Legal · Privacy policy · Last updated 8 October 2026
Privacy policy
How Forgeby handles personal data: on this website, at the door, and inside the Forgeby platform. If you are here because someone used Forgeby to contact you, or you were told your details are in our records, the page written for you is the privacy notice for business contacts. This policy does not vary that notice.
1. Who we are
Forgeby is a service of Zmart Com West AB, Swedish organisation number 559019-9161, Gothenburg, Sweden. A registered name change to Forgeby AB is in progress; it is the same company either way. That company is the data controller for the personal data described on this page: it decides what is held and why, and it is responsible for it under the General Data Protection Regulation (GDPR).
For privacy matters write to privacy@forgeby.com. For anything else, partner@forgeby.com.
2. What this website collects
When you email us, you actively provide:
- your name
- your company name
- your email address
- the message you choose to send
That data is used solely to respond to you and, where relevant, to discuss a potential engagement. It is not shared with third parties, not sold, and not used for marketing communications.
The site runs one performance script, Vercel Speed Insights, and no visitor analytics. It measures how fast a page loads and sends that measurement, the page URL and a connection-speed class to Vercel, our hosting provider, which is named in Annex B of the data processing agreement. It sets no cookie and writes nothing to your browser, so it cannot recognise you on a later visit, and it does not read the referrer. The cookies page describes exactly what it sends. Until 24 August 2026 this page named Plausible, which was never loaded; that was corrected, and this describes what runs.
Like any web server, ours writes access logs (IP address and browser user agent). They exist for security and abuse prevention only, are not used to profile anyone, and are purged at 90 days.
This site has two forms that collect a work email. The waitlist is so we can tell you when the door opens. The demo workspace request is so the founder can open a workspace by hand. Neither form creates an account or a tenant. A demo-workspace request is the request class: your work email, the company domain you named, and that you consented. The legal basis is that you asked (GDPR Article 6(1)(b)), and you ticked the box. We delete that row when you ask, or when the founder has acted. There is no automatic clock on it. Write to privacy@forgeby.com to withdraw.
3. What we deliberately do not load
There is no cookie banner on this site because there is nothing to consent to. The marketing site loads no advertising tags, no Google Tag Manager, no LinkedIn Insight Tag, and no visitor-identification service such as Albacross. No consent-gated tracker of any kind is loaded. If that ever changes, a consent step will come first and this page will say so. The cookie policy describes the full picture, including the session state the app keeps in your own browser.
4. Before sign-in
The public market search is retired. The site runs no search for visitors, and the only library figures it shows are totals about companies, never about people. The two forms in section 2 are the only way in before sign-in.
5. Signing up and signing in
Sign-up is for B2B sellers and go-to-market teams. You sign in with your work email address; there is no Google login and no social login of any kind. At sign-up we verify the domain of your email address is a company mailbox; a personal mailbox does not get an account.
What we process for your account: your work email address, your name, and the company you sign up under. The legal basis is GDPR Article 6(1)(b): taking steps at your request before entering a contract, and then performing it. In your browser, the app keeps your sign-in session in a first-party HttpOnly cookie, and your interface preferences in local storage. Neither is a tracking mechanism. Detail is in the cookie policy.
6. The Forgeby platform and customer data
Separately from this website, we operate the Forgeby platform (formerly Alloy) for those customers. In the platform, Forgeby processes business-contact data of prospects (name, work title, business email and phone, public professional profile, employer) to identify and manage B2B opportunities. For business prospecting the lawful basis is legitimate interest (documented, and available on request). Forgeby is the controller for the library. You are the controller of your own outreach. Where Forgeby processes a customer's own data on their behalf, Forgeby acts as a data processor under our Data Processing Agreement.
Workspace records are stored in Stockholm (eu-north-1) and encrypted in transit and at rest, with row-level isolation between customers. The services that run outside the EU are named in section 8 and in Annex B. Public pages show people by role only. People open inside a workspace, behind sign-in, with a named owner and a route out.
When a seat connects a CRM, Forgeby reads companies, contacts, deals and owners from it with that seat's own token, under the customer's own instructions, and never writes back. The CRMs a seat will be able to connect are HubSpot and Salesforce, through WorkOS; that connection is not switched on today. Lime, webCRM and OnePageCRM have no connection. Each CRM processes that data under its own terms, and where a connected CRM processes data outside the EU/EEA the transfer is covered by Standard Contractual Clauses.
A workspace admin may connect the workspace's own FullEnrich account. Forgeby then calls FullEnrich with that workspace's key, the same way it reaches a connected mailbox. Results stay in that workspace and are never pooled. FullEnrich Corp is a sub-processor only while a managed FullEnrich key is switched on for Forgeby's own work. That switch is off.
If a customer switches listening on, Kvasir from Forgeby may join a Google Meet or Microsoft Teams call named, post a chat notice, and take notes. SAS Spoke (Meeting BaaS) records the audio. AssemblyAI transcribes it. The processing region is not pinned through Meeting BaaS as of 26 September 2026. Removal within five minutes deletes the capture. A follow-up from the meeting leaves only under the mailbox rules below. Zoom stays off.
A partner may connect their own mailbox and calendar, Outlook or Google, so that Kvasir can prepare a meeting before they walk into it, and so that a message or a meeting can leave from their own account under the rules below. It is optional, it is never a condition of using Forgeby, and one person connects it for their own seat rather than for a company. The sign-in is brokered by WorkOS, which holds the resulting token; Forgeby never receives or stores a mailbox password or any other provider credential.
A mailbox connection can read and send mail. A connected mailbox lets a message leave from your own account when you approve it, or when your admin has turned on Autopilot and the message is a follow-up inside your workspace's rules, after a cancel window. The Autopilot switch does not exist yet, so today every message waits for your approval. A connection without send permission cannot send. Calendars are read. A meeting is booked only if the calendar connection includes write permission, and only after that user approves that specific booking in Forgeby.
What Forgeby actually reads is narrower than the connection allows:
- from the calendar, the events in the day being prepared
- from the mailbox, for a meeting brief, the subject line, the sender and the date only, and only for the outside people attending that meeting, at most five messages each
- from the mailbox, when the partner asks Kvasir to read the inbox, a short preview of recent messages
A meeting brief is read at the moment it is asked for. When the partner asks for an inbox preview, this app stores that preview in the record of what was said for the workspace they have chosen. Each row holds the sender, the date, the provider message id, and the preview text: the Gmail snippet or the Outlook body preview, at most 8,000 characters. The write uses that seat's own token and that workspace's tenant id. A later read uses a token that can see that tenant. A caller who cannot see that tenant is refused. The row is keyed to the seat that connected the mailbox. This app does not delete those rows when the mailbox is disconnected, and it does not run a retention clock on them. A partner can disconnect a mailbox or a calendar at any time from the integrations page, which withdraws that access.
Google Workspace data, and the Limited Use rule. Forgeby's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms, and these are commitments rather than a restatement: Gmail and Google Calendar data reaches a human only when that person asks Kvasir to prepare their own meeting or to read their own mailbox; it is never sold, never transferred to anyone except to provide or improve that feature at the partner's direction or where the law requires it, and it is never used to train generalised or foundation models. A meeting brief is read to answer one question. An inbox preview the partner asks for is stored in that workspace's record of what was said, as set out above.
7. Business contacts, and where their data came from
Some of what the platform holds is business contact information we did not collect from the person it describes. GDPR Article 14 requires us to tell those people what we hold, where it came from, why, and how to make it stop. The authoritative version of that is the privacy notice for business contacts. In brief, the sources are four: public company records (the public business registers: Bolagsverket and SCB in Sweden, Brønnøysund in Norway, PRH in Finland, Companies House in the United Kingdom, and each other market's own register), licensed business-data providers, public web pages and public search results (web pages are read by the Forgeby crawler, which names itself in your logs and obeys robots.txt, and decision-makers found in public search results, including public professional profiles those results return, are resolved by Serper), and our founder's own professional network export. We do not log in to or crawl a social network. We hold professional information in a professional context only: no home addresses, no personal email, nothing about anyone's private life, and we profile companies, not people.
Some register rows describe a sole trader: a person trading under his or her own name. In Sweden that is an enskild firma, whose organisation number is the owner’s personal identity number. We do not use sole-trader register rows for outreach. They are suppressed, so they never appear in a search or a list.
The right to object to direct marketing is absolute. One email to privacy@forgeby.com saying “opt out” is the whole process. We stop, we do not ask why, and we record the objection so a later import cannot undo it.
8. Where data lives, and the AI that touches it
Forgeby's own database lives in the EU, self-hosted on Forgeby's AWS infrastructure in Stockholm (eu-north-1). Some services named in section 9 keep data in the United States: WorkOS holds sign-in records and mailbox tokens, and Composio keeps connected-app tokens and a call log. AWS acts as a data processor under GDPR Article 28. Forgeby's own service mail is sent through Amazon SES in Stockholm, from alerts@send.forgeby.com. Mail to a buyer leaves only from the seller's own connected mailbox. The website and the Forgeby web application run on Vercel, with serverless functions pinned to Stockholm (arn1).
AI processing runs on Amazon Bedrock using EU inference profiles, which route each call within EU regions; search embeddings for account facts run in Frankfurt (eu-central-1). For tasks that need live web search, and as a fallback when the EU route is unavailable, one model path runs with Anthropic PBC in the United States under Standard Contractual Clauses. A prompt on that path can carry the company being researched and business contact details; it is not used to train models.
Email correspondence is hosted by GoDaddy, the domain and email provider for Forgeby's mailboxes. Their practices are described at godaddy.com/legal. Transfers outside the EU are safeguarded under standard contractual clauses where they occur.
9. Sub-processors
The full, current sub-processor list is Annex B of the Data Processing Agreement. In summary: Amazon Web Services (hosting, database, AI inference via Amazon Bedrock, transactional email, EU Stockholm), Vercel Inc. (hosting of the web application and page-load performance measurement, EU Stockholm), WorkOS, Inc. (sign-in, identity and the optional mailbox and calendar connection, United States, Standard Contractual Clauses), AssemblyAI, Inc. (speech-to-text when a user dictates, EU Ireland), Serper.dev (web search to read public company pages and descriptions, for a company's website, a business contact's public professional profile link, and decision-makers found in public search results, and a company's public switchboard number, United States, Standard Contractual Clauses), Anthropic PBC (AI inference for tasks needing live web search and as fallback, United States, Standard Contractual Clauses), Sampark, Inc., trading as Composio (the tool layer that holds a seat's connections to its own apps and runs the read-only calls Forgeby makes on that seat's behalf; each call's content passes through it and is logged; no new connection is made through it since 7 October 2026, United States), Explee LTD (the built-in global B2B database: company and business contact data, work emails and phone numbers; a lookup of one named person carries that person's name and company domain or public professional profile link, United Kingdom), SAS Spoke (meeting capture after the seller switches listening on; region not pinned through Meeting BaaS as of 26 September 2026), Slack Technologies (Kvasir in Slack, only for a workspace a customer connects; not switched on today), the CRM a seat chooses to connect (HubSpot or Salesforce, read only, each per its own region; not switched on today), and a workspace's own FullEnrich account when an admin connects it. FullEnrich Corp is a sub-processor only while a managed key is on. That switch is off. Kvasir does not speak aloud today, so no voice-synthesis service receives anything. Customers get at least 30 days' prior notice of an intended addition or replacement. Objection is sent to privacy@forgeby.com. A sustained objection that we cannot accommodate is a ground to terminate; unused prepaid fees for the remaining term are refunded pro rata. The procedure is in section 3 of the data processing agreement.
Google favicon service: receives a company's website domain from our server, to draw its logo. Never a person, never who looked.
10. How long data is kept
| Inquiry correspondence | Up to 24 months from the last interaction, then deleted. |
|---|---|
| Engagement records | For the duration of the engagement, then for the period required by Swedish accounting law (typically 7 years). |
| Access logs | Purged at 90 days. |
| Waitlist address | Until you withdraw consent. Withdrawal deletes the row. |
| Demo workspace request (request class) | Until you ask us to delete it, or the founder has acted. No automatic clock. |
| Account data | For the life of the account; deleted when the account closes, except what the accounting row above requires us to keep. |
| Business-contact records | For as long as the information remains professionally relevant, reviewed periodically. After an objection, only the minimum needed to make sure the person is not added again. Detail in the privacy notice. |
11. Your rights under GDPR
You have the right to:
- request access to the personal data Forgeby holds about you
- request correction of inaccurate data
- request deletion of your data (the “right to be forgotten”)
- object to processing, or request restriction of processing
- request your data in a portable format
- withdraw consent at any time, where processing rests on consent (for example, a recorded meeting)
- lodge a complaint with the Swedish Authority for Privacy Protection (IMY), or with the supervisory authority where you live
To exercise any of these rights, email privacy@forgeby.com. Requests are handled within 14 days, half the one month the law allows.
12. Changes to this policy
This policy may be updated as Forgeby's practices evolve. The date at the top of this page reflects the most recent revision, and a change never lowers a protection described here without notice.
13. Contact
For any privacy-related question or request:
Forgeby, a service of Zmart Com West AB (org.nr 559019-9161), Gothenburg, Sweden
privacy@forgeby.com