Privacy Policy

Information We Collect

When you submit a form on this website — a discovery call booking, the contact form, or a data request — we collect your name, email address, company name, and whatever you write in the message.

If you book a call we also record the slot you chose and your timezone, so we can send the invite and two reminders.

We hold contact details for firms we have approached by email who never contacted us first: usually a name, firm name, work email address, website, and city or state. This comes from commercial business-contact lists, not from anything you gave us. If that is you, you have exactly the same rights over it as anyone else, and you can use the link below without being a client.

We collect analytics — browser type, approximate location, pages visited — only if you accept cookies. If you decline, the analytics script is never loaded and the cookies are cleared.

We do not collect payment information. Payments are handled by third-party processors under their own terms.

We do not use automated decision-making or profiling, and we do not build behavioural advertising audiences.

How We Use Your Information

To reply to you, and to schedule, run and remind you about a discovery call.

To send project updates and communications related to work we are doing for you.

To send a first email and at most one follow-up to firms that fit the kind of work we do. Every one of those carries a one-click unsubscribe, and an unsubscribe, a bounce or a "no thanks" stops all further contact permanently.

To understand how visitors use the site, where cookies were accepted.

We do not sell, rent, or trade personal information, and we never have.

Data Storage and Security

Form submissions and booking records are stored in Supabase. The connection to it is encrypted and enforced: plain HTTP is refused and upgraded, and the endpoint sets HSTS for a year. Supabase encrypts stored data at rest as a property of its platform; that is their assurance rather than something we can independently verify, and we would rather say so than imply we audited it. The site itself is served over HTTPS only. Email goes through Resend, which keeps its own delivery logs.

Access to the database is limited to Forge and is held behind a service key that is never exposed to your browser.

We are a small studio, not a bank: we are describing real measures, not a certification. Forge has not been independently security-audited, and we are not going to imply otherwise.

We keep contact details for as long as we need them to answer you or to do the work, and prospect records until they are acted on or the address opts out.

AI, and What It Is Sent

The platforms Forge builds use AI, and the demos on this site do too. The model is provided by Anthropic (Claude). When a feature uses it, the relevant text — a document, an email, a set of records — is sent to Anthropic to be processed, and the result comes back to the platform.

Anthropic does not use data submitted through its API to train its models. That is their commercial terms, not a promise Forge is in a position to make on their behalf, and you should read those terms yourself if it matters to your firm.

Nothing is sent to any other AI provider. We do not sell data to model builders and we do not train anything of our own on your data.

The AI drafts and analyses. It cannot send, file, sign, bill, or move money on its own — every one of those actions needs a named person to approve that specific thing, and the platforms are built that way rather than configured that way.

The platforms assist the professionals at a firm. They do not replace professional judgment, and nothing they produce is legal, tax, financial or insurance advice.

Children

This site and everything on it is directed at accounting, insurance, contracting and consulting firms. It is not directed at children, and we do not knowingly collect personal information from anyone under 16.

If you believe a child has given us their information, email hello@forgesoftware.co and we will delete it without asking for anything further.

Third-Party Services

We use Supabase for storage, Resend for email, Daily for the video calls, and Google Analytics for site statistics. Each has its own privacy policy and its own retention schedule.

Google Analytics is the only one of these that runs in your browser, and it is loaded only after you accept cookies.

We do not control what these providers do with data once it reaches them, and we encourage you to read their policies.

Cookies

We ask before setting any analytics cookie. Nothing non-essential is set until you accept, and declining clears anything already there.

You can change your answer at any time using the "Cookie settings" link in the footer of every page.

Your Rights

You can ask for a copy of everything we hold about you, ask us to correct it, or ask us to delete it. You do not need an account, a reason, or an existing relationship with Forge.

Use the request form at forgesoftware.co/data-request, or email hello@forgesoftware.co — both reach the same place and are honoured the same way. We reply within 30 days.

A deletion request suppresses your email address immediately, before anything else happens, so you stop hearing from us while we work through it.

One thing survives a deletion: your email address on a do-not-contact list, with the date. We keep that so we cannot accidentally add you back from a future lead list. It is the only record we retain, and it is retained for your benefit.

If you are unhappy with how we handled a request, you can complain to your data protection authority. In California that is the California Privacy Protection Agency.

Changes to This Policy

We may update this policy. When we do, we will revise the effective date at the top of this page.

If a change materially affects how we use information we already hold, we will say so rather than quietly amending the text.

Contact Us

Questions about this policy, or about anything we hold: hello@forgesoftware.co.