FittingsOS Privacy Policy

Effective date: October 14, 2026
Policy version: 2026.10.14-1

This Privacy Policy (this “Policy”) describes how Montes Software LLC, a California limited liability company doing business as FittingsOS (“Provider,” “we,” “us,” or “our”), collects, uses, discloses, retains, and otherwise processes personal information in connection with fittingsos.com, the FittingsOS hosted user interface, related public pages, and (as described below) the hosted Software.

This Policy is a legally binding statement of our practices and, together with the FittingsOS Terms of Service (also called the Terms of Use and Terms and Conditions) and the Data Processing Agreement, forms part of the contract between Provider and each Authorized User and, as applicable, the Customer organization. Our Cookie and Tracking Notice and Subprocessors page supplement this Policy and form part of it.

This Policy is written for users and customers of a commercial shop-software product. FittingsOS is offered for legitimate internal business operations of machine shops and similar industrial users. It is not offered for personal, family, or household purposes.

If you do not agree with this Policy, do not use the website, do not submit a quote request, do not create an account, and do not sign in. First sign-in requires affirmative agreement to this Policy and the Terms of Service, and acknowledgement of the Data Processing Agreement, which binds the shop only when its named DPA Signer signs it. When we publish a new version of this Policy as part of a TERMS_VERSION change, you must re-agree before further use of the Software. Continued use of the public website after a posted update constitutes acceptance of the then-current Policy as to website activity that does not require an account.

This Policy is available in an accessible format. If you need it in an alternative format, see our Accessibility Statement or contact us as described in Section 19.

1. Who we are; roles

Business / controller of website, marketing, and account-administration data. Montes Software LLC, doing business as FittingsOS, operates fittingsos.com and the FittingsOS Software. For personal information we collect from you on the public website (including quote-request forms), for operator account identifiers we create to authenticate you, and for security logs of our own systems, we determine the purposes and means of processing and act as a “business” under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code § 1798.100 et seq.) (“CCPA”), and as a controller under other applicable laws.

Service provider / processor as to Customer Data. Job records, quality records, employee time, customer and vendor files, and other shop content that a Customer organization stores in FittingsOS (“Customer Data”) are processed by Provider on behalf of that Customer. As to Customer Data, the Customer is the “business” / controller, and Provider is a “service provider” (Cal. Civ. Code § 1798.140(ag)) / processor. Provider does not act as a CCPA “contractor” (Cal. Civ. Code § 1798.140(j)) for Customer Data; Provider processes Customer Data only to provide the Software to the Customer. The Data Processing Agreement governs that processing. Employee privacy requests about Customer Data should be directed to the employer first. We will not respond to a data-subject request about another company’s Customer Data except to redirect the requester, unless legally required.

No personal guaranty; no individual party. Members, managers, officers, employees, and contractors of Provider are not parties to this Policy in their individual capacities.

2. Scope; what this Policy does not cover

This Policy covers: (a) the public website at https://fittingsos.com and related public pages; (b) quote and custom-project inquiry forms; (c) hosted sign-in, invites, password reset, and email multi-factor authentication; (d) account identifiers and audit logs Provider maintains to operate the Software; and (e) Customer Data only to the extent Provider hosts it and only as a service provider, as described in the Data Processing Agreement.

This Policy does not cover: (a) a Customer’s own privacy practices toward its employees, contractors, suppliers, or customers; (b) data that remains on a Customer-controlled shop origin (including export-controlled technical data and gold NC programs that Customer keeps off public uploads); (c) third-party sites we link to; or (d) job-shop manufacturing of physical fittings. FittingsOS is software, not a machine shop.

Do not submit export-controlled technical data, prints, NC programs, classified information, government ID numbers, health information, or another person’s biometric identifiers on a public form. Public forms and fittingsos.com uploads are not a designated controlled channel. See Section 16.

3. California notice at collection

If you are a California resident, this section is our notice at collection under Cal. Civ. Code § 1798.100 and Cal. Code Regs. tit. 11, § 7012. It applies to personal information we collect as a business. For each category below, we state the sources, the purposes, the categories of recipients to whom we disclose it for a business purpose, and whether we sell or share it. Retention periods appear in Section 9.

We do not sell personal information. We do not “share” personal information for cross-context behavioral advertising. We have not sold or shared personal information in the preceding twelve (12) months. We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit under Cal. Civ. Code § 1798.121; we use it only as permitted to provide the Software and secure our systems (Cal. Code Regs. tit. 11, § 7027(m)).

We do not require Social Security numbers, driver’s licenses, financial account numbers, precise geolocation, or health data for core FittingsOS use. Do not submit those on a public form.

We do not offer financial incentives or price or service differences in exchange for personal information.

4. Information we collect and sources

You provide: name, company, work email, phone, and free-text notes on a quote or custom-project form; username, password, and typed legal name on sign-in and Terms acceptance; optional title and company on the signature card; content you or your shop store as Customer Data.

Your organization provides: invites (email, intended username, roles, shop); seat and role assignments; Customer Data the shop elects to store.

Automatic collection: IP address, user-agent, timestamps, referring URL, cookie or similar identifiers required to keep a session, Cloudflare Turnstile challenge tokens on hosted sign-in when enabled, and security logs. See our Cookie and Tracking Notice.

Service providers: our Subprocessors (listed on /subprocessors and summarized on /security) may process identifiers as needed to host the UI, tunnel the API, send transactional email, or provide DNS and WAF. They are not permitted to sell your information.

5. How we use personal information

We use personal information to: (a) operate, maintain, and secure the website and Software; (b) respond to quote and custom-project inquiries and follow up at the email you give us; (c) authenticate Authorized Users, enforce seats, and keep an audit trail of click-wrap acceptance; (d) send transactional messages (invites, password reset, email multi-factor codes); (e) detect, prevent, and investigate abuse, fraud, and security incidents; (f) comply with law and enforce our Terms of Service; (g) improve reliability of the public site (aggregated or de-identified where practicable); and (h) process Customer Data solely to provide the Software to that Customer, as a service provider.

We do not use public-site inquiry data to train public large-language models. Cloud AI features in the Software are off by default and must not receive gold NC, production G-code, prints, or export-controlled technical data.

A quote request submitted on the public form is an inquiry. It is not an offer, not a sales order, not a shop ticket, and not a contract to machine parts.

Email. We send transactional and relationship messages (such as invites, password messages, and replies to inquiries you submit). If we send commercial email, we will comply with the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (“CAN-SPAM,” 15 U.S.C. § 7701 et seq.), including by identifying ourselves, providing our postal address, and honoring requests to opt out of commercial messages. Opting out of commercial email does not stop transactional messages needed to operate your account.

6. De-identified and aggregated information

We may create and keep de-identified or aggregated information that is not personal information, including Aggregated Statistics as described in the Terms of Service. Where we hold de-identified information, we maintain it in de-identified form, do not attempt to re-identify it except as permitted by law, and contractually prohibit recipients from re-identifying it, consistent with Cal. Civ. Code § 1798.140(m).

7. Disclosure; Subprocessors; no sale or sharing

We disclose personal information to: (a) service providers / Subprocessors that host or operate the Software under contract (currently including, as applicable, Vercel for the shop UI; Cloudflare for DNS, WAF, API tunneling, and Turnstile; GitHub for source control and CI; Tailscale for remote access as applicable; Resend for transactional email; and, when a shop enables them, Intuit / QuickBooks Online for accounting sync and Plaid for bank linking); (b) the Customer organization that invited you, which can see your account activity inside that shop; (c) professional advisors under confidentiality; (d) a successor in a merger, financing, or sale of assets, subject to this Policy; and (e) authorities when we believe disclosure is required by law or to protect rights, safety, or security.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not disclose personal information to data brokers.

The current Subprocessor list and status (in use / as applicable / available when enabled) is published at /subprocessors and summarized at /security. Material additions that process personal information will be reflected there, with a fifteen (15) day Customer objection period under the Data Processing Agreement for new Subprocessors that Process Personal Data. As to Customer Data, the Data Processing Agreement’s Subprocessor mechanism, including the Customer objection right, also applies.

8. Cookies, local storage, and similar technologies

We use cookies and similar technologies that are reasonably necessary to operate the site and Software: httpOnly session cookies for hosted sign-in; CSRF tokens; and limited local or session storage (for example, a Terms-acceptance cache on the device, a marketing-lead copy of a form you just submitted, and accessibility preferences). These are not used to run a third-party advertising network on fittingsos.com.

You may block cookies in your browser. If you block session cookies, hosted sign-in will not work. Public pages remain readable.

We do not currently operate a non-essential advertising cookie banner because we do not run third-party ads on the public site. If that changes, we will update this Policy and, where required, obtain consent.

On the hosted shop UI, a notice asks before optional page-view analytics. Necessary session cookies stay on so sign-in and the shop book keep working if you choose necessary cookies only.

Global Privacy Control. We treat a Global Privacy Control signal as a valid request to opt out of sale and sharing for that browser, as required by Cal. Code Regs. tit. 11, § 7025. Because we do not sell or share personal information, honoring the signal does not change how the Site works.

Do Not Track. Because we do not track users across third-party websites for advertising, and no uniform standard for responding to “Do Not Track” browser signals has been adopted, the Site does not change its behavior in response to them (Cal. Bus. & Prof. Code § 22575(b)(5)).

Full details are in our Cookie and Tracking Notice.

9. Retention

We keep each category of personal information only as long as reasonably necessary for the purposes described in this Policy, consistent with Cal. Civ. Code § 1798.100(a)(3):

• Quote and custom-project inquiries: retained as long as needed to respond and for a commercially reasonable period thereafter for operational and legal records (typically not more than twenty-four (24) months unless a longer period is required by a dispute, audit, or law).
• Account identifiers, Terms-acceptance records, and security logs: retained for the life of the account and a commercially reasonable period after. Terms-acceptance rows are append-only evidence and are retained so we can show what instrument was signed.
• Transactional email logs: retained as needed to prove send or fail-closed status. Message bodies of invites and multi-factor codes are not kept as recoverable plaintext codes.
• Sensitive personal information: password hashes are retained for the life of the account; multi-factor codes are short-lived; biometric unlock templates, if a shop enables them, are retained according to the Customer’s configuration and deleted under the Data Processing Agreement.
• Customer Data: retained according to the Customer’s configuration and the Data Processing Agreement and exit schedule. When Provider hosts Customer Data, deletion or return on termination follows the DPA, except for backup or legal-hold copies as described there.

We may keep de-identified or aggregated information that is not personal information.

10. Security; security incidents

We implement administrative, technical, and organizational measures designed to protect personal information, described in more detail at /security and in the Data Processing Agreement. Those pages are posture statements, not certifications.

FittingsOS is not SOC 2 certified, not ISO 27001 certified, and not HITRUST certified. We do not claim AS9100, Nadcap, ISO, FAA, or EASA certification or approval. No security measure is perfect. You are responsible for the security of accounts your organization issues, for shop-origin systems you control, and for classifying data and keeping controlled technical data off public uploads.

If we discover a breach of the security of personal information we hold as a business, we will notify affected individuals and authorities as required by Cal. Civ. Code § 1798.82 and other applicable law. Security Incidents affecting Customer Data we host are reported to the Customer under Section 8 of the Data Processing Agreement. To report a suspected security issue, email security@fittingsos.com.

11. Your California privacy rights

If you are a California resident, subject to CCPA exceptions, you have the right to:

• Know and access the categories and specific pieces of personal information we have collected about you as a business, the categories of sources, the business purposes, and the categories of third parties to whom we disclosed it (Cal. Civ. Code §§ 1798.100, 1798.110);
• Delete personal information we hold about you as a business (Cal. Civ. Code § 1798.105);
• Correct inaccurate personal information (Cal. Civ. Code § 1798.106);
• Opt out of sale or sharing (Cal. Civ. Code § 1798.120). We do not sell or share personal information, and this is a standing representation;
• Limit the use of sensitive personal information (Cal. Civ. Code § 1798.121). We use sensitive personal information only for purposes that do not give rise to this right; and
• Non-discrimination and non-retaliation for exercising CCPA rights, including as an employee, applicant, or independent contractor (Cal. Civ. Code § 1798.125).

How to submit a request. For data we hold as a business (website inquiries, your operator account with us), email security@fittingsos.com with the subject line “Privacy request,” or use the public contact form on fittingsos.com with the subject “Privacy request.” We will not require you to create an account solely to submit a privacy request about website data.

Identity confirmation. We will confirm your identity before fulfilling a request to know, delete, or correct, generally by matching information you provide against information we already hold (for example, by responding from the email address we have on file). We will not ask for more information than reasonably necessary.

Authorized agents. An authorized agent may submit a request on your behalf as permitted by Cal. Code Regs. tit. 11, § 7063. We may require signed permission from you and may ask you to confirm your identity directly with us.

Timing. We will confirm receipt of a request to know, delete, or correct within ten (10) business days and respond within forty-five (45) calendar days. If we need more time, we will notify you and may extend once by up to an additional forty-five (45) days, as permitted by Cal. Civ. Code § 1798.130.

Limits. We will not fulfill a request that would compromise the security of another user, a Customer’s Customer Data, or our systems, or that is manifestly unfounded or excessive. If we deny a request in whole or part, we will explain why.

Customer Data. To exercise rights as to Customer Data your employer stored in FittingsOS, contact your employer. We will redirect you, and we will assist the Customer as described in the Data Processing Agreement.

Shine the Light. California Civil Code § 1798.83 permits California residents to request information about disclosure of personal information to third parties for their direct-marketing purposes. We do not disclose personal information to third parties for their own direct-marketing purposes.

12. Other U.S. state privacy rights

Residents of other U.S. states with consumer privacy laws (including, as applicable, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and similar) may have comparable rights of access, deletion, correction, portability, and opt-out. We will honor applicable state law. Because FittingsOS is a business-to-business product, many records about shop employees are Customer Data under the employer’s control.

Appeals. If we decline to take action on a request, you may appeal by replying to our decision or emailing security@fittingsos.com with the subject line “Privacy appeal.” We will respond to an appeal within the period required by your state’s law and explain our decision. If your appeal is denied, you may contact your state attorney general.

13. EEA / UK individuals (limited)

FittingsOS is offered by a United States company to commercial shops. Hosting and processing are oriented to the United States as described in Section 12 of the Data Processing Agreement; edge TLS termination may occur at global CDN points of presence. We do not presently target consumers in the EEA or UK. If you are in the EEA or UK and nonetheless use the site, our legal bases are: performance of a contract or steps at your request (inquiries, accounts); legitimate interests in securing and operating the service; and compliance with law. Personal information Provider processes as a business is handled with United States–oriented hosting as described in the Data Processing Agreement; edge TLS may terminate at global CDN points of presence. For Customer Data, Section 12 of the Data Processing Agreement describes transfer mechanisms available on request. You may have rights of access, rectification, erasure, restriction, objection, and portability under the GDPR, and the right to lodge a complaint with a supervisory authority. Contact security@fittingsos.com.

14. Children

The website and Software are not directed to children. You must be at least eighteen (18) years of age to agree to the Terms of Service and to use the Software. We do not knowingly collect personal information from children under sixteen (16), and we do not sell or share personal information of consumers under sixteen (16). If you believe we have collected personal information from a child, contact security@fittingsos.com and we will delete it.

15. Biometrics

Optional biometric or passkey unlock is a shop-configured feature. Do not enroll another person’s face, fingerprint, or passkey without a lawful basis and notice to that person. Provider does not sell biometric information. A Customer that enables biometrics is responsible for its own biometric policy, notices, and consents. Provider is not the shop’s employer.

16. Export-controlled and restricted data

Provider is not your Empowered Official. Classification under the International Traffic in Arms Regulations (22 C.F.R. Parts 120–130), the Export Administration Regulations (15 C.F.R. Parts 730–774), or other export laws is the Customer’s responsibility. Customer must keep controlled technical data and gold NC programs on the Customer/shop origin and off public uploads to fittingsos.com. Global CDN and edge points of presence may terminate TLS in transit; Provider does not claim United States–only residency for all bytes in transit, and public cloud paths are not a designated controlled channel.

Customer portal uploads. Every customer-portal upload asks whether the file is ITAR or EAR controlled technical data. If the uploader answers yes, or if the filename or title contains “ITAR” or “EAR,” fittingsos.com refuses the upload and points the uploader to the shop’s controlled channel. After an uploader answers no, any on-screen label reflects that person’s own declaration only. Provider does not classify the file as cleared, not ITAR, or commercial.

Do not paste export-controlled technical data into a quote form, a support email to a public mailbox, or an AI prompt.

17. Automated decision-making

We do not make legally significant decisions about individuals solely by automated means in the consumer-credit or hiring sense. Abuse-prevention systems may automatically throttle or refuse traffic that appears to be an attack. That is security, not profiling of a natural person for advertising.

18. Changes; re-agreement; agreement by use

We may update this Policy. The version and effective date appear at the top of /privacy. We review this Policy at least once every twelve (12) months, as required by Cal. Civ. Code § 1798.130(a)(5).

Material changes that affect Authorized User use of the Software (including changes to the categories we collect as a business, sale or share practices, or our role as to Customer Data) will be published with a new Policy version and will change the Terms of Service instrument version (TERMS_VERSION). You must re-execute the click-wrap (typed legal name plus the agreement checkbox) before further use of the Software. Until you re-agree, access to the shop UI may be withheld. We will not begin selling or sharing personal information, or use personal information for a materially different purpose, without first updating this Policy and providing any notice or obtaining any consent the law requires.

For the public website only (pages that do not require an account): posting the updated Policy and your continued use after the effective date constitutes acceptance of the updated Policy as to that website activity. If you do not agree, stop using the public site.

We may also present a banner or email notice of a change. Notice is a courtesy; the version on /privacy controls.

19. Contact; complaints

Privacy and security contact: security@fittingsos.com.

Provider: Montes Software LLC, doing business as FittingsOS, 5392 Corradi Ter, Acton, CA 93510, United States, operating fittingsos.com.

Do not send export-controlled technical data, prints, or NC programs to that mailbox.

You may also use the public contact form on fittingsos.com. A form submission is an inquiry, not a guaranteed response time and not a shop ticket.

California residents may also contact the California Privacy Protection Agency (cppa.ca.gov) or the California Attorney General.

This Policy describes Provider’s practices. Your shop remains responsible for its own notices, consents, and quality system.

20. Related pages

• Terms of Service
• Data Processing Agreement
• Security
• Subprocessors
• Cookie and Tracking Notice
• Accessibility Statement