a public mailbox, or an AI prompt.

We do not make legally significant decisions about individuals solely by automated means in the consumer-credit or hiring sense. Abuse-prevention systems may automatically throttle or refuse traffic that appears to be an attack. That is security, not profiling of a natural person for advertising.

We may update this Policy. The version and effective date appear at the top of /privacy.

Material changes that affect Authorized User use of the Software (including changes to the categories we collect as a business, sale/share practices, or our role as to Customer Data) will be published with a new Policy version and will bump the Terms of Service instrument version (TERMS_VERSION). You must re-execute the click-wrap (typed legal name plus the agreement checkbox) before further use of the Software. Until you re-agree, access to the shop UI may be withheld.

For the public website only (pages that do not require an account): posting the updated Policy and your continued use after the effective date constitutes acceptance of the updated Policy as to that website activity. If you do not agree, stop using the public site.

We may also present a banner or email notice of a change. Notice is a courtesy; the version on /privacy controls.

Privacy and security contact: security@fittingsos.com. Provider: Montes Software LLC, Los Angeles County, California, United States, operating fittingsos.com.

Do not send export-controlled technical data, prints, or NC programs to that mailbox.

You may also use the public contact form on fittingsos.com. A form submission is an inquiry, not a guaranteed response time and not a shop ticket.

Nothing in this Policy is legal, export, or privacy-compliance advice to your organization. Your shop remains responsible for its own notices, consents, and quality system.