Legal

Privacy Policy

Forge Solutions, Corp.

Effective Date: October 17, 2026

Payment Information: What We Hold

We collect payment information only if you choose to give it to us. Starting a free trial does not require a card, and until you add a payment method we hold no billing data about you beyond the account details described below. When you do add one, it goes directly to Stripe, our payment processor: Stripe stores the card, and we receive only a tokenized reference, your billing email, and whether each transaction succeeded. We never see or store your full card number or CVV. Sections 1, 2, 3, and 6 below describe this in full.

1. Information We Collect

We may collect: • Contact information (name, email) • User inputs (project details, measurements, descriptions, audio recordings, video recordings, and photos) • 3D captures, only for areas you choose to capture in 3D: video of the room, depth data and the position and angle of the camera from your phone's sensors, and the phone's model and operating system (see Section 1.1) • Usage data (interactions with the platform) • Device and log data • Billing information (processed and stored by Stripe. We do not store your full card details) • Records of the apps and AI tools your company connects to Forge, and of what each one reads

1.1 3D Captures

A 3D capture is optional. It is made only for an area your team chooses to capture in 3D. What we collect: video of the room from your phone's camera, depth data from the phone's sensors where the phone has a LiDAR scanner, the position and angle of the camera over time, and the phone's model and operating system. People who are in the room may appear in the video. A 3D capture does not record sound. Where it is processed: the scan is uploaded to Forge's storage on Amazon Web Services and sent to Modal, a graphics-processing provider, which builds the 3D view and returns the result to us. Modal is listed in Section 3. How long we keep it: we keep the raw scan in standard storage for 2 days after the capture, then move it to lower-cost archive storage on the same provider. We move a scan only after its 3D build has finished. An archived scan can still be used to rebuild the 3D view. The 3D view stays in your account until it is deleted. Deleting it: Deleting a walk deletes its 3D captures, and deleting a job deletes the job's 3D captures. When a workspace is permanently deleted, its 3D captures are deleted with it (see Section 7).

1.2 Your Company's Writing Style

If your company connects its project management software to Forge and turns this on, Forge learns how your company writes, so the estimates and scopes it drafts for you sound like your company. This is called a writing style profile. Where it comes from: only the descriptions on your company's own cost items in that software (the lines of its budgets, proposals and change orders). Forge reads them only while the writing style switch is on. What we keep: format statistics (such as how long names and descriptions run), sentences your company reused on 4 or more jobs, and 2 to 3 example lines for each cost code. How it is used: Used only in your company's own estimates and scopes. It is not model training. When Forge drafts for your company, a short text built from the profile is sent to Anthropic with the rest of the request (see Section 3). No other company sees it, and it is never used for another company's drafts. Your control: your company's owners and admins can view the profile, remove items from it, or switch it off. Deleting it: the profile is deleted when your company disconnects that software, when your company turns data access off, and when the workspace is permanently deleted (see Section 7).

2. How We Use Information

We use data to: • Provide and improve the Service • Generate estimates and structured scope outputs • Process payments via Stripe • Communicate with users • Monitor performance and security • Share your company's data with apps and AI tools your company connects, when your company tells us to (see Section 5)

3. Data Sharing

We do not sell your personal data. We share data in three ways. First, with the service providers we use to run Forge, listed below. Second, with apps and AI tools your company chooses to connect, as described in Section 5. Third, with people you choose to send documents to from Forge, such as your clients. Our service providers are: • Stripe: payment processing (tokenized card reference, billing email, transaction status) • OpenAI: audio transcription. When you record a job walk or meeting, the audio is sent to OpenAI's Whisper service to convert speech to text. • Anthropic: AI generation. The text of your transcripts, project details, and measurements (and, where you use those features, photos of plans/blueprints and receipts) are sent to Anthropic's Claude models to draft scopes, estimates, client updates, and to read blueprints and receipts. • Tavily: building-code lookup. When you look up applicable codes, we send a search query containing the job's city and state and a description of the construction task. We do not send your name, contact details, or full address. • Modal: 3D processing. When you capture an area in 3D, the scan (video, depth data and camera position and angle) is sent to Modal's graphics-processing service to build the 3D view (see Section 1.1). • Hosting, storage, and analytics providers: to operate and monitor the Service • Legal authorities: only where required by law We send these providers only the data needed for the specific feature you are using. We do not authorize them to use your data to train their own models, and we require each provider to protect your data under terms at least as protective as this policy (see "AI Processing" below). These promises cover our service providers only. They do not cover apps and AI tools your company connects. Section 5 explains the difference.

4. AI Processing

Forge is an AI-powered tool. To generate scopes, estimates, client updates, and to read blueprints and receipts, we send your inputs to third-party AI processors: OpenAI (audio transcription), Anthropic (text and image generation/analysis), and Tavily (building-code search using the job's city/state and task description). • We send each processor only the data needed for the feature you are using. • We require these processors, by contract, to protect your data under safeguards at least equivalent to those in this policy, and not to use your data to train their own models. • Because Forge's core features are AI-powered, AI processing is required to use the app. You can withdraw your consent at any time in Settings → AI Data Sharing (see "Your Rights"); withdrawing signs you out, and you'll be asked to consent again the next time you sign in. • Some AI-related logs and outputs are retained as described in "Data Storage and Retention". This section covers the AI providers Forge uses to run its own features. AI tools that your company connects to Forge are not our AI providers. Section 5 covers them.

5. Apps and AI Tools You Connect

Forge has a public API and an MCP server. We call them the "Forge API". They let software and AI tools that your company chooses read your company's Forge data. That can be any AI tool that supports MCP, or your own software. We call these "connected apps".

A connected app is not one of our service providers. Your company chooses it, and your company directs us to share data with it. This is true even when the app is made by a company that is also one of our service providers, such as Anthropic.

Each connection needs your company’s approval.

• Data access is available by default. An owner or admin can turn it off in Settings. Each connection still needs its own approval. When it is turned on, we tell the company's owner by email, or, if the owner has no email address, by a push notification and a notice in Forge's Settings. • After that, each connection needs its own approval. The person connecting signs in to Forge, reads a consent screen that names the app and what it can read, and chooses Allow. • Owners and admins approve connections with full access and create API keys; project managers and estimators can connect apps such as Claude with read-only access, and see only what they see in the app; subs and clients cannot connect. An API key works with both the public API and the MCP server. It reads the same data as any other connection, its reads are recorded the same way, and it ends the same way. • Each connection covers one company. A connected app never sees another company's data, even if the person who connected it belongs to more than one company.

What a connected app can read

• Your jobs and their status • Your clients' details: their name, the address of the job, their phone number and their email address • The current version of each scope and estimate, including drafts. Each one is labelled with its status. Earlier versions that have been replaced are never shared. Estimates created by features that are still in limited release, such as Blueprint, are not shared. • Your costs and your customer prices. Both are your company's own data. Where a number is labelled as a customer price, it is always your marked-up price. If your company's markup is 0%, customer prices are not shared until an owner or admin sets a markup. • Job photos, as a resized copy, without the location recorded with them. • The transcripts and audio and video recordings of your job walks and daily sweeps. They hold the words of everyone who was recorded, including your clients. A connected app reads them only by asking for them on their own; they are not repeated inside your scopes and estimates.

An owner or admin may separately allow an app to create jobs and their clients, edit job details, link external job IDs, decide and sync daily sweep segments, merge duplicate jobs, record estimate outcomes, record the prices sent to clients and what work actually cost, and propose rate changes for an owner or admin to approve. These edits are recorded. Connected apps cannot change money, permissions or ownership, or delete records. API keys remain read only.

What a connected app reads, it reads as written. Job names, notes, scopes, estimate notes and walk transcripts reach the app word for word, including anything your team, your subcontractors or your clients wrote or said. Text like that can contain instructions aimed at an AI tool. Connect only tools you trust, and keep an eye on what they do with the other accounts they are connected to.

How we record reads. We record every read a connected app makes. When it looks at a photo, we record that read as it happens. Audio and video are different: we give the app a link to the recording that works for 15 minutes, so we record when we issued the link, not when or whether the recording was played.

About your clients' details

Your clients' names, the addresses of their jobs, their phone numbers and their email addresses are your company's own records about your own customers. So a connected app can read them, and you can also send them to other business systems your company connects to Forge, such as your CRM or your project management software. You decide which software that is. You are responsible for having the right to share your clients' information with it, and for telling your clients if you need to.

The same goes for recordings of your job walks and sweeps. They can hold your clients' own words. Before you record, you are responsible for telling everyone who will be recorded, and for getting any consent the law where you work requires. You are also responsible for having the right to share those recordings and their transcripts with the apps you connect.

If you are a client of a Forge customer and you are reading this: a contractor who uses Forge may pass your name, the address of the work, your phone number and your email address, and recordings and transcripts of conversations you had with them about the work, to software they have chosen, including AI tools and their own business systems. Forge does not choose that software and does not control what it does with your details. The software's own terms and privacy policy apply to what it receives. Ask your contractor which tools they use. You can also contact us at the address below.

What never leaves Forge through a connected app

• Receipt photos • The exact location saved with a photo

After a connected app reads your data

• The app's own terms and privacy policy apply to what it receives. • We do not control what the app does with your data. We cannot make it delete the data. We cannot promise that it will not use the data to train AI models. Please check the app's terms before you connect it. • Deleting something in Forge does not delete a copy that a connected app already has.

When access ends

• Any owner or admin can see every connection for the company, and end any of them, in Settings. • A connection belongs to the person who made it. It ends when that person leaves the company or their role no longer allows it. • Turning off Data access ends every connection and API key for the company at once. • Deleting your account ends every connection and API key you made, in every company. • Withdrawing your consent to AI data sharing, or your acceptance of our Terms, ends every connection and API key you made. • If a company is closed, its connections end. If the company is reopened later, the old connections do not come back. They must be made again. • If your company's subscription is paused, connected apps are refused with a message that says billing is the reason. Connections are not deleted. They work again once the subscription is active.

Records we keep

We keep a record of the moment data access was turned on for your company: who turned it on, when, the exact wording they agreed to, and the versions of these Terms and of any Master Subscription Agreement in force at that moment. We keep a record of each connection: who approved it, when, and what the consent screen said. We also keep a record of what each connected app read. We keep the read records for 13 months and then delete them. Owners and admins can see these records in Settings on the web, or ask us at the contact address below.

Notices about connections

When data access is turned on or off, and when a connection is made or ended, we email the company's owner and the person who made the change. If either of them has no email address, we send them a push notification and show the notice in Forge's Settings instead. Each of them can turn off their own copy of these notices in Settings, except the notice that tells the owner data access was turned on.

6. Payment Data

All payment processing is handled by Stripe via their secure, PCI-compliant infrastructure. We receive only a tokenized reference, your billing email, and transaction status. We never have access to your full card number or CVV.

7. Data Storage and Retention

We protect your data with encryption in transit and at rest. We retain your account data while your account is active. When you delete your account, we deactivate it and remove the personal details on your user profile (such as your name, email, and phone number) promptly. Content you created that belongs to a company workspace, for example job records, recordings, photos, transcripts, and generated scopes and estimates, is retained as business records of that workspace and is permanently deleted 90 days after the workspace is deactivated, or sooner on request, except where longer retention is required by law. For the first 30 days after a workspace is deactivated, its owner can sign in on the web and download an export of its content. When you delete your account, every connection and API key you made ends at once. We cannot delete copies that a connected app already holds. Raw 3D scans move to archive storage 2 days after the capture, and are deleted with the walk, the job or the workspace they belong to (see Section 1.1). A writing style profile is deleted when your company disconnects the software it was learned from, turns data access off, or has its workspace permanently deleted (see Section 1.2). Internal AI request logs are automatically deleted on a rolling 30-day cycle. Records of what connected apps read are deleted after 13 months. To request earlier deletion of specific content, contact us using the details below.

8. Your Rights

You may request access to, correction of, or deletion of your data at any time by contacting us, and we will respond within 30 days. Because Forge's core features are AI-powered, AI processing is required to use the app. You may withdraw your consent at any time in Settings → AI Data Sharing, or by contacting us; withdrawing signs you out and you will be asked to consent again the next time you sign in. Withdrawing does not delete data already processed. You can end any connection you made at any time in Settings. Owners and admins can end any connection in their company, or turn off Data access to end all of them at once. Ending a connection stops future access. It does not delete data the app already read. Withdrawing your AI consent, or your acceptance of our Terms, also ends every connection and API key you made.

9. Cookies

We may use cookies and similar technologies to improve user experience and analyze usage patterns.

10. Changes to Policy

We may update this Privacy Policy at any time. For material changes, we will notify you by email or through the platform at least 14 days before they take effect.

11. Contact

Forge Solutions, Corp. Email: team@forge.equipment