Privacy Policy
Effective 29 September 2026
Version 2026-09-29, effective 29 September 2026
1. Who we are
Fortbit d.o.o. (“Payload Stack”, “we”, “us”) is the controller of the personal data described in this policy, which covers the website at payloadstack.com (the “Site”). Our contact details:
Fortbit d.o.o.
Gradiščak 31A, 40313, Gradiščak, Croatia
Email: hello@payload.solutions
Website: https://fortbit.hr
We have not appointed a Data Protection Officer because we are not required to; the contact above handles all privacy requests.
Payload Stack is open-source software that you download and run on your own infrastructure. We do not receive any data from applications you build with it. This policy covers only the Site.
2. What we collect and why
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Technical data | IP address, browser and device information, requested page, time of the request | Deliver the Site, keep it secure, prevent abuse, fix problems | Legitimate interests (running a secure website, GDPR Art. 6(1)(f)) |
| Analytics data | pages visited, interactions such as copying the install command, referrer, approximate location derived from the IP address, error reports — only when you allow analytics cookies | Understand how the Site is used and improve it | Consent (Art. 6(1)(a)), withdrawable at any time |
| Correspondence | messages you send us by email and your email address | Answer your requests | Legitimate interests; steps at your request before entering into a contract (Art. 6(1)(b)) |
The Site has no user accounts, forms or payments, and we do not ask you for personal data to use it. We do not sell personal data. We do not use personal data to make automated decisions that have legal or similarly significant effects on you.
3. Cookies and similar technologies
We use cookies and comparable technologies. Necessary ones keep the Site working; others run only with your consent, which you can give or withdraw at any time through the “Cookie settings” link in the footer. The full list, with providers and durations, is in our Cookie Policy.
4. Who receives your data
We share personal data with the providers below. Processors act only on our instructions, under a written contract that binds them to confidentiality and appropriate security.
| Provider | Role | Purpose | Data | Location |
|---|---|---|---|---|
| PostHog (EU Cloud) | Processor | Product analytics hosted in the EU, only where analytics consent is given. | usage, technical | DE |
| Vercel | Processor | Website hosting, edge network and request logs. | technical | US |
We may also disclose personal data when the law requires it, to establish or defend legal claims, or to a buyer as part of a merger or acquisition — in which case this policy continues to apply until you are told otherwise.
The Site links to other websites, such as GitHub, the documentation at payload.solutions and the projects Payload Stack is built on. Once you follow a link, that website’s own privacy policy applies.
5. International transfers
Some of these providers process data outside the European Economic Area. Every such transfer rests on one of the safeguards in Chapter V of the GDPR, listed per provider below. You can ask us for a copy of the Standard Contractual Clauses we rely on at hello@payload.solutions.
| Provider | Location | Transfer basis |
|---|---|---|
| PostHog (EU Cloud) | DE | Standard Contractual Clauses |
| Vercel | US | Standard Contractual Clauses |
6. How long we keep data
| Data | Retention |
|---|---|
| Technical data and security logs | Up to 90 days |
| Analytics data | As set by the provider listed in the Cookie Policy, typically up to 14 months |
| Correspondence | Up to 24 months after the last message |
| Your consent choice | Stored only in your browser, in the cookie described in the Cookie Policy; we do not keep a copy |
7. Your rights
Depending on where you live you have the right to access, correct, delete, or receive a copy of your personal data, to restrict or object to certain processing, and to withdraw consent at any time without affecting processing that happened before. Write to hello@payload.solutions to exercise them; we respond within one month (extendable in complex cases as the law allows). You also have the right to lodge a complaint with your data protection authority; in Croatia that is the Personal Data Protection Agency (AZOP).
8. Security
We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit and access controls. No system is perfectly secure; if you suspect a problem, contact us immediately.
9. Children
The Site is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.
10. Changes to this policy
We may update this policy. The effective date at the top is updated when we do. Where a change affects consent-based processing, we will ask for your consent again.
11. Contact
Questions about this policy or your data: hello@payload.solutions.