Data processing agreement

Version of 8 October 2026. Draft for counsel: roles, 30-day sub-processor objection, termination with pro-rata refund. Breach notice remains without undue delay. Annex B says what Serper receives, including decision-makers found in public search results. A workspace may connect its own FullEnrich account. A connected mailbox can send a message its user approves. The send scope in Annex B also covers Autopilot follow-ups inside the workspace's rules. The Autopilot switch does not exist yet, so every send waits for its user's approval. Annex B names Composio, the tool layer that holds a seat's connected apps and runs its reads, and Explee LTD, the built-in B2B database. This version removes ElevenLabs, Inc. and Vainu Finland Oy, which no longer receive anything: Kvasir does not speak aloud today, and Vainu is not a source for the product. It also says that a CRM connection reads and never writes back, that it is not switched on today, and that Slack is not switched on today.

These are Forgeby's standard data-processing terms, and they form part of your agreement. To execute a signed DPA, write to privacy@forgeby.com.

Last updated 8 October 2026

This Data Processing Agreement ("DPA") applies to Zmart Com West AB, Swedish organisation number 559019-9161, trading as Forgeby (a registered name change to Forgeby AB is in progress; it is the same company either way) and a customer in connection with the Forgeby platform (formerly Alloy). It forms part of the agreement between the parties. The two roles below do not collapse into one.

1. Roles and scope

Forgeby is the controller of the library: the company and contact records compiled from the four named sources, the Article 14 notice published for them, and the requests those people send to us.

The customer is the controller of its own outreach: who it writes to, what it says, and the record of anyone who tells it to stop.

Where Forgeby processes the customer's own data on the customer's behalf (workspace accounts, pipeline, a connected mailbox or calendar, CRM sync, meeting capture the customer turns on), the customer is the Controller and Forgeby is the Processor. The rest of this DPA applies to that processing. Subject-matter, duration, nature and purpose, types of personal data and categories of data subjects for that processing are set out in Annex A.

2. Processor obligations (GDPR Art. 28)

Process only on documented instructions from the Controller.
Ensure persons authorised to process are bound by confidentiality.
Implement appropriate technical and organisational measures (Art. 32): see Trust and security.
Engage sub-processors only under Section 3 and flow down equivalent obligations.
Assist the Controller in responding to data-subject requests.
Assist with security, breach notification, and DPIAs (Art. 32-36).
At the Controller's choice, delete or return personal data at the end of the service.
Make available information needed to demonstrate compliance and allow audits.

3. Sub-processors

The Controller grants general authorisation to use the sub-processors listed in Annex B. We will give at least 30 days' prior notice of an intended addition or replacement, by email to the address we hold for the Controller and by updating this page. Objection is sent to privacy@forgeby.com, on reasonable data-protection grounds, within those 30 days. A sustained objection that we cannot accommodate is a ground for the Controller to terminate the processing under this DPA; unused prepaid fees for the remaining term are refunded pro rata.

4. International transfers

Where personal data is transferred outside the EU/EEA, the parties rely on Standard Contractual Clauses and appropriate safeguards. Your workspace, pipeline and contact records are stored in the EU (Stockholm, eu-north-1), and the application that serves them runs in the EU (Stockholm, arn1).

Five sub-processors sit outside the EU/EEA and each is listed in Annex B with its role. Sign-in and identity (WorkOS) holds user email addresses, names and session records in the United States, and holds the token for any mailbox or calendar a partner chooses to connect; that connection can include permission to send mail, and Annex B says when a message may leave. Company and decision-maker research (Serper) receives company names and role words, and a business contact's name when resolving that contact's public professional profile link; what comes back is public search results, from which decision-makers are found. AI inference runs on Amazon Bedrock EU inference profiles by default; the Anthropic API in the United States remains configured as a fallback and for tasks needing live web search, which Bedrock does not offer, and it carried no calls at all in the ten days to 21 August 2026. Connected apps (Composio, a trading name of Sampark, Inc.) holds the connection a seat makes to one of its own apps, such as a CRM, Notion or Drive, and runs each read Forgeby makes on that seat's behalf; what the app returns passes through it, and Composio logs each call. The built-in B2B database (Explee LTD, United Kingdom) receives company domains, company names and search sentences, and, for a lookup of one named person, that person's name and company domain or public professional profile link; what comes back is company and business contact data. Apart from the tokens and the call log Composio keeps, and what Explee keeps of the requests it receives, no customer records are stored outside the EU by any of the five.

5. Personal data breach

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, with the information reasonably available.

6. Liability and term

This DPA follows the term and liability provisions of the main agreement. If the Controller terminates because of a sustained sub-processor objection under section 3, unused prepaid fees for the remaining term are refunded pro rata.

Annex A: Processing details

Subject-matter	Provision of the Forgeby go-to-market platform (formerly Alloy) for companies that sell technology products and services
Nature and purpose	Identifying, enriching, contacting and managing B2B opportunities
Data types	Business contact data: name, title, work email, business phone, professional profile, employer; user account data
Data subjects	The Controller's prospects and business contacts; the Controller's users
Duration	For the term of the agreement

Annex B: Sub-processor list

All Forgeby-operated storage runs in the EU (Stockholm, eu-north-1). Records reach the services marked below only as each row says. AI inference runs in the EU by default, on Amazon Bedrock EU inference profiles, which route each call within EU regions. The Anthropic API in the United States remains configured for tasks needing live web search, which Bedrock does not offer, and as fallback when the EU route is unavailable; it carried no calls in the ten days to 21 August 2026. Sign-in, the tool layer for connected apps, the built-in B2B database, and some company and decision-maker research run outside the EU and are marked below. Customer-connected services run only where a customer chooses to connect them. A workspace admin may connect the workspace's own FullEnrich account. Forgeby then calls FullEnrich with that workspace's key, the same way it reaches a connected mailbox. Each request may carry the contact's name, the company's name and domain, and the contact's public professional profile link where one is held. Results stay in that workspace and are never pooled. FullEnrich Corp is a sub-processor only while a managed FullEnrich key is switched on for Forgeby's own work. That switch is off.

Amazon Web Services	Hosting and deployment; the self-hosted database; AI inference on Amazon Bedrock (EU inference profiles); transactional email for sign-in and service messages (Amazon SES, sending Forgeby's own service mail from alerts@send.forgeby.com; mail to a buyer leaves only from the seller's own connected mailbox); pricing and data APIs. Search embeddings and re-ranking of a workspace's account facts run on Amazon Bedrock in Frankfurt (eu-central-1). Region: EU: Stockholm (eu-north-1) for storage and mail; Amazon Bedrock EU inference profiles, within EU regions, for inference.
Vercel Inc.	Hosting and delivery of the Forgeby web application, which runs on Vercel. Serverless functions are pinned to Stockholm (arn1). Processes request metadata including IP address and user agent in operational logs. Also receives page-load performance measurements through Vercel Speed Insights: the loading metric and its value, the page URL and a connection-speed class. That script sets no cookie and stores nothing in the visitor's browser. Region: EU (Stockholm, arn1).
WorkOS, Inc.	Sign-in and identity for partner users: email address, name and session records. Also brokers the optional mailbox and calendar connection a partner may make to Outlook or Google, and holds the resulting token on that partner's behalf, so that no provider credential reaches Forgeby. A mailbox connection can read and send mail. An email leaves a connected mailbox only when the user who connected it approves it in Forgeby, or when a workspace admin has turned on Autopilot and the message is a follow-up inside that workspace's rules, after a cancel window. The Autopilot switch does not exist yet. A connection without send permission cannot send. Calendars are read. A meeting is booked only if the calendar connection includes write permission, and only after that user approves that specific booking in Forgeby. Transferred under Standard Contractual Clauses. Region: United States.
AssemblyAI, Inc.	Speech-to-text when a user dictates into Kvasir, and when Meeting BaaS delivers a meeting recording for transcription. Dictation audio is sent to AssemblyAI's EU endpoint and is not retained by Forgeby. Meeting audio reaches AssemblyAI through Meeting BaaS. Retention at AssemblyAI is set to one day and their model-improvement programme is opted out, so the audio is never used for training. A short list of names already on the user's screen accompanies dictation audio so that company and contact names are transcribed correctly. Region: EU (Ireland) for dictation. Meeting audio is not pinned through Meeting BaaS as of 26 September 2026.
Serper.dev	Web search, used to read public company pages and company descriptions, and for three further things: resolving a company to its website; resolving a named business contact to their public professional profile link; and decision-makers found in public search results (for example a public professional profile returned by a web search), resolved for companies in the library that have no named contact in that role. Serper's places search also returns a company's public switchboard number, looked up by the company's name. Queries carry company names and role words, and may carry a contact name; what comes back is public search results. Region: United States; transferred under Standard Contractual Clauses.
Anthropic PBC	AI inference for tasks requiring live web search (which Amazon Bedrock does not offer), for streamed responses, and as fallback when the EU route is unavailable. The prompt carries the company being researched and may carry business contact details. Transferred under Standard Contractual Clauses. Not used to train models. Region: United States.
Sampark, Inc. (Composio)	The tool layer for a seat's connected apps. Composio holds the connection a seat makes to one of its own apps, including the resulting OAuth token (or API key, for an app that uses one), and runs each call Forgeby makes to that app on the seat's behalf. Each call carries the arguments Forgeby sends, and what the app returns passes through Composio to Forgeby. Since 7 October 2026 no new connection is made through Composio; the connections made before then keep running. The apps those connections can reach are HubSpot, Salesforce, Pipedrive, Attio, Notion, Linear, Google Drive, OneDrive, SharePoint, Stripe, Google Analytics, Zendesk, Jira, Cal.com and GitHub. Each connection belongs to one seat in one workspace, so one workspace's connection never runs for another. At present only tools Composio marks read-only run; any other tool is refused before it runs. Composio logs each call. Unless payload storage is switched off in Composio's settings, that log holds the call's arguments and results for up to one year. The Composio SDK's anonymous usage analytics are switched off in Forgeby's client. Region: United States. The hosting region is not pinned as of 30 September 2026.
Explee LTD	The built-in global B2B database: company search and company facts, the people in a role at a company, and a named person's work email or phone number. A company request carries a company's domain or name, or a sentence describing the companies or roles sought, and may carry the company domains a workspace already holds so that they are skipped (company domains only, never people). A lookup of one named person carries that person's first and last name and company domain, or their public professional profile link, and nothing else from the workspace. Beyond those company domains, a workspace's accounts, contacts and messages are never sent. What comes back is company and business contact data, which Forgeby marks with its source and date. Explee states that its data comes from the public web, company registers, professional networking sites, map listings and its partners. Region: United Kingdom (London).
SAS Spoke (Meeting BaaS)	Meeting capture for a Google Meet or Microsoft Teams call after the seller switches listening on. The bot joins named (Kvasir), posts one chat notice, and records audio only. AssemblyAI transcribes, as named in this annex. Forgeby then asks Meeting BaaS to delete the bot's data, including at the speech provider. Removal within five minutes keeps no transcript. Zoom stays off until Forgeby's own Zoom app is approved. Region: not pinned through Meeting BaaS as of 26 September 2026.
Slack Technologies	Kvasir in Slack, only for a workspace a customer connects. Messages carry the company and contacts being discussed. Not switched on today: no workspace can connect Slack yet. Region: per customer workspace.
HubSpot, Salesforce	The CRM a seat connects, and only that one, through the seat's own WorkOS connection. Forgeby reads companies, contacts, deals and owners from it with that seat's own token, and never writes back. Not switched on today: no seat can connect a CRM yet. Lime, webCRM and OnePageCRM have no connection. Region: per provider.
Google favicon service	Receives a company's website domain from our server, to draw its logo. Never a person, never who looked.

Questions about this DPA, or a request for a countersigned copy, go to privacy@forgeby.com.