Privacy Policy

Last updated 24 October 2026. The company identified below is the data controller for personal data processed by Forge. Contact: contact@forge.team.

Forge is operated by the company registered in England and Wales under company number 17431058, registered office 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

1. What we collect

Account data: your email address, and - if you sign in with Google - the email address and basic profile (name, avatar) Google shares with us; we use Google sign-in data to authenticate you; separately connected Google content is accessed only when you authorise that connection. Verification data: a phone number when phone verification is required (with its carrier line type). Additional fraud-risk and human checks, and step-up identity verification, are described below as planned features. Invitation data: we plan to let an inviter provide your email address or phone number so that a matching verified sign-up is recognised without the invitation link. This contact-matching feature is not yet available. When introduced, contact details supplied by the inviter will be used only to recognise the invitee and deleted when the invitation is redeemed, cancelled or expires. Security signals: IP address and coarse device/browser characteristics, used for fraud prevention, abuse detection and account security. Service data: your conversations, connected projects, optional phone communications and usage records needed to run and bill the service. Payments are processed by Stripe - we receive payment status and a reference, never full card numbers.

2. Why we process it

To provide and bill the service (performance of contract); to prevent fraud and abuse of promotional balance, referrals and verification, to keep accounts secure, and, for the planned usage-learning feature below, to improve how Forge chooses models and approaches for tasks (legitimate interests); to meet UK VAT, tax and accounting obligations (legal obligation); and, where we ask for it, with your consent. Development-only operator access to workspaces for debugging and product analysis is permitted only if it is read-only and audited. This is an access restriction, not a claim that an operator view is currently available. We do not use your content to train AI models by default.

3. Who we share it with

Processors acting on our instructions only: Stripe (payments), Telnyx (phone verification, calls and messages), Amazon Simple Email Service (SES, email delivery), AI providers including Anthropic, OpenAI and Google (requests and responses needed to provide AI features), ElevenLabs and Deepgram (speech needed for voice features; these are currently used through accounts held by TwoShot, which processes this speech data on our instructions), Sentry (error monitoring), and cloud infrastructure and storage providers (including DigitalOcean, Cloudflare and Wasabi). We do not sell personal data.

Planned processing: Didit (identity checks), Stripe Identity (fallback identity checks), IPQualityScore (fraud-risk checks on phone numbers before sending a sign-in code), Cloudflare (a human check for some numbers), and SES (receiving mail for the planned per-account email addresses). These new workflows are not yet available end to end. If you use WhatsApp with Forge, messages also pass through Meta's WhatsApp platform under its own privacy policy, rather than our processor instructions.

4. Retention

Account and service data is kept while your account is active. When you ask us to delete your account, we delete or anonymise it, except billing records we must keep for as long as tax law requires, and limited fraud-prevention records (such as hashed phone identifiers and IP activity linked to abuse) kept to prevent repeat abuse of promotional programs. When you disconnect a connected account, we delete the access credentials we stored for it. We keep no more than we need for each purpose.

5. Your rights

Under UK/EU GDPR you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Write to contact@forge.team; we answer within a month. You may also complain to the UK Information Commissioner's Office (ICO).

6. International transfers

Our processors may store data outside the UK/EEA; where they do, transfers are protected by recognised safeguards such as adequacy decisions or standard contractual clauses.

7. Calls and messages

If you use phone features, we process your phone number, the numbers you contact, message content and call metadata or content needed to deliver or transcribe calls. Telnyx handles phone traffic and verification. We plan to give each admitted account its own Forge phone number and email address. When this is available, we will process messages sent and received on them to run the service; first contact from the agent will require your consent recorded at sign-up. When Forge's agent calls or answers someone other than the account holder, it first says it is Forge, and whose assistant it is when it acts for someone. Agent-initiated calls and texts are not placed or sent during quiet hours in the recipient's local time. We use this information to deliver and bill the service and prevent abuse. A text, call or email to Forge permits Forge to get back to that sender until you ask us to stop, including in natural language: by text or a call to the number that texted or called, or by email to the address that emailed. Otherwise Forge may text or call the phone number verified on your account. It calls when its agent judges a call useful; there is no separate setting to turn calls on. Replying STOP stops agent calls as well as agent texts until you reply START; replying HELP to a text from Forge gets help. Forge's agent is also instructed to honour a request to stop made in plain words. Opting out of agent messages does not block the sign-in or verification codes you request. Marketing messages are sent only with separate consent; verifying your phone number or email does not sign you up for them. We do not share mobile numbers with third parties or affiliates for their marketing or promotional purposes, and we never share SMS opt-in data or consent with any third party.

8. Identity checks

We plan to offer an identity check only when our fraud checks flag an account. The customer-facing check and document-only choice are not yet available. The planned provider is Didit (didit.me), with Stripe Identity as the fallback. Didit's full workflow processes a photo of your ID document, a selfie with a liveness check and a face match against the document (biometric data), and device and IP data. Didit also compares the document, and in its full workflow the face, with those already verified on other accounts to detect duplicates; that duplicate comparison is not a claim about Stripe Identity. The planned document-only choice for verified phones in the EEA, the UK or Switzerland has no selfie or face matching. Any biometric consent required by law must be obtained before the check runs.

Forge's verification result fields store only the time you passed and the check's session ID, not document images, selfies or face data. The verification provider processes and holds the check materials separately; these Forge result fields do not determine the provider's retention period. Review the provider's data notice before completing a check.

9. How Forge learns from usage

We plan to use usage-derived learnings to improve model and approach selection. This includes which model and approach was chosen and why, cost and time, and outcomes inferred from what followed, such as your reply, a retry or a task finishing. The planned Help improve setting defaults to on: learnings and derived task examples would be pooled across accounts to improve choices for everyone. Such examples could be supplied as context to a model handling another account's task, not just counted in aggregate statistics. The model would be instructed to use the approach and not to reproduce the example; that instruction is not an anonymity guarantee.

The pooling feature and its per-account controls are not yet implemented end to end. The planned control lets a Forge administrator turn pooling off for an account, limiting its records to improving that account's own choices. We do not claim that OFF isolation is already enforced. Your rights, including the right to object to processing based on legitimate interests, remain unchanged; contact us to exercise them. This planned learning is separate from training AI models, which we do not do with your content by default.

10. Changes

We will post any changes here and, for material changes, notify you in the product or by email.