Privacy Policy

The Forge ("we", "us", "the Service") is a construction management platform operated from Alberta, Canada. This policy explains what information we collect, why we collect it, and how it is protected. We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

Information we collect

• Account information: your name, email address, phone number, and role within your company.
• Company business data: jobs, estimates, proposals, invoices, customer contact details, schedules, purchase orders, and related records your company creates in the Service.
• Job-site photos: photos uploaded to document work, which may include the time and GPS location where they were taken.
• Time and location records: clock-in/clock-out times and, where your company enables it, the GPS position at clock-in used to confirm presence at a job site.
• Safety and compliance records: hazard assessments, permits, incident reports, acknowledgments, and signatures.
• Employment documents: onboarding documents, employment agreements, policy acknowledgments, electronic signatures, and completed government tax credit forms (TD1) where your employer uses the feature. These include your Social Insurance Number. Completed tax forms are stored in access-restricted storage visible only to you and your company's management, and their contents are never written to our general database.
• Technical information: device and browser information, IP addresses on signed documents (part of the signature record), and logs needed to run and secure the Service.

Email connection (Gmail and Outlook)

If you choose to connect a Gmail or Outlook account, The Forge asks for access to read, organise and send mail in that mailbox (Gmail: the gmail.modify scope; Outlook: Mail.ReadWrite and Mail.Send), plus your email address. We use this access only to:

• show your inbox inside The Forge and sort it into folders (opening a Gmail message files it under a Forge label and archives it out of your Gmail inbox);
• draft replies with AI (Anthropic) that you review and choose whether to send;
• send the proposals, invoices and emails you compose or trigger, from your own address, so replies come back to you.

• Your mail is visible only to you, unless you deliberately connect a shared company mailbox.
• We store an encrypted refresh token; it is encrypted at rest and can be revoked at any time from Settings → Email or from your Google / Microsoft account permissions page.
• We never sell mail data, use it for advertising, or allow humans to read it except with your explicit consent, for security purposes, or where required by law.

The Forge's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use information

• To provide the Service: estimating, proposals, scheduling, time tracking, safety compliance, document signing, and payroll support for your company.
• To send emails and notifications you or your company trigger.
• To secure the Service, prevent abuse, and meet legal obligations.

We do not sell personal information. Ever.

How information is shared

• Within your company: data you create is visible to teammates according to the roles and permissions your company sets. Every company's data is isolated from every other company's.
• People you share with: when your company shares a link (a proposal, a photo gallery, safety documentation), the recipient sees only what was granted on that link.
• Service providers: we use infrastructure and processing providers who handle data on our behalf under their own security and privacy commitments, sharing only what is necessary to run the Service. These include Vercel (hosting), Supabase (database and file storage), Anthropic (AI processing of photos, receipts, and documents you submit, for text extraction and drafting; your content is not used to train their models), Sentry (error monitoring), and Resend (transactional email).
• Legal requirements: if required by law, subpoena, or to protect safety and rights.

Security

All traffic is encrypted in transit (TLS). Data is stored with per-company row-level isolation. Sensitive credentials such as email tokens are encrypted at rest. Completed tax forms live in a separate restricted store accessible only to the employee and their company's management. Signature records retain the signer's name, timestamp, IP address, and the exact document text signed, and cannot be altered after signing.

Retention and deletion

Your company controls its business records and may delete documents, photos, and records from the Service. Some records, such as signed employment documents, tax forms, payroll and safety records, may need to be retained for periods required by employment, tax, and occupational health and safety law before deletion. To request deletion of your personal information, contact us or ask your company administrator; we honour deletion requests subject to those legal retention requirements.

Your rights

You may request access to, correction of, or deletion of your personal information, and you may withdraw consents (such as the Gmail connection) at any time. Contact support@theforgeapp.ca and we will respond within 30 days.

Children

The Service is built for working construction companies and is not directed at children under 16.

Changes

If we make material changes to this policy we will update this page and note the new date above. Continued use of the Service after changes take effect constitutes acceptance.

Contact

Privacy questions: support@theforgeapp.ca