ForgeStack AI

Privacy notice

Last updated: 7 October 2026

This notice explains how ForgeStack AI Ltd (“ForgeStack”, “we”) handles personal data in connection with this website and the ForgeStack Evidence Packs service. Evidence Packs is no longer accepting new sign-ups; this notice covers the data the service already holds and the data we still process while existing users can sign in, until 30 November 2026.

Who we are

ForgeStack AI Ltd is a company registered in England and Wales (company number 16419264). Registered office: 128 City Road, London, EC1V 2NX, United Kingdom. For privacy questions or requests, contact support@forgestack.ai.

We are the controller for account, billing, support and website data. Where a customer used the service to capture content from their own workspaces (for example Slack messages, GitHub or Jira items, or forwarded emails), we process that content on the customer's behalf and on their instructions.

What we collect

  • Account data: email address and a password, which is stored only in hashed form by our authentication provider.
  • Content captured by customers: messages from Slack channels the ForgeStack bot was invited to; GitHub issues, commits and pull requests; Jira issues and status changes; emails forwarded to a ForgeStack address; and the evidence packs, receipts and bundles built from them. This can include names, usernames and email addresses of the people involved.
  • Integration credentials: access tokens for connected Slack, GitHub and Jira accounts, encrypted with keys held in Microsoft Azure Key Vault.
  • Billing data: plan and subscription status. Card details are collected and held by Stripe, not by us.
  • Support and enquiry forms: the name, email address, company, role and message you submit. These are sent to our company mailbox by email; the website does not store them in a database.
  • Shared verification pages: when a customer shares an evidence record, its evidence ID, hash, date and the sharer's display name are shown to anyone with the link.
  • Technical data: IP address, browser details and request logs kept by our hosting and authentication providers for security and troubleshooting.

Why we use it and our lawful basis

  • To provide the service to existing users, including sign-in and receipt verification: performance of a contract.
  • To process customer content on the customer's instructions: as their processor, under our contract with them.
  • To classify captured messages with an AI model, as part of the service: performance of a contract.
  • To handle billing and keep financial records: performance of a contract and legal obligation.
  • To answer support and enquiry messages: our legitimate interest in responding to people who contact us.
  • To keep the service secure and working: our legitimate interest in operating a secure service.

Who we share it with

We use these service providers, who process data on our behalf:

  • Microsoft Azure: application hosting, logs and key management (UK South region).
  • Supabase: database and authentication (data stored in the EU, Ireland).
  • Stripe: payments and subscription billing.
  • Resend: sending and receiving email for the service (sending via Amazon SES in the EU).
  • Namecheap (Private Email): hosts our forgestack.ai mailboxes, which receive support and enquiry messages.
  • Anthropic: AI classification of captured messages (United States).

Slack, GitHub and Atlassian (Jira) are sources a customer chose to connect; we read from them using the customer's authorisation. We do not sell personal data.

International transfers

Some providers are based in, or process data in, the United States. The safeguards they use are:

  • Stripe: the UK Extension to the EU–US Data Privacy Framework, or where that does not apply, the UK International Data Transfer Addendum to the Standard Contractual Clauses.
  • Resend: the UK Extension to the EU–US Data Privacy Framework, and the Standard Contractual Clauses with the UK Addendum.
  • Anthropic and Supabase: the Standard Contractual Clauses with the UK Addendum issued by the Information Commissioner.
  • Namecheap: the safeguards set out in the provider's data processing terms; a copy is available on request.

Microsoft Azure hosts the application in the UK.

How long we keep it

Because the service is closed to new users, we will keep account data and customer content until 31 December 2026, then delete it, unless you ask us to delete or export it sooner. We keep billing records for six years, as UK company and tax law requires. Support emails are kept for up to 24 months.

Cookies

We use only the cookies our authentication provider needs to keep you signed in. We do not use analytics or advertising cookies.

Your rights

You can ask for access to, correction of, deletion of, or a copy of your personal data, and you can object to or ask us to restrict certain processing. Email support@forgestack.ai. If your data was captured by one of our customers, we will pass your request to them and help them respond.

You can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint. We would appreciate the chance to address your concern first.