Forge Privacy Policy

Effective Date: July 2026

Blecher LLC ("Blecher LLC," "we," "us," or "our") operates Forge, a supply-chain compliance verification platform ("Forge" or the "Service"). This Privacy Policy describes what information we collect, how we use and store it, with whom we share it, and the choices available to you. It applies to your use of the Service and is incorporated into the Forge Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

1. Information We Collect

We collect the following categories of information:

Bills of Materials (BOMs) and component data. The BOM files, component identifiers, part numbers, manufacturer names, quantities, and related supply-chain data you upload or enter for screening.
Check results and compliance data. Per-component compliance verdicts, screening results, and the regulatory regimes against which you screen, including any custom or imported regimes you configure.
Evidence chains. The supporting records, matched list entries, cited authorities, corporate-structure findings, and reasoning artifacts generated in support of each verdict.
Signed compliance certificates. The certificates the Service generates and cryptographically signs to memorialize a screening outcome.
Account information. Your name, business or entity name, email address, role, authentication credentials (stored in hashed or otherwise protected form), and multi-factor authentication settings.
Payment information. Billing contact details and subscription records. Full payment card numbers are collected and processed by our payment processor, not stored by Blecher LLC.
Usage and technical data. Log data, IP address, device and browser information, feature usage, and diagnostic information used to operate, secure, and improve the Service.

2. How We Use Information

We use the information we collect to: provide, operate, and maintain the Service; perform compliance screening and generate verdicts, evidence chains, and certificates; authenticate users and secure accounts; process subscriptions and payments; provide customer support; monitor, diagnose, and improve the reliability and security of the Service; and comply with legal obligations. We do not use your information for purposes incompatible with those described in this Policy.

3. How Information Is Stored

Structured data — including BOMs, check results, evidence chains, account records, and certificate metadata — is stored in a PostgreSQL database. Sensitive fields, including BYOK credentials and other confidential data elements, are encrypted at rest. Access to production data is restricted to authorized personnel on a need-to-know basis and is subject to access controls and logging. We employ administrative, technical, and physical safeguards designed to protect information against unauthorized access, disclosure, alteration, and destruction; however, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

4. BYOK Inference and Content Handling

Enterprise Users may configure bring-your-own-key ("BYOK") inference, under which AI inference is routed through the User's own foundation-model provider credentials. When BYOK is configured, Forge does not retain the content of inference requests or responses beyond what is transiently necessary to orchestrate the workload and return the result to you. Inference content processed in BYOK mode is subject to the terms and privacy practices of the foundation-model provider you designate, and your relationship with that provider governs that provider's handling of the content. Screening results, verdicts, evidence chains, and certificates that you elect to save remain stored in your account as described in this Policy.

5. Third-Party Subprocessors

We engage a limited set of third-party subprocessors to provide the Service:

Stripe — payment processing and subscription billing.
Resend — transactional email delivery (for example, account, billing, and security notifications).
Anthropic — AI agent inference for entity resolution and related tasks in the default (non-BYOK) mode. When you use BYOK, inference is instead routed to the foundation-model provider you designate, and the applicable provider acts as your subprocessor under your own account.

Each subprocessor is engaged under terms that require appropriate confidentiality and security protections and that limit their use of information to providing services to us.

6. Data Retention

We retain your information for as long as your account is active and as needed to provide the Service. Upon deletion of your account or of specific data, we apply a thirty (30)-day grace period, during which the data may be recoverable, after which it is deleted or de-identified from active systems (residual copies in backups are purged on our ordinary backup rotation). Signed compliance certificates are retained permanently as legal records, because they memorialize a compliance determination that you or third parties may need to evidence; certificate retention persists notwithstanding account deletion. We may also retain information as required to comply with legal obligations, resolve disputes, and enforce our agreements.

7. Data Export

You may export all of your data — including BOMs, check results, evidence chains, and certificates — from the Service in a machine-readable JSON format at any time through your account. This enables you to maintain your own records and to port your data as you see fit.

8. Subprocessor Change Notification

We will provide at least sixty (60) days' advance notice before engaging any new third-party subprocessor that will process your data, by email to your account address or by prominent notice within the Service. This notice period gives you an opportunity to review the change and, if you object, to cancel your subscription in accordance with the Terms of Service before the new subprocessor begins processing.

9. What We Do Not Do

We do not sell your data. We do not sell, rent, or trade your personal information or your User Content to any third party.
We do not use your data for advertising. Forge does not serve advertising and does not share your information with advertising networks.
We do not train on your data. We do not use your BOMs, check results, evidence chains, or other User Content to train, fine-tune, or improve any general-purpose AI model, and our subprocessor terms are structured to prohibit provider training on your content.

10. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or restrict the processing of your personal information, or to object to certain processing. You may exercise many of these rights directly through your account (including data export and deletion), or by contacting us. We will respond to verified requests as required by applicable law.

11. International Transfers

The Service and its subprocessors may process and store information in jurisdictions other than your own. Where we transfer information across borders, we take steps designed to ensure an appropriate level of protection consistent with applicable law.

12. Governing Law

This Privacy Policy and any dispute arising out of or relating to it shall be governed by and construed in accordance with the laws of the Dubai International Financial Centre (DIFC), notwithstanding any conflict of law provisions, consistent with the Forge Terms of Service.

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide notice consistent with the Terms of Service. Your continued use of the Service after the effective date of a change constitutes acceptance of the updated Policy.

14. Contact

For questions about this Privacy Policy or to exercise your rights, contact Blecher LLC.