Privacy Policy

1. Introduction and Scope

ForgeSystem is a white-label agency platform that helps agencies manage their clients, communications, payments, and workflows. This Privacy Policy explains how we collect, use, store, and protect information when you interact with our platform, whether you are an agency owner, a team member, or an end client of an agency using ForgeSystem.

This policy applies to all services provided through ForgeSystem, including Invoicing & Payments, Contracts & E-Signatures, Custom Forms, Scheduling & Booking, Client Messaging, Email & SMS Marketing, Client Feedback, Onboarding & Checklists, Portfolio & Case Studies, Landing Pages, and Analytics & Reporting.

2. Our Role: Data Controller and Data Processor

Because ForgeSystem operates as a white-label platform, our privacy responsibilities depend on the type of data involved. We operate under a three-tier model:

ForgeSystem as Data Controller

We act as the Data Controller for information related to agency accounts, billing, and platform usage. This includes the data agencies provide when they sign up, their payment information, and how they use the platform. We decide why and how this data is processed.

ForgeSystem as Data Processor

When agencies use ForgeSystem to manage their own clients, we act as a Data Processor. We process agency client data on the agency's behalf and according to their instructions. We do not use this data for our own purposes beyond providing the service.

Agencies as Data Controllers

Agencies that use ForgeSystem are Data Controllers for their own clients' data. They determine what data to collect, why, and how it is used within the platform. Agencies are responsible for maintaining their own privacy policies that inform their clients about data practices.

3. Information We Collect

3.1 Information You Provide

• Account registration: Name, email address, business name, and other details provided during sign-up
• Payment and billing data: Payment is processed through Stripe. We do not store full credit card numbers on our servers. Stripe handles card data in accordance with PCI DSS Level 1 standards.
• Client data uploaded by agencies: Contact information, project details, files, and other content agencies add to the platform for their clients
• Communication content: Emails, SMS messages, and chat messages sent through the platform
• Support requests: Information you provide when contacting our support team

3.2 Automatically Collected Information

• Usage analytics: How you interact with the platform, features used, and frequency of use
• Technical information: IP address, browser type, device type, operating system, and screen resolution
• Performance metrics: Page load times, error logs, and service performance data
• Server logs: Access logs including timestamps, request URLs, and response codes

3.3 Cookies and Tracking

• Essential cookies: Required for authentication, session management, and security. These cannot be disabled without breaking core functionality.
• Analytics cookies: Help us understand how the platform is used so we can improve it. These can be managed through your browser settings.

You can control cookies through your browser settings. Disabling essential cookies may prevent certain features from working correctly. Disabling analytics cookies will not affect your ability to use the platform.

4. How We Use Your Information

We use information for the following purposes, each tied to a legal basis:

• Providing our services (contractual necessity) — Operating the platform, delivering features, and managing your account
• Processing payments (contractual necessity and legal obligation) — Handling subscriptions, invoicing, and payment transactions through Stripe
• Sending communications on agencies' behalf (contractual necessity) — Delivering emails, SMS messages, and notifications that agencies configure for their clients
• Platform security and fraud prevention (legitimate interest) — Detecting abuse, preventing unauthorized access, and maintaining service integrity
• Analytics and improvement (legitimate interest) — Understanding usage patterns to improve features, performance, and user experience
• Legal compliance (legal obligation) — Meeting tax, financial reporting, and other regulatory requirements

5. How We Share Your Information

We do not sell personal information. We share data only in the following circumstances:

• Service providers: With sub-processors necessary to operate the platform (see Section 6 below)
• Agency access: Agency client data is accessible to the agency that manages the client relationship
• Legal requirements: When required by law, regulation, legal process, or enforceable governmental request
• Business transfers: In connection with a merger, acquisition, or sale of assets, with prior notice to affected users

6. Sub-Processors

We use the following third-party service providers to operate ForgeSystem. Each processes only the data necessary for their specific function.

Provider	Purpose	Data Processed
Amazon Web Services (AWS)	Email delivery via SES, infrastructure	Email content, recipient addresses, delivery metadata
Stripe	Payment processing (PCI DSS Level 1 certified)	Payment card details, billing addresses, transaction amounts
Supabase	Database hosting, authentication, file storage	Account data, application data, uploaded files, auth credentials
Netlify	Application hosting, serverless functions	Request data, access logs, function execution data

For details on how each provider handles data, see their respective privacy policies:

• AWS Privacy Policy
• Stripe Privacy Policy
• Supabase Privacy Policy
• Netlify Privacy Policy

7. Data Retention

We retain data for the minimum period necessary to fulfill the purposes described in this policy. Specific retention periods are:

Data Type	Retention Period
Account data	Duration of account + 90 days post-deletion
Payment and billing records	7 years (legal requirement)
Communication logs (email, SMS, chat)	24 months
Usage analytics	24 months
Server and access logs	90 days
Agency client data	Deleted within 30 days of agency request or account termination

When data reaches the end of its retention period, it is securely deleted or anonymized so it can no longer be linked to an individual.

8. Data Security

We take the security of your data seriously and implement multiple layers of protection:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (HTTPS)
• Encryption at rest: Stored data is encrypted using industry-standard encryption methods
• Access controls: Strict role-based access ensures only authorized personnel can access data, and only the data they need
• Security monitoring: We continuously monitor for suspicious activity, unauthorized access attempts, and vulnerabilities
• Incident response: We maintain documented procedures for responding to security incidents, including containment, investigation, and notification

9. International Data Transfers

ForgeSystem's infrastructure is hosted primarily in the United States through AWS and other US-based providers. If you are located outside the US, your data may be transferred to and processed in the United States.

For transfers of personal data from the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms, to ensure an adequate level of data protection.

10. Your Privacy Rights

10.1 GDPR Rights (EU/EEA/UK Residents)

If you are located in the European Union, European Economic Area, or the United Kingdom, you have the following rights under the General Data Protection Regulation:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data, subject to legal retention requirements
• Right to restriction: Request that we limit how we process your data in certain circumstances
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests or direct marketing

We respond to all GDPR requests within 30 days. You also have the right to lodge a complaint with your local supervisory authority if you believe your data has been mishandled.

10.2 CCPA/CPRA Rights (California Residents)

If you are a California resident, the California Consumer Privacy Act and California Privacy Rights Act provide you with the following rights:

• Right to know: Request details about what personal information we collect, use, and disclose
• Right to delete: Request deletion of your personal information, subject to certain exceptions
• Right to correct: Request correction of inaccurate personal information
• Right to opt out of sale or sharing: We do not sell or share personal information as defined by the CCPA (see Section 11)
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights

We respond to all CCPA/CPRA requests within 45 days.

10.3 Other US State Privacy Laws

We comply with applicable state privacy laws, including those in Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy legislation. If your state provides additional privacy rights, please contact us to exercise them.

11. Do Not Sell or Share

ForgeSystem does not sell personal information. We do not share personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act (CCPA). Because we do not engage in these practices, a "Do Not Sell or Share My Personal Information" link is not necessary, but we honor such requests regardless if received.

12. Email and SMS Communications

CAN-SPAM Compliance

All commercial emails sent through ForgeSystem comply with the CAN-SPAM Act. This means every marketing email includes:

• A clear and functioning unsubscribe mechanism
• Accurate "From" and "Reply-To" headers
• A valid physical postal address
• Honest subject lines that reflect the content

Unsubscribe requests are honored within 10 business days.

TCPA Compliance for SMS

SMS messages sent through ForgeSystem comply with the Telephone Consumer Protection Act (TCPA). This means:

• Prior express consent is required before sending marketing or promotional SMS messages
• Opt-out requests (e.g., replying STOP) are honored immediately
• Messages include sender identification and opt-out instructions

Agency Responsibilities

Agencies using ForgeSystem are responsible for obtaining proper consent from their contacts before sending communications. ForgeSystem provides the tools for compliance, but agencies must ensure they have the appropriate permissions and consents in place.

13. Children's Privacy

ForgeSystem is a business platform and is not directed at children under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 16, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at the email address listed below.

14. Data Breach Notification

In the event of a data breach that affects your personal information, we will:

• Notify affected users without undue delay
• Provide clear information about what happened, what data was affected, and what steps we are taking
• Report to relevant supervisory authorities within 72 hours where required by GDPR
• Cooperate with agencies to help them fulfill their own breach notification obligations to their clients

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Notify you by email and through a platform notification at least 30 days before the changes take effect
• Clearly describe what has changed and why
• Update the "Last Updated" date at the top of this page

Continued use of ForgeSystem after the notice period constitutes acceptance of the updated policy. If you disagree with any changes, you may close your account before the changes take effect.

16. Contact Us

If you have questions about this Privacy Policy, want to exercise your privacy rights, or have concerns about how your data is handled, please reach out: