Privacy Policy

The Forge ("we", "us", "the Service") is a construction management platform operated from Alberta, Canada. This policy explains what information we collect, why we collect it, and how it is protected. We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

Information we collect

• Account information — your name, email address, phone number, and role within your company.
• Company business data — jobs, estimates, proposals, invoices, customer contact details, schedules, purchase orders, and related records your company creates in the Service.
• Job-site photos — photos uploaded to document work, which may include the time and GPS location where they were taken.
• Time and location records — clock-in/clock-out times and, where your company enables it, the GPS position at clock-in used to confirm presence at a job site.
• Safety and compliance records — hazard assessments, permits, incident reports, acknowledgments, and signatures.
• Employment documents — onboarding documents, employment agreements, policy acknowledgments, electronic signatures, and — where your employer uses the feature — completed government tax credit forms (TD1), which include your Social Insurance Number. Completed tax forms are stored in access-restricted storage visible only to you and your company's management, and their contents are never written to our general database.
• Technical information — device and browser information, IP addresses on signed documents (part of the signature record), and logs needed to run and secure the Service.

Google user data (Gmail connection)

If you choose to connect a Gmail account, we request only the permission to send email on your behalf (the gmail.send scope) and to read your email address. We use this access solely to send the emails you explicitly compose or trigger in the Service — such as proposals and invoices to your customers — from your own address, so replies come back to you.

• We never read, scan, or store the contents of your inbox.
• We store only an encrypted refresh token, used to authorize sending; it is encrypted at rest and can be revoked at any time from Settings → Email or from your Google Account permissions page.
• We do not sell Google user data, use it for advertising, or allow humans to read it except with your explicit consent, for security purposes, or where required by law.

The Forge's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use information

• To provide the Service: estimating, proposals, scheduling, time tracking, safety compliance, document signing, and payroll support for your company.
• To send emails and notifications you or your company trigger.
• To secure the Service, prevent abuse, and meet legal obligations.

We do not sell personal information. Ever.

How information is shared

• Within your company — data you create is visible to teammates according to the roles and permissions your company sets. Every company's data is isolated from every other company's.
• People you share with — when your company shares a link (a proposal, a photo gallery, safety documentation), the recipient sees only what was granted on that link.
• Service providers — we use infrastructure and processing providers who handle data on our behalf under their own security and privacy commitments, sharing only what is necessary to run the Service. These include Vercel (hosting), Supabase (database and file storage), Anthropic (AI processing of photos, receipts, and documents you submit — for text extraction and drafting; your content is not used to train their models), Sentry (error monitoring), and Resend (transactional email).
• Legal requirements — if required by law, subpoena, or to protect safety and rights.

Security

All traffic is encrypted in transit (TLS). Data is stored with per-company row-level isolation. Sensitive credentials such as email tokens are encrypted at rest. Completed tax forms live in a separate restricted store accessible only to the employee and their company's management. Signature records retain the signer's name, timestamp, IP address, and the exact document text signed, and cannot be altered after signing.

Retention and deletion

Your company controls its business records and may delete documents, photos, and records from the Service. Some records — signed employment documents, tax forms, payroll and safety records — may need to be retained for periods required by employment, tax, and occupational health and safety law before deletion. To request deletion of your personal information, contact us or ask your company administrator; we honour deletion requests subject to those legal retention requirements.

Your rights

You may request access to, correction of, or deletion of your personal information, and you may withdraw consents (such as the Gmail connection) at any time. Contact support@theforgeapp.ca and we will respond within 30 days.

Children

The Service is built for working construction companies and is not directed at children under 16.

Changes

If we make material changes to this policy we will update this page and note the new date above. Continued use of the Service after changes take effect constitutes acceptance.

Contact

Privacy questions: support@theforgeapp.ca