Fortis-Stack Inc. and its product Xale (Xale Sales Tracker)
Effective date: 26 August 2026
This Privacy Policy explains how Fortis-Stack Inc. (“Fortis-Stack”, “we”, “us”, or “our”) collects, uses, shares, stores, and protects personal information through:
We have written this policy in plain language so that ordinary business owners across Africa can understand it. Where a section describes legal requirements under Nigerian law, we say so. Where we describe additional good practice that goes beyond what the law strictly requires, we say that too.
By using our website or Xale, you agree to the practices described in this policy. If you do not agree, please do not use our services.
Fortis-Stack Inc. is a software company that builds structured, data-driven software systems for businesses, with a focus on African markets. Our first product, Xale (Xale Sales Tracker), helps businesses track sales, revenue, profit and loss, products and inventory, payments, and receive analytics and AI-assisted business insights.
Depending on how you use our services, Fortis-Stack may act as either a data controller (deciding why and how personal data is processed) or a data processor (processing personal data on behalf of a business that uses Xale). This is explained further in Section 29.
This policy applies to:
This policy does not cover the practices of third parties whose services we use (such as Calendly, WhatsApp, or cloud and payment providers). Those services have their own privacy policies, which we encourage you to review.
The information we handle falls into the categories below. Not all categories apply to every user. For the Fortis-Stack website, we collect very little (see Sections 5 and 6). For Xale, we collect more, because the product is designed to store your business records.
You may choose to share information with us directly, for example when you:
The Fortis-Stack portfolio website does not use contact forms that store your information on our servers. When you reach us through WhatsApp, email, phone, or Calendly, your information is handled by those communication channels and providers, and we receive it so we can respond to you.
When you use our website or Xale, some technical information is collected automatically to keep the service working, measure performance, and protect against abuse. This may include IP address, device and browser type, pages or screens viewed, and similar diagnostic data.
On the Fortis-Stack portfolio website, we do not currently run third-party advertising or analytics tracking scripts. If we add any such tools in future, we will update this policy and, where required, request your consent.
Within Xale, automatic technical and usage data is collected as part of operating the product. Xale does not currently use third-party advertising or analytics tools; we collect limited internal technical and usage logs to operate and secure the product.
We use personal data to:
We do not use your personal information for purposes that are incompatible with those described here without informing you first.
Under the Nigeria Data Protection Act, 2023 (the “NDPA”), personal data must be processed lawfully, fairly, and transparently. We rely on the following lawful bases, depending on the situation:
Where we rely on consent, you may withdraw it at any time (see Section 25). Withdrawing consent does not affect processing that already took place.
Xale is designed to store the business records you choose to enter. This includes information about your own customers when you record their sales, payments, or contact details.
When you use Xale to process personal data about other people (such as your customers), you are usually the data controller for that information, and Fortis-Stack acts as your data processor. This relationship, and our obligations to protect that data and act only on your instructions, are described in Section 28 and (where applicable) in a Data Processing Addendum, which is available on request.
You are responsible for having a lawful basis (such as consent or contract) to collect and process your customers’ personal data within Xale.
Xale offers AI-assisted business insights. To provide these features, the data you submit (such as your sales and inventory records) may be processed by AI models or services to generate summaries, predictions, or recommendations.
AI features are provided to help you make decisions; they are decision-support tools and are not a substitute for your own judgement. We aim to make AI outputs clear about their basis where feasible.
We want to be transparent about whether personal data submitted to Xale is used to train or improve AI models. Because this depends on the specific AI providers and configuration we use, we state it plainly below:
We do not use your personal or business data to train or fine-tune our own AI models, and Xale does not build or train its own models. The data you submit to AI-assisted features (such as your sales, revenue, products, customer names, and business goals) is sent to our AI sub-processor, Groq, which serves the Llama 3.1 8B Instant model, solely to generate the insights you request.
Groq’s API terms prohibit training on customer API data by default, so your inputs are not used to train Groq’s models. You can review Groq’s privacy terms at groq.com/privacy-policy.
If you are unsure how a specific AI feature handles your data, contact us using the details in Section 34 before using it.
We use trusted third-party providers to operate our services. We require them to handle personal data only as needed to provide their service and in line with applicable data-protection law. Providers may include:
Where a provider processes personal data on our behalf, we put appropriate contractual safeguards in place. This policy does not cover the independent practices of those providers.
Xale uses Paystack to collect subscriptions and other payments. Payment information is handled by Paystack, not directly by Fortis-Stack. You should review Paystack’s privacy policy for details of how it handles your payment data. Xale stores records of your subscription and billing status (such as plan, dates, and amounts) needed to operate your account, while sensitive card or bank details are processed and stored by Paystack.
Xale runs on cloud hosting and CDN infrastructure provided by Cloudflare and Render. This means personal data entered into Xale may be stored and processed in the infrastructure operated by those providers. Where data is hosted outside Nigeria (for example, on infrastructure in regions outside Africa), see Section 21 on international transfers.
The Fortis-Stack portfolio website does not currently use third-party analytics. Within Xale, we do not currently use third-party analytics or product-monitoring tools; we rely on internal technical and usage logs. If we add such tools in future, we will disclose them here and obtain consent where required.
AI-assisted features in Xale are powered by the Llama 3.1 8B Instant model, served through Groq’s API. When you use an AI feature, the relevant inputs may be sent to Groq to generate a result. Groq’s own privacy and usage terms apply to that processing. See Section 11 for how we address model training.
We may disclose personal data where we believe it is necessary to:
If Fortis-Stack is involved in a merger, acquisition, financing, reorganisation, or sale of assets, personal data may be transferred as part of that transaction. We will ensure, where practicable, that the recipient is bound by data-protection commitments consistent with this policy. You will be notified if your personal data becomes subject to a materially different privacy policy.
Because we use global cloud and AI providers, personal data may be transferred to and processed in countries outside Nigeria, including outside Africa. Under the NDPA, personal data may only be transferred outside Nigeria where there are adequate safeguards (for example, contractual clauses or the receiving country being recognised as providing adequate protection).
We will put appropriate safeguards in place for international transfers and will comply with the NDPC’s requirements for cross-border transfers. Transfers are protected through our providers’ technical and organisational measures and, where required, contractual safeguards consistent with NDPC guidance. Hosting regions include those operated by Cloudflare and Render, which may process data outside Nigeria.
For users in other African countries, we will also respect any local rules that apply to cross-border transfers of personal data.
We use technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or misuse. These measures include access controls, encryption in transit (HTTPS/TLS), secure hosting on Cloudflare and Render, token hashing (refresh tokens are hashed with SHA-256 before storage in MongoDB), and monitoring. We review and improve these measures on an ongoing basis.
No online service can be guaranteed 100% secure. We work to protect your data, but we cannot promise absolute security. You can help by keeping your account credentials confidential and notifying us of any suspected breach.
We keep personal data only for as long as necessary to provide our services and to meet legal, accounting, or reporting obligations.
When personal data is no longer needed, we delete or anonymise it using reasonable measures.
If you are in Nigeria, or your personal data is processed under Nigerian law, the NDPA gives you the following rights (set out in Part V of the Act):
These rights are not absolute and may be limited where the law allows (for example, where we must keep records to comply with tax law). We will respond to valid requests within the timeframes required by the NDPA (generally not more than one month, with a possible extension for complex requests).
If you are in another African country, similar rights may apply under local law (for example, South Africa’s POPIA, Kenya’s Data Protection Act, or Ghana’s Data Protection Act). We will respect the rights granted to you under the law that applies to you.
To exercise any of the rights above, contact us using the details in Section 34. Please tell us:
We may need to verify your identity before acting on a request. There is normally no fee, though we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive, as permitted by law.
You may specifically request:
You can request deletion of your Xale account and the personal data associated with it. Xale does not currently offer self-service account deletion, so to delete your account please contact us using the details in Section 34. We will delete or anonymise the data within a reasonable period, subject to legal obligations to retain certain records.
Xale does not currently provide a self-service data-export feature. If you would like a copy of your personal or business data, contact us using the details in Section 34 and we will provide it where we can.
Xale is intended for businesses and is not directed at children. You must be at least 18 years old to use Xale. Under the NDPA, a child is a person under 18, and processing a child’s personal data requires the consent of a parent or guardian.
We do not knowingly collect personal data from children without appropriate consent. If you believe a child’s data has been provided to us without proper consent, contact us and we will delete it.
Many Xale users are businesses that enter personal data about their own customers, suppliers, or staff. In those cases:
We will assist you, where we reasonably can, to respond to your customers’ data-protection requests, in line with our Data Processing Addendum, which is available on request.
Whether Fortis-Stack is a controller or processor depends on the context:
As a processor, we will: process data only on documented instructions, impose confidentiality on staff, apply appropriate security, assist with data-subject requests and breach notification, and delete or return data at the end of the service (subject to legal retention).
If you are not satisfied with how we handle your personal data, you can complain to us using the contact details in Section 34. We will investigate and respond.
You also have the right to complain to the Nigeria Data Protection Commission (NDPC), the authority that oversees data protection in Nigeria (website: https://ndpc.gov.ng). Users in other African countries may also contact their local data-protection authority.
We are committed to handling personal data responsibly. Under the NDPA, controllers of “major importance” must register with the NDPC and appoint a Data Protection Officer (DPO). We will do so if and when our processing meets that threshold.
For privacy questions or to exercise your rights, contact our privacy team at:
We may update this policy from time to time as our services change or as the law develops. When we make material changes, we will update the effective date above and, where appropriate, notify you (for example, by posting a notice or emailing account holders). We encourage you to review this page periodically.
This Privacy Policy is effective as of 26 August 2026.
You can reach Fortis-Stack Inc. at: