Legal
Privacy Policy
ForgeTheStack LLC's collection, use, and protection of information.
Last updated: October 20, 2026
1. Information We Collect
We collect information you provide directly, including:
- Name, email address, phone number, and business name when you contact us or create an account
- Billing and payment information processed securely through Stripe
- Communications you send to us (emails, contact form submissions, comments, and optional attachments)
- Account credentials and preferences when you use our client portal
We automatically collect:
- Usage data including pages visited, time on site, and referring URLs
- Device information including browser type, operating system, and screen size
- IP address and approximate geographic location
- Limited automation signals used to route and prioritize legitimate inquiries
2. How We Use Your Information
- To provide, maintain, and improve our services
- To process payments and send billing-related communications
- To communicate with you about your project or account
- To send promotional communications only when you opt in
- To monitor and analyze usage trends and preferences
- To protect against fraud and unauthorized access
3. Information Sharing
We do not sell your personal information. We may share information with carefully selected service providers that process it on our behalf:
- Infrastructure: Vercel for hosting and delivery, and our configured database provider for lead, account, and portal records.
- Payments: Stripe for secure payment processing. We do not store complete payment-card numbers.
- Communications: Resend and, where configured as a fallback, Zoho SMTP for transactional email.
- Analytics and performance: Google Analytics loads after opt-in and records page views, engagement, and Forge events for CTA clicks, qualification submissions, booked calls, quiz assignments, project-wizard starts and submissions, and audit submissions and completions. Those events use an allowlist of context parameters: CTA ID and placement, funnel stage, quiz variant or page, static source, and selected-goal or feature counts. They do not send form text, contact details, CTA destinations, user-submitted URLs, budgets, estimates, booking times, or raw project selections. PostHog records site-wide page views and page exits (autocapture is off), custom marketing events, and server-side contact, audit, booking, lead-conversion, and QR-scan events. Custom events can include CTA destinations, qualification choices such as intent, industry, budget range, launch timing and referral source, project quiz or wizard selections and estimates, booking interest, and audit source, website host, and score. Contact analytics can use email as an identifier and include name, business name, selected project options, industry, referral/campaign and landing-page details, device category, and attachment count; they do not include the contact message, phone number, or uploaded-file contents. Audit events may include the submitted website URL and score. Booking events may include email as an identifier, service, staff, start time, payment method, and appointment or client IDs. Conversion events may include email, name, business name, internal client ID, business type, template, revenue, and lead source. QR-scan events use a QR slug and campaign, source, medium, and landing-path details. Vercel Analytics and Speed Insights run when enabled by deployment configuration.
- Session replay: Microsoft Clarity loads after opt-in on selected public marketing routes to create heatmaps and session recordings. It is not initialized on other routes; if a visitor navigates there from an eligible route, the page is masked and Clarity receives denied storage consent. When storage consent is denied, Microsoft documents that Clarity may continue limited, non-persistent tracking.
- Automation: An n8n workflow webhook when configured to route and follow up on qualified inquiries.
- AI-assisted review: Our AI gateway/provider may process contact details, message content, industry, business context, and attachment metadata to assess safety and help prioritize legitimate inquiries. Uploaded file contents are not included in that analysis payload.
- Legal requirements: When required by law, legal process, or to protect our rights.
- Business transfers: In connection with any merger, acquisition, or sale of assets.
4. Data Security
We implement industry-standard security measures including SSL/TLS encryption, secure payment processing through Stripe, and access controls on our systems. However, no method of transmission over the Internet is 100% secure.
5. Contact Submissions and Automated Processing
When you submit our contact form, we use the information you provide to respond to your inquiry, prevent abuse, qualify the request, and coordinate follow-up. This may include your name, email address, business details, message, selected project options, referral and campaign information, device category, and the number and types of attached files.
We may use automated tools, including AI-assisted safety and lead analysis, to help identify spam or phishing, summarize an inquiry, and suggest follow-up questions. These tools support human review and do not make decisions about your legal rights, eligibility, or access to essential services.
Do not upload passwords, payment-card information, government identifiers, or other sensitive information that is not needed for your inquiry.
6. Client Data Processed to Provide Services
When we provide website, hosting, maintenance, or portal services, a business client may ask us to process personal data about its customers, staff, or site visitors. The client is responsible for determining its lawful basis, providing required notices, and giving documented instructions. Our role depends on the data and service; a signed agreement or data-processing addendum will define the parties' roles and processing details where applicable.
We use client data only to provide, secure, maintain, and support the contracted services or as required by law. Access is limited to authorized personnel and relevant service providers. Return, deletion, retention exceptions, incident cooperation, and data-subject assistance are addressed in the applicable signed agreement or addendum.
Do not send sensitive personal data unless it is necessary for the contracted service and the parties have agreed on appropriate handling terms.
7. Your Rights
You have the right to access, export, delete, or opt out of communications at any time. Use the self-service tools below or email us at contact@forgethestack.com. We target a response within 30 days after verifying request ownership.
Request a copy of all personal data we hold on file for your email address. We'll email you a JSON export within minutes.
Request permanent deletion of your data. We'll email you a confirmation link that's valid for 7 days. Deletion is irreversible.
Opt out of all Forge The Stack marketing and nurture emails. You'll still receive transactional emails related to any active project.
8. Data Retention
We retain personal information only as long as needed for operational, contractual, security, and legal purposes. Contact inquiries and related files are retained for follow-up, support, and compliance recordkeeping, then removed when no longer necessary under our retention schedule.
9. Cookies
We use essential cookies for authentication and session management. We may also use analytics cookies to understand how visitors use our site. See our Cookie Policy for details.
10. Changes to This Policy
We may update this policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the “Last updated” date.
11. Contact Us
If you have questions about this privacy policy, please contact us at contact@forgethestack.com.