Privacy policy

There are three different kinds of personal data around Forge, and they are governed differently. This distinction decides which document applies to you.

If your employer uses Forge and you want to know what they have put into it, ask them. We hold it on their behalf and cannot make decisions about it without them.

Our hosting providers also hold ordinary technical logs of requests to the service, which can include an IP address. That is standard infrastructure logging and is held under their terms, listed in section 3.

Forge uses no advertising trackers and no cross-site tracking. Inside Forge, after you sign in, nothing tracks you: the only cookies are the two in section 2, an authentication session and a record of which organisation you are working in, and both are strictly necessary to use the service.

On our public website, such as this page, the home page and the blog, we use Gojiberry, a website visitor tool, to learn which companies visit, so that we can follow up. If you are in the EU, the EEA, the UK or Switzerland, we ask first, and Gojiberry runs only if you accept. Elsewhere it runs unless you turn it off. You can change your choice at any time with “Cookie settings” at the foot of every public page. Gojiberry may set its own cookies when it runs; its privacy policy describes them. It never runs inside Forge, on a page a customer has published, or on the sign-in page.

We do not sell personal data, and we do not share it for anyone else’s marketing. If you send an access request we may email you about it. We will not add you to a marketing list you did not ask for.

The service providers we use to run Forge. Each one is bound by contract and processes data only on our instruction.

• Supabase, for the database and file storage that holds your account and the records above.
• Vercel, which hosts the application and handles the requests you make to it.
• Cloudflare, which runs program apps. It sees nothing this policy covers: it receives workspace content, not your account details, so the data processing agreement governs it and the security page describes what it handles.
• Resend, which delivers our outbound email, such as invitations and password resets.
• Gojiberry, which sees visits to our public website, as section 3 describes, and nothing inside Forge.

The AI providers listed on the security page see workspace content when a customer asks a question. They are not sent your account details, and they are covered by the data processing agreement rather than by this policy.

We may also disclose personal data where the law requires it. If we are compelled to, we will tell the affected customer unless we are prohibited from doing so.

Data is stored in the United States, and the application runs there too. Our AI and email providers operate from the United States as well, so asking a question or sending an email does not move your data to another country, though it does move it to another company. One exception: Voyage AI, which performs embeddings and reranking, publishes no processing region, so we cannot tell you which country that step uses. Every transfer is covered by the terms we hold with each provider.

There is one more, and it is listed here because it is a transfer rather than because this policy governs what moves. If your organisation uses a program app, the run happens on Cloudflare’s network rather than in the region above, and is constrained to Eastern North America rather than placed freely. That is a region and not a country, so it says a run stays within that area rather than which country inside it was used. What that handles, and the controls around it, are on the security page; the content itself is covered by the data processing agreement, not by this policy.

• Account details are kept while your account exists, and are deleted when it is closed.
• Access requests are kept while we are considering or acting on them, and are deleted on request at any time.
• Usage and activity records are kept as the record of what the service did, which is what makes them useful for billing and oversight.
• Conversations follow the retention window your organisation sets, and are deleted automatically when it passes. Documents stay until deleted.

Retention controls and deletion behaviour are described in more detail on the security page.

Depending on where you are, you can ask us to do the following with the personal data we hold about you. We will not charge you for asking, and we will respond within a reasonable time.

• Tell you what we hold about you and why.
• Correct it if it is wrong or incomplete.
• Delete it, where we do not need to keep it for a legal or contractual reason.
• Give you a copy in a portable form.
• Stop a particular use, or withdraw a consent you gave us.
• Nominate someone to exercise these rights on your behalf if you are unable to.

Write to contact@gradtensor.com and we will handle it. That address is also where to raise a complaint about how we have handled your data. If you are not satisfied with our answer, you can complain to your data protection authority.

If your data is inside a customer’s workspace rather than held by us directly, section 1 applies: we will pass your request to that customer, who decides how to answer it.

Encryption in transit and at rest, invite-only access, per-organisation separation, an append-only audit log, and no use of your data to train any AI model. The controls, and the ones we do not yet have, are set out on the security page.

We run a public tool that finds the personal information in a piece of text and works out how to mask it. It is reachable at /api/mcp/public and from AI clients that connect to it. It needs no account, so anyone can use it, and this section describes what happens to what they send.

Nothing sent to it is stored or logged. The text is read, examined in memory and discarded when the reply is sent. No part of it is written to a database, written to a log line, kept in a cache, or repeated in an error message. We cannot produce a copy of something you sent, because none was kept.

The tool can reply in three ways. A scan tells you the kind of each identifier found and the line it sits on. A masking request tells you where each identifier sits and what to replace it with, so that your copy of the file can be masked where it is. Or, for pasted text, it returns the text with each identifier already replaced by a placeholder such as [EMAIL]. No reply ever contains an identifier itself, so a reply can be shared without repeating the information it is about.

When a file is masked, the file itself never reaches us. Only the parts of its text that could hold an identifier are sent. The edits are made to the copy in your Claude session, not by us, and we never see or keep the masked file.

We record counts for rate limiting, which is the number of requests seen from an address in a short window, held in memory and not written down. We do not set a cookie, we do not identify you, and we have no account to attach anything to.

Nothing sent to this tool reaches an AI model. It runs the same pattern matching our own ingestion uses, in our own code.

If we change what we collect or what we do with it, we will update this page and the date at the top. Where a change is significant and affects you, we will tell you rather than rely on you noticing.

Forge is operated by GradTensor. For any question about this policy, to exercise a right, or to raise a complaint, write to contact@gradtensor.com.