Privacy Policy
Effective date: June 28, 2026
1. Who we are
Forge-Worx, Inc.("Forge", "we", "us") operates the Forge issue-tracking platform at forge-worx.com. We are the data controller for personal data processed through the platform. Contact us at privacy@forge-worx.com.
2. Data we collect
- Account data: name, email address, profile photo.
- Workspace data: issues, comments, attachments, and other content you create.
- Usage data: page views, feature interactions, session timestamps.
- Technical data: IP address, browser type, device identifiers.
- Communication data: support tickets and messages you send to us.
3. Lawful basis for processing (EU/UK users)
| Processing activity | Lawful basis |
|---|---|
| Providing the platform and account management | Contract (Art. 6(1)(b) GDPR) |
| Sending transactional emails (password reset, invitations) | Contract (Art. 6(1)(b) GDPR) |
| Security logging and fraud prevention | Legitimate interest (Art. 6(1)(f) GDPR) |
| Product analytics and improvement | Legitimate interest (Art. 6(1)(f) GDPR) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c) GDPR) |
| AI feature processing (triage, Think Tank) | Contract + Legitimate interest |
4. How we use your data
- To provide, maintain, and improve the Forge platform.
- To authenticate you and secure your account.
- To send service-related notifications (no marketing without consent).
- To analyse aggregate usage and improve product features.
- To comply with legal and regulatory obligations.
5. AI features
Forge uses AI providers (currently xAI / Grok) for features including issue triage, Think Tank idea analysis, and digest generation. Issue text and idea content may be sent to these providers for processing. AI providers do not use your data to train their models. See our AI Use Policy for full details, including how to opt out of specific AI features.
6. Data retention
| Data type | Retention period |
|---|---|
| Account and workspace data | For the duration of your subscription, plus 90 days after account closure |
| Audit logs (actor labels) | 3 years (legal obligation) |
| Security logs (IP, failed logins) | 90 days |
| AI turn data | Retained until you request deletion or close your account |
| Support tickets | 3 years |
| Backups | 30 days rolling |
7. Sub-processors
We share data with a limited set of sub-processors necessary to operate the platform. See our Sub-Processor List for the current list including Supabase (database), Vercel (hosting), xAI (AI), Postmark (email), and Resend (transactional email). All sub-processors are bound by Data Processing Agreements. Standard Contractual Clauses (SCCs) are available on request at privacy@forge-worx.com.
8. International transfers
Forge is hosted on infrastructure located in the United States. If you are based in the EU/EEA or UK, your personal data is transferred to the US under Standard Contractual Clauses (EU Commission Decision 2021/914). Contact us to receive a copy.
9. Your rights
Depending on your location, you may have the following rights regarding your personal data:
- Access (Art. 15 GDPR): Request a copy of your data via Account → Settings → Privacy → Download my data, or email us.
- Rectification (Art. 16 GDPR): Correct inaccurate data via Account Settings, or email us.
- Erasure (Art. 17 GDPR / CCPA): Request deletion via Account → Settings → Privacy → Request account deletion, or email us.
- Restriction (Art. 18 GDPR): Request that we restrict processing while a dispute is pending. Email us.
- Portability (Art. 20 GDPR): Receive your data in a structured, machine-readable format. Use the Download my data link above.
- Objection (Art. 21 GDPR): Object to processing based on legitimate interests. Email us.
- CCPA: California residents may request disclosure, deletion, or opt-out of sale of personal information. Forge does not sell personal information.
We will respond to all verifiable requests within 30 days (extendable by 60 days for complex requests). To exercise your rights: privacy@forge-worx.com.
10. Complaints
EU/EEA residents have the right to lodge a complaint with their local supervisory authority. A list of EU data protection authorities is available at edpb.europa.eu. We encourage you to contact us first at privacy@forge-worx.com so we can address your concern directly.
11. Cookies
Forge uses strictly necessary session cookies for authentication. We do not use tracking cookies or third-party advertising cookies. Vercel Analytics may collect anonymized, aggregate usage metrics without cookies.
12. Changes to this policy
We will notify you of material changes to this policy by email or via an in-app notice at least 14 days before the changes take effect. The effective date at the top of this page reflects the most recent update.
13. Contact
Data controller: Forge-Worx, Inc.
Privacy enquiries: privacy@forge-worx.com
DPA / SCC requests: privacy@forge-worx.com