Privacy Policy

Privacy Policy

Applied Math Group LLC |
Effective date: October 12, 2026 |
Last updated: October 12, 2026

Summary

Please read this policy carefully. If you do not agree with the terms of this privacy policy, please do not access the Service.

This is the short version. The full policy follows.

  • Who we are. Applied Math Group LLC (“we,” “us”) is a Massachusetts company. We run FernOpt (the “Service”), an optimization problem-solving platform sold only to businesses, and the website at fernopt.ai.
  • What we collect. Contact, account, billing, and support details; website analytics; and statistics about how the Service runs. Our customers also upload problems and data (“Customer Content”), which we process on their behalf.
  • What we don’t do. We don’t sell personal data. We don’t share it for cross-context behavioral advertising. We never use Customer Content to train any AI or machine-learning model or any solver.
  • Who sees it. Service providers that help us run the business, listed on our public subprocessor page, and others only in the limited cases described below.
  • How long we keep it. Customer Content stays for the life of the subscription and for six months after it ends. Other records follow the schedule in Section 7.
  • Your choices. You can ask to see, correct, or delete your information, and more. Email privacy@fernopt.ai.

1. Who this policy covers, and our role

This policy covers our website, demo scheduling, sales and support, billing, and the Service. A “Customer” is a business that subscribes to the Service. We sell only to businesses and do not offer consumer accounts, so most of the personal data we hold is business contact information for people acting on behalf of their employers.

We play two different roles:

  • Controller. For website visitors, demo requests, accounts, billing, support, and usage data, we decide how and why personal data is used. This policy describes those practices.
  • Processor. For personal data inside Customer Content, we act only on the Customer’s instructions, as the Customer’s processor or service provider. Our Data Processing Addendum (DPA) governs that work. If this policy and the DPA differ on personal data in Customer Content, the DPA controls.

2. Information we collect

Website visitors. IP address, device and browser details, pages viewed, referring page, and cookie data collected through Google Analytics.

Demo requests. Name, work email, company, role, and any notes you add, collected through our Cal.com scheduling link. Cal.com’s own privacy policy covers what you enter on its pages.

Prospects and business contacts. Business contact details for people we may want to reach about FernOpt: name, work email, work phone, company, role, and public professional profile details. We may get these from public sources, professional networks, events, referrals, and business-contact data providers.

Newsletter sign-ups. If we offer a newsletter or similar updates, your email address, name, and subscription choices.

Accounts. Name, work email, and role. We use Amazon Web Services (AWS) and Amazon Cognito to securely manage user authentication and sign-in services.

Billing. Billing contact and address. Card payments are handled by Stripe. We do not store card numbers.

Support. Emails and in-app form messages you send us, and whatever you choose to include in them.

Customer Content. Any content, files, or data you upload, input, or generate while using the software platform features. Our Terms of Service ask Customers not to submit sensitive categories such as protected health information, Personally Identifiable Information (PII), payment card data, government ID numbers, biometric data, children’s personal data, or export-controlled technical data unless we have agreed otherwise in writing.

Usage data. Statistics about problem size and structure, run timings, and outcomes. This is information about how the Service performs, not the content of a Customer’s problems or data. When it is tied to a user or account, it can be personal data.

3. How we use information

We use information to:

  • provide, secure, and maintain the Service;
  • bill Customers and manage accounts;
  • support Customers and answer questions;
  • send account communications, such as service notices, security alerts, and changes to our terms;
  • improve the product, plan capacity, and calibrate the model we use to produce quotes;
  • reach out to business contacts and prospects, and send marketing and newsletters (see below); and
  • comply with the law, enforce our agreements, and protect our users and the Service.

Customer Content. We use it only to provide, secure, support, and maintain the Service for the Customer who submitted it, and to comply with law. We never use Customer Content to train, fine-tune, or improve any large language model or other machine-learning model, or any solver or optimization algorithm, or to develop products or services for others. We do not allow our service providers to do so either.

Usage data. Our improvement, capacity-planning, and quote-calibration work relies on usage data, not Customer Content. Usage data does not contain the substance of a Customer’s problems or data, and any statistics we publish or share are aggregated so they do not identify you or a Customer.

Outreach and marketing. We may contact business contacts and prospects by email, phone, or other business channels to tell them about FernOpt. Every outreach email explains how to opt out, and we honor opt-out and do-not-call requests promptly and keep a record so we do not contact you again. Our emails may use standard tracking to show whether a message was opened or a link was clicked. If we offer a newsletter or similar subscription content, we send it only to people who have opted in, and you can unsubscribe at any time. Account and service messages are not marketing, so you will still receive them.

No sale or ad sharing. We do not sell personal data, and we do not share it for cross-context behavioral advertising.

4. Who we share information with

Service providers. We use vendors to run the business, and they may process personal data for us only to provide their services. They include Amazon Web Services (hosting and processing), Stripe (payments), Google Workspace (email and Google Meet video conferencing), Google Analytics (website analytics), Cal.com (demo scheduling), and other providers for support, monitoring, accounting, customer relationship management, and email delivery. Our subprocessor list is public, and we update it as the DPA describes.

Your organization. Administrators on a Customer’s account can see the account details of that Customer’s users.

Legal requirements and protection. We may disclose information when the law requires it, or when needed to protect people, the Service, or our rights. If we receive a legal demand for Customer Content, we will, where legally permitted, notify the Customer, reasonably cooperate with its efforts to limit or contest the demand, and disclose only what we are legally required to disclose.

Business transfers. If we are involved in a merger, acquisition, financing, or sale of the business or its assets, personal data may be transferred as part of that deal. [We will notify you if the transfer changes how your data is handled.]

With your consent. We share information for other purposes when you ask us to.

We do not sell personal data.

5. Cookies and similar technologies

We built our website to load quickly and use few cookies. Here are the kinds of technologies we use. The specific tools within each kind may change over time:

  • Analytics. Google Analytics sets cookies to show us which pages are visited and how visitors arrive.
  • Sign-in and security. We use Amazon Cognito and AWS Amplify to securely manage user registration and authentication for our Service. To keep you securely signed in across browser sessions, these services store necessary account tokens and session identifiers directly in your browser’s local storage. This data is used solely to verify your identity and maintain your active session. The Service also uses session storage for temporary application data, which clears when you close the tab. These are needed for the Service to work.
  • Marketing and site improvement. We may use cookies, local storage, and similar technologies to measure how visitors find us, how our marketing performs, and how we can improve the site and the Service. We do not use them to build advertising profiles or show you targeted ads on other sites.

You can block or delete cookies in your browser settings, or use Google’s Analytics opt-out browser add-on.

Global Privacy Control and Do Not Track. We recognize the Global Privacy Control signal. Because we do not sell personal data or share it for cross-context behavioral advertising, the signal does not change how we handle your data. [We do not respond to Do Not Track signals, because there is no common standard for them.]

6. How we protect information

We use encryption in transit and at rest, access controls, multi-factor authentication for administrators, backups, and logging. No system is perfectly secure, and we cannot guarantee that information will never be accessed, disclosed, or lost. Customers are responsible for the security of their own systems, credentials, and integrations.

If a security incident affects personal data that we control, we will give the notices the law requires. If it affects personal data in Customer Content, we will notify the Customer without undue delay and share the information reasonably available to us to help it meet its legal duties.

7. How long we keep information

Customer Content.

  • While a subscription is active, we keep Customer Content. We do not delete it merely because it is old. We may purge temporary and intermediate files, such as solver working files and detailed logs, after seven days.
  • After a subscription ends, the Customer has 90 days to view and download its Customer Content. After that there is no self-service access, but the Customer can ask in writing, before the retention period ends, for a one-time export.
  • We keep Customer Content for six months after the subscription ends. When that period ends, we delete or irreversibly de-identify it from our production systems within 30 days, and it is removed from backups in the ordinary course of our backup cycle, within 90 days after that.
  • A Customer’s account administrator can ask in writing for earlier deletion.
  • We may keep data longer where the law requires, for legal holds, to resolve disputes, for billing and tax records, and for security logs.

Other information.

  • Account and billing records: 7 years after the account closes, or longer where tax or other law requires.
  • Support messages: 3 years after the request is closed.
  • Demo requests and sales prospects who do not become Customers: 24 months after our last contact. Newsletter subscribers: until you unsubscribe. If you opt out of outreach, we keep only the minimum needed to honor your choice.
  • Website analytics data: 14 months.
  • Security and access logs that we keep ourselves: 24 months.
  • Usage data: 24 months. Aggregated statistics that do not identify anyone may be kept longer.

We may keep information longer if the law requires it or a legal claim is pending.

8. International transfers

We are based in the United States, our website and Service are aimed at the U.S. market, and we host data in the Amazon Web Services US-EAST-1 (Northern Virginia) region. If you use the Service from another country, your information will be processed in the United States. Transfers of personal data from the European Economic Area, the United Kingdom, or Switzerland are covered by the standard contractual clauses in the DPA.

9. Your rights and choices

Depending on where you live, you may have the right to:

  • access the personal data we hold about you;
  • correct it;
  • delete it;
  • receive a portable copy;
  • object to or restrict certain uses; and
  • withdraw consent where we rely on it.

We will not treat you differently for using these rights.

How to ask. Email privacy@fernopt.ai. To protect your information, we verify your identity before acting, usually by matching details to what we already hold, and we may ask for more if needed. An authorized agent can submit a request for you with proof of authority.

How fast. We respond within 45 days for requests under the California Consumer Privacy Act. Where the law allows an extension, we will tell you why we need one.

Appeals. If we deny your request and your state’s law gives you the right to appeal, reply to our decision with the word “Appeal” within 60 days. We will respond in writing within 45 days and explain the result. If you are not satisfied, you can contact your state attorney general.

Customer Content. If your personal data is in files or problems uploaded by a business that uses FernOpt, that business decides how the data is used and is responsible for answering your request. Please contact that business directly. If you contact us instead, we will direct you to that business and help it respond as our DPA provides.

10. Children

Our website and the Service are for businesses and are not directed to anyone under 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, email privacy@fernopt.ai and we will delete it.

Our website may link to other sites, including Cal.com for demo scheduling. We do not control those sites and are not responsible for their privacy practices. Please read their policies.

12. Changes to this policy

We may update this policy from time to time. We will post the new version at https://fernopt.ai/privacy and change the “Last updated” date above. For material changes, such as collecting new kinds of personal data or using or sharing it in ways this policy does not describe, we will give notice by email to account administrators and on our website at least 30 days before they take effect. Other updates, such as adding new tools or providers within the categories described here, take effect when we post them.

13. Contact us

Email: privacy@fernopt.ai.

Related documents: Terms of Service, Data Processing Addendum, and subprocessor list.