URSA Secure
Back to Legal

Privacy Policy

Last updated July 7, 2026

Last Updated: July 7, 2026

FMToolkit and its related services, products, software, and content (the "Services" or the "Platform") are owned and operated by URSA, Inc. ("URSA," "our," "us," "we"), a New Hampshire corporation with its principal place of business in Exeter, New Hampshire. URSA has adopted this Privacy Policy ("Privacy Policy") to inform you that it collects Personal Information when you use the Services and to explain how this information is used. This Privacy Policy applies to all online interactions with URSA-owned or managed services and does not cover our offline data practices. Your Personal Information is not shared with unrelated third-party businesses except as expressly set forth in this Privacy Policy. You should contact URSA directly with any questions or concerns at [email protected].

URSA MAY CHANGE, MODIFY, AMEND, SUSPEND, TERMINATE, OR REPLACE THIS PRIVACY POLICY FROM TIME TO TIME IN ITS SOLE AND ABSOLUTE DISCRETION. IF URSA CHANGES THIS PRIVACY POLICY, THE LAST UPDATED DATE ABOVE WILL CHANGE. YOUR CONTINUED USE OF THE SERVICES AFTER A CHANGE IN THE LAST UPDATED DATE CONSTITUTES YOUR ASSENT TO THE CHANGE. MATERIAL CHANGES WILL BE COMMUNICATED TO YOU VIA EMAIL OR PROMINENT NOTICE ON THE PLATFORM WHERE REQUIRED BY APPLICABLE LAW.

Definitions

  • California Consumer Privacy Act ("CCPA") means the California statute, as amended by the California Privacy Rights Act ("CPRA"), intended to enhance privacy rights and consumer protection for residents of California.

  • General Data Protection Regulation ("GDPR") means the European Union law on data protection and privacy applicable to individuals within the European Economic Area ("EEA").

  • Personal Data under the GDPR means any information relating to an identified or identifiable natural person.

  • Personal Information under the CCPA means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. For purposes of this Privacy Policy, "Personal Data" is included within this definition.

  • Florida Digital Bill of Rights ("FDBR") means the Florida statute governing the processing of personal data of Florida residents.

  • Customer Code means source code and related materials that you upload to the Services for analysis, as further described in the Services' Terms of Service.

  • Account means a Registered User's account with the Services.

  • Registered User(s) means Users who have created an Account.

  • User(s) means individuals who visit, access, or use the Services, including Registered Users.

  • You / Your means User(s).

Types of Personal Information We Collect

URSA collects the following Personal Information from Users who contact URSA or create an Account with the Services:

  • First name;
  • Last name;
  • Email address;
  • Company or organization name;
  • Payment and billing information, which is collected and processed by our payment processor to establish billing, including for free-plan accounts that are required to provide a payment method. URSA does not store your full payment card number; and
  • Any other information that you submit to URSA when you contact us or create or maintain an Account.

In addition, URSA collects the following information from all Users automatically:

  • Your IP address;
  • Your browser and device information, including device type, operating system version, and identifiers;
  • Your usage of the Services, including pages or features accessed, actions taken, and related statistics; and
  • Information stored in cookies and similar technologies, as described below.

Customer Code that you upload to the Services is your content and is handled as described in the section titled Customer Code Handling below. Customer Code may incidentally contain Personal Information; URSA does not use Customer Code except to provide the Services and does not retain it after processing, as described below.

Automated Processing

URSA processes Customer Code through automated systems, including formal verification techniques, in order to provide the Services and generate results. URSA does not use Customer Code to train any artificial intelligence or machine learning models. You should not upload Customer Code containing sensitive categories of data unless strictly necessary for your use of the Services.

Sources of Personal Information Collection

URSA may collect Personal Information from you through various channels, including your voluntary submission of information to the Services, requests initiated by you through the Services, the collection and analysis of information concerning your device and activity, the use of cookies and similar technologies, and other sources permitted by law.

Cookies and Similar Technologies

The Services use cookies and similar technologies, including pixel tags and web beacons ("Tracking Technologies"), to recognize your browser, deliver features, and analyze usage. You can use controls in your internet browser to limit or block cookies and to withdraw consent, and you can opt out of non-essential cookies where a cookie notification is presented. The table below describes how we use different categories of cookies and your options for managing them.

Type of Cookie Description Managing Settings
Required Cookies (Strictly Necessary) Required cookies enable you to navigate the Services, authenticate, and use core features. Because required cookies are essential to operate the Services, there is no option to opt out of these cookies.
Functional Cookies (Non-Strictly Necessary) Functional cookies remember information you have entered or choices you make and provide enhanced, more personal features. To manage functional cookies, consult your individual browser settings. Note that opting out may affect the functionality you receive when using the Services.

Lawful Basis for Processing Your Personal Information

The lawful basis for processing your Personal Information for the uses described in this Privacy Policy will typically be because: you have provided your consent; the processing is necessary for our contractual relationship with you; the processing is required for us to comply with our legal obligations; and/or the processing is in our legitimate interest of providing, securing, and improving the Services.

How URSA Uses Your Personal Information

We use your Personal Information to provide the Services, process requests made by you, communicate with you, identify and fix problems with the Services, and update you regarding changes to the Services. By using the Services, you further authorize the following uses of your Personal Information:

  • Enable your use of the Services and associated features;
  • Authenticate Accounts and maintain security;
  • Set up and process billing and payments, including through our third-party payment processor;
  • Operate, maintain, and improve the Services;
  • Measure and analyze usage of the Services;
  • Develop new features;
  • Contact and communicate with you regarding your Account, the Services, and support, whether through email or messages within the Services;
  • Provide you with technical service and support, including updates;
  • Detect, prevent, and respond to fraud, abuse, security incidents, and violations of the Terms of Service, including violations of export-control obligations;
  • Comply with legal obligations and enforce our agreements; and
  • Understand your needs and requests.

Sharing of Your Personal Information

URSA shares your Personal Information with third parties only in the following circumstances:

  • Where URSA has obtained your consent;
  • With service providers and subprocessors that assist us in operating and securing the Services, including hosting and cloud infrastructure providers, under obligations of confidentiality and consistent with this Privacy Policy;
  • With URSA's parents, subsidiaries, successors, assigns, affiliates, or business partners as necessary to provide the Services;
  • In connection with a merger, acquisition, financing, or sale of all or a portion of URSA's business or assets;
  • To respond to requests by government authorities, a court order, or subpoena;
  • Where needed to protect the rights, property, or safety of URSA, its personnel, Users, or third parties, or to prevent fraud or violation of applicable law; and
  • Where URSA is otherwise legally obligated to share your Personal Information.

URSA does not sell your Personal Information. URSA shares your Personal Information with the following categories of third parties:

  • Google Cloud Platform, for hosting and infrastructure;
  • Auth0 by Okta, for authentication;
  • Stripe, for payment processing;
  • Zuplo, for API gateway and key management;
  • Resend, for transactional email delivery; and
  • Cloudflare, for content delivery and security.

Each provider operates under its own privacy policy. This list may not be exhaustive as to all third parties with which URSA may share your Personal Information. URSA is committed to keeping track of which third parties receive your Personal Information.

Payment Information

URSA does not directly store your full payment card information. Payments are processed by Stripe, a third-party payment processor. Your payment information is shared with Stripe solely to establish and complete transactions, including the storage of a payment method for accounts that provide one on a free plan. Please review Stripe's privacy policy for information on how it handles your payment data. URSA is not responsible for the data practices of its payment processor.

Customer Code Handling

Customer Code that you upload to the Services is processed in memory only, within an ephemeral, containerized execution environment, for the duration of the applicable analysis. URSA does not retain, store, persist, archive, or back up the contents of Customer Code after the analysis completes, and URSA does not use Customer Code to train, fine-tune, or improve any artificial intelligence or machine learning model. URSA maintains operational metadata, such as timestamps and account identifiers, that does not include the contents of Customer Code. URSA treats Customer Code as confidential and discloses it only to subprocessors that assist in providing the Services under obligations of confidentiality, or as required by law.

No Liability for Third-Party Services and Links

Third-party service providers affiliated with URSA have their own independent privacy policies, and we encourage you to review them. You understand that even if URSA deletes your Personal Information, it may still be available in a third-party service provider's database. URSA has no responsibility or liability for the Personal Information collection, use, or storage activities of the third-party service providers used to provide the Services. URSA may include or offer third-party links on the Services; these third-party websites have separate and independent privacy policies, and URSA has no responsibility or liability for their content or activities.

Personal Information Transfer and Storage

Your Personal Information is stored and processed on computers and servers in the United States. Data protection laws vary among countries. Regardless of where your information is stored and processed, we apply the protections described in this Privacy Policy. Through your use of the Services, you consent to the processing and storage of your Personal Information in the United States, and you understand that your Personal Information may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction. If you are located outside the United States and choose to provide Personal Information to us, we transfer your Personal Information to the United States and process it here.

Data Retention

URSA retains your Personal Information only for as long as necessary to fulfill the purposes described in this Privacy Policy, maintain your Account, comply with our legal obligations, resolve disputes, and enforce our agreements, unless a longer retention period is required or permitted by law. When your Personal Information is no longer required for these purposes, we will securely delete or anonymize it. As described in the section titled Customer Code Handling, URSA does not retain Customer Code after it has been processed to provide the Services. You may request deletion of your Personal Information as described herein. Even after deletion, some information may be retained in backup systems or third-party service provider databases, subject to their own retention policies.

Personal Information Security

URSA implements reasonable administrative, technical, and organizational safeguards designed to protect your Personal Information from unauthorized access, use, disclosure, alteration, or destruction. These measures include, as appropriate, encryption of data in transit and at rest, access controls, and regular security assessments. Though we undertake commercially reasonable efforts to protect your information, no service is completely secure, and you provide all information at your own risk. URSA does not guarantee the absolute security of your Personal Information. If you believe your Account has been compromised, please contact us immediately at [email protected].

No Users Under Age 18

The Services are not intended for or directed to users under the age of 18, and URSA does not knowingly collect Personal Information from minors. If URSA discovers that Personal Information has been collected from a minor under the age of 18, we will promptly deactivate the Account and delete the associated Personal Information. If you are a parent or guardian and believe a minor has provided Personal Information to URSA, please contact us immediately at [email protected].

General Privacy Rights

Depending on your jurisdiction, you may have the following rights with respect to your Personal Information.

EU/EEA Users' Rights Under the GDPR

The GDPR provides Users located in the European Economic Area (EEA) with certain rights with respect to their Personal Data collected by us. URSA recognizes and will comply with the GDPR and those rights, except as limited by applicable law. The rights under the GDPR include:

  • Right of Access: the right to obtain confirmation of whether your Personal Data is being processed, along with the purposes of the processing, the categories of Personal Data concerned, the recipients to whom your Personal Data has been disclosed, and the period for which your Personal Data is stored.
  • Right of Rectification: the right to correct inaccurate Personal Data collected or stored by us.
  • Right of Erasure ("Right to be Forgotten"): the right to have your Personal Data deleted, subject to applicable law. Where deletion is required, fulfilling your request may prevent you from using the Services and may result in closing your Account.
  • Right to Restriction of Processing: the right to request restriction of how and why your Personal Data is used or processed by us.
  • Right to Data Portability: the right to receive your Personal Data in a structured, commonly used, machine-readable format and to have it transferred.
  • Right to Object: the right to object to our processing of your Personal Data, including for direct marketing purposes and for scientific or historical research or statistical purposes.
  • Right to not be Subject to Automated Decision-Making: the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects concerning you.
  • Right to Lodge a Complaint: the right to lodge a complaint with the supervisory authority in the EEA member state of your habitual residence, place of work, or place of the alleged infringement.

To exercise your rights under the GDPR, contact URSA at [email protected]. URSA will respond to verified requests within the timeframes required by applicable law, generally within one month of receipt, with the possibility of a two-month extension where permitted by law.

California Users' Rights (CCPA/CPRA)

Under the CCPA, as amended by the CPRA, California Users have the following rights:

  • Right to Know About Personal Information Collected, Disclosed, or Sold: the right to request that URSA disclose the categories and specific pieces of Personal Information it has collected about you, the categories of sources, the purposes for collection, and the categories of third parties with which it is shared.
  • Right to Request Deletion of Personal Information: the right to request that URSA delete Personal Information it collected from you, subject to legal exceptions.
  • Right to Correct Inaccurate Personal Information: the right to request that URSA correct inaccurate Personal Information it maintains about you.
  • Right to Opt-Out of the Sale or Sharing of Personal Information: URSA does not sell Personal Information and does not share Personal Information for cross-context behavioral advertising. You nonetheless have the right to opt out of any such sale or sharing.
  • Right to Limit the Use of Sensitive Personal Information: the right to direct URSA to limit its use of sensitive Personal Information to that which is necessary to provide the Services.
  • Right to Non-Discrimination: URSA will not discriminate against you for exercising your rights under the CCPA.

California residents may also request, once per year and free of charge, information about Personal Information disclosed to third parties for those third parties' own direct marketing purposes under California's "Shine the Light" law (Cal. Civ. Code Section 1798.83). URSA does not disclose Personal Information to third parties for their direct marketing purposes. To exercise your rights, or to have an authorized agent exercise your rights on your behalf, submit a request to URSA at [email protected]. URSA will verify your request by matching the information provided against our records and will respond within 45 days of receipt, with the possibility of a 45-day extension where permitted by law.

Supplemental Notice for Residents of Other U.S. States

Florida Digital Bill of Rights (FDBR). Florida residents have rights under the Florida Digital Bill of Rights with respect to their personal data processed by URSA, including the rights to confirm, access, correct, delete, and obtain a portable copy of their personal data, and to opt out of the processing of personal data for the purposes of targeted advertising or profiling. URSA does not sell personal data and does not engage in targeted advertising or profiling that produces legal or similarly significant effects. Florida residents may exercise their rights by contacting us as set forth herein.

Colorado, Virginia, Connecticut, Texas, and Other State Residents. Residents of Colorado (Colorado Privacy Act), Virginia (VCDPA), Connecticut (CTDPA), Texas (TDPSA), Montana, Oregon, Iowa, and other states with applicable privacy laws may have rights regarding their Personal Information, including rights to access, correct, delete, and port their Personal Information, and to opt out of targeted advertising, the sale of Personal Information, and profiling in furtherance of decisions that produce legal or similarly significant effects. URSA does not sell Personal Information and does not engage in such profiling without consent. To exercise your rights under applicable state privacy laws, contact URSA at [email protected]. We will process requests consistent with applicable law and respond within the timeframe required by the applicable statute.

Notice to Nevada Residents

Under Nevada Revised Statutes Chapter 603A, certain Nevada consumers may opt out of the sale of Personal Information for monetary consideration. URSA does not engage in such sales. If you are a Nevada resident and wish to submit an opt-out request, you may do so by contacting us at [email protected].

Purchase or Sale of the Services or Other Assets

URSA may purchase other businesses or sell components of its business, including the Services. In that event, your Personal Information will continue to be used consistent with this Privacy Policy, and we will provide notice before your Personal Information becomes subject to a materially different privacy policy.

How to Stop URSA from Collecting Your Personal Information

You can stop URSA from collecting your Personal Information, or have your Personal Information deleted, by contacting URSA at [email protected] and requesting that URSA stop collecting or delete your Personal Information. You can also adjust your browser settings to limit or turn off cookies or other tracking technologies, or cease use of the Services. URSA honors Do Not Track requests and signals. Deleting your Account may require deletion of certain information necessary to maintain Account functionality, and some information may be retained in backup systems or third-party service provider databases subject to their own retention policies.

Your Obligations

When using the Services, you are obligated to inform URSA of any changes to your Personal Information.

Contact and Notices

All questions, concerns, data requests, or privacy-related inquiries regarding this Privacy Policy may be submitted to URSA at:

URSA, Inc. 38A Cross Road, Exeter, New Hampshire 03833 [email protected]