FORGE Privacy Policy

Effective date: August 15, 2026
Last updated: August 15, 2026

This Privacy Policy explains how we collect, use, disclose, retain, and otherwise process personal information in connection with this service (the "Service").

Operated by Mediator Solutions LLC.

Privacy questions and privacy-rights requests may be sent to reach@prime88.studio.

1. Scope and roles

FORGE is designed primarily for businesses and people acting on behalf of businesses. In operating the Service, we may process two broad categories of information:

Account and service information about our own users and visitors. For this information, Mediator Solutions generally determines the purposes and means of processing and acts as the business, controller, or similar responsible entity under applicable privacy law.
Customer Data placed into FORGE by a customer. This may include information about the customer's own clients, employees, contractors, vendors, jobs, invoices, photos, notes, and business contacts. For Customer Data, the customer generally determines why the data is in FORGE and how it will be used. In that context, the customer is generally the business or controller, and Mediator Solutions acts as a service provider or processor on the customer's behalf, subject to our Terms and any applicable Data Processing Addendum.

If you are an individual whose information was entered into FORGE by one of our customers, the fastest way to exercise rights about that Customer Data is usually to contact the business that entered the information. We will reasonably assist our customer with verified requests where required by applicable law and contract.

2. Information we collect

The information we collect depends on how you interact with FORGE and which features are active for your account or market.

2.1 Account and identity information

We may collect:

email address;
account identifier and internal user ID;
sign-in timestamps and last-login information;
authentication request information;
information required to verify a login request or protect against abuse;
team invitation email addresses and invitation status;
business membership and account-role information, such as owner or member.

FORGE currently uses passwordless email sign-in. A six-digit sign-in code is generated, a cryptographic representation of that code is stored for verification, and the code expires after a limited period. We do not need your password because the current authentication flow does not require one.

2.2 Business profile information

We may collect information you provide about the business you operate through FORGE, including:

business name;
market or locale selection;
business logo, seal, or brand image;
team membership;
account and subscription configuration;
capacity or entitlement information associated with the account.

2.3 Client and contact information entered by customers

Customers may enter or upload information about their own clients, customers, vendors, or business contacts, including:

names;
business names;
phone numbers;
email addresses;
service or job addresses;
notes and descriptions;
related job, estimate, invoice, payment-status, or receipt information.

Customers are responsible for having an appropriate legal basis, authority, or business reason to place third-party personal information into FORGE and for providing any notices they are required to provide to those individuals.

2.4 Job, work, invoice, and operational information

Depending on the features used, we may process:

job titles and descriptions;
job status;
service addresses;
due dates;
estimates, quoted values, invoice amounts, invoice numbers, and payment status;
free-form notes;
records indicating that an invoice was marked paid or void;
generated invoices, receipts, or related PDF documents;
uploaded job photos;
business logos or other images uploaded for use in the Service.

FORGE is a recordkeeping and business-management tool. It is not a bank, accounting firm, tax adviser, law firm, healthcare record system, or payment-card vault. Customers should not use free-form fields or uploads to store information that is unnecessary for the business purpose of the Service.

2.5 Billing and transaction information

Paid subscriptions and add-ons may be processed through Stripe or another disclosed payment provider. We may receive or maintain information such as:

Stripe customer identifier;
subscription identifier or subscription status;
plan and entitlement information;
current billing period or renewal information;
transaction status;
limited payment metadata supplied by the payment provider;
records necessary to reconcile payment events and prevent duplicate webhook processing.

Payment-card numbers, bank-card security codes, and similar full payment credentials are collected and processed by the payment provider rather than stored by the ordinary FORGE application database.

2.6 Support and communications

If you contact us, we may collect:

your name and email address;
business or account details you choose to provide;
support request content;
attachments or screenshots you provide;
correspondence history;
information reasonably necessary to diagnose the issue or respond to you.

2.7 Device, network, log, and security information

When you use the Service, our systems and infrastructure providers may automatically process technical information such as:

IP address;
browser type and version;
device type and operating system;
request timestamps;
requested URL or route;
referring URL where available;
error logs and diagnostics;
session and security-event information;
abuse-prevention and rate-limit signals;
approximate geographic information inferred from network information where supplied by infrastructure providers.

We use this information primarily to operate, secure, troubleshoot, and improve the Service rather than to build advertising profiles.

2.8 Cookies and similar technologies

FORGE uses or may use browser cookies, local storage, or similar technologies for functions such as:

secure session continuity;
authentication;
fraud and abuse prevention;
remembering necessary service state;
maintaining checkout or billing continuity;
preserving user-interface preferences;
measuring service health or product usage where an analytics feature has been deliberately enabled.

See the FORGE Cookie Notice for additional information.

3. Sensitive information and information you should not upload

FORGE is not designed as a general repository for highly sensitive regulated data. Unless we expressly agree otherwise in writing, do not use FORGE to store or transmit:

Social Security numbers or equivalent government identifiers;
full payment-card numbers or card security codes;
online banking credentials;
account passwords or private cryptographic keys;
protected health information subject to HIPAA where a business associate agreement would be required;
biometric templates used for identification;
precise geolocation unless genuinely necessary to a supported business workflow;
highly sensitive information about children;
information whose storage in a general business-management application would violate a professional, statutory, contractual, or regulatory restriction applicable to you.

If you choose to enter unnecessary sensitive information into a free-form field or upload, you do so contrary to the intended design of the Service and may violate the Terms.

4. How we use information

We may use personal information and Customer Data to:

4.1 Provide the Service

create and maintain accounts;
authenticate users;
send sign-in codes;
accept valid team invitations;
create and manage business workspaces;
store and display customer-entered client and job information;
generate invoices and receipts;
process and verify file-upload requests;
provide billing and subscription functionality;
deliver requested features and customer support.

4.2 Secure the Service

detect, investigate, and prevent unauthorized access;
enforce rate limits and sign-in attempt limits;
detect abuse, fraud, malicious traffic, and prohibited conduct;
validate access permissions to businesses, jobs, files, and records;
maintain logs reasonably necessary for security and incident response;
investigate potential violations of the Terms or Acceptable Use Policy.

4.3 Operate billing and account administration

create and reconcile subscription records;
connect accounts with payment-provider customer records;
determine whether base service or purchased capacity is active;
process billing events and account status;
communicate about payment failures, renewals, or subscription changes;
comply with accounting, tax, and legal recordkeeping obligations.

4.4 Communicate with users

send transactional sign-in messages;
send requested support communications;
provide service, security, legal, or billing notices;
respond to inquiries;
communicate material changes to the Service or applicable terms.

We may send marketing communications where permitted by law, but transactional authentication, security, billing, and legal notices are not marketing messages.

4.5 Maintain and improve the Service

diagnose technical failures;
understand reliability and performance;
improve workflows and usability;
develop and test service improvements;
perform internal analytics that are reasonably related to operating FORGE.

We do not use Customer Data to train a general-purpose public artificial-intelligence model unless we first change this Policy and obtain any consent or contractual authorization required by law.

4.6 Comply with law and protect rights

We may process information when reasonably necessary to:

comply with legal process or lawful government requests;
establish, exercise, or defend legal claims;
enforce agreements;
protect the rights, property, safety, or security of FORGE, Mediator Solutions, our customers, users, or others;
investigate fraud or security incidents;
complete a corporate transaction as described below.

5. Sources of personal information

We may obtain personal information from:

you directly;
the business that owns or administers your FORGE workspace;
another user who invites you to a workspace;
a customer that enters information about its own clients or contacts;
payment providers;
email-delivery providers;
hosting, security, and infrastructure systems;
device and browser interactions with the Service;
support communications;
legally available sources where reasonably necessary for fraud prevention, security, compliance, or account verification.

We are not a data broker and do not operate FORGE to assemble dossiers about people with whom we have no direct or customer-mediated relationship.

6. How we disclose information

We may disclose personal information as described below.

6.1 Service providers and subprocessors

We use service providers to operate the Service. Those providers are listed in the FORGE Subprocessors document.

These providers may process information only to the extent needed to perform the services we request, subject to their contractual terms and applicable law. Some providers, particularly payment providers, may also process certain information as independent businesses or controllers for their own fraud-prevention, compliance, or legal obligations.

6.2 Within a customer's workspace

Information entered into a business workspace may be visible to authorized owners and members of that workspace according to their role and the product's access controls. Customers are responsible for deciding whom they invite and for revoking access when appropriate.

6.3 Professional advisers

We may disclose information to lawyers, accountants, auditors, insurers, security consultants, or similar advisers where reasonably necessary for legitimate business, legal, security, or compliance purposes and subject to appropriate duties of confidentiality.

6.4 Legal and safety disclosures

We may disclose information if we reasonably believe disclosure is necessary to comply with law, subpoena, court order, valid legal process, government request, or to protect rights, safety, systems, or users.

6.5 Business transactions

If Mediator Solutions is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, information may be disclosed to counterparties and advisers as part of due diligence and may be transferred as part of the transaction, subject to applicable law and appropriate confidentiality protections.

6.6 With your direction or consent

We may disclose information when you direct us to do so, when a customer instructs us to do so within the scope of its authority, or when you otherwise provide valid consent.

7. Sale, sharing, targeted advertising, and Global Privacy Control

As of the Effective Date:

FORGE does not sell personal information for money;
FORGE does not sell Customer Data;
FORGE does not use Customer Data for cross-context behavioral advertising;
FORGE does not operate an advertising network;
FORGE does not knowingly sell or share personal information of consumers under 16 years of age.

Some U.S. privacy laws define "sale," "sharing," or "targeted advertising" more broadly than ordinary language. If we later enable a practice that falls within those definitions, we will update the applicable disclosures and provide legally required opt-out mechanisms before or when that practice begins.

Where applicable law requires recognition of browser-based universal opt-out signals such as Global Privacy Control (GPC), we will treat a technically valid signal as an opt-out request for the browser or device from which the signal is sent with respect to legally covered sale, sharing, or targeted advertising practices. Because FORGE does not currently engage in those covered practices, receiving a GPC signal ordinarily does not change the core operation of the Service.

8. Data retention

We retain information for no longer than reasonably necessary for the purposes described in this Policy, taking into account:

the duration of the customer relationship;
the period necessary to provide the Service;
account administration and customer support needs;
security, fraud-prevention, and incident-response needs;
dispute and legal-claim periods;
tax, accounting, payment, and regulatory recordkeeping requirements;
contractual obligations;
backup and disaster-recovery cycles.

Examples:

sign-in codes expire quickly for authentication purposes, although limited security records associated with authentication requests may be retained for a longer period where reasonably necessary for fraud prevention or operational integrity;
billing and transaction records may be retained after account closure where needed for tax, accounting, payment disputes, legal compliance, or audit;
Customer Data is generally retained while the relevant customer account or workspace remains active and may be deleted, exported, or otherwise handled following termination according to the Service, the customer's instructions, our backup cycles, and applicable law;
support correspondence may be retained for a reasonable period to maintain context, resolve disputes, improve support, and establish a record of actions taken.

Deletion from an active production system may not result in immediate deletion from encrypted backups, immutable security logs, payment-provider systems, or legally required records. Those copies are isolated from ordinary use and age out or are deleted according to the relevant retention process.

9. Security

We maintain administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure. Depending on the system and data involved, safeguards may include:

authenticated server-side access controls;
signed secure session mechanisms;
HTTPS/TLS in transit;
encrypted cloud database or storage services;
server-side authorization checks;
limited-duration upload URLs;
server-side encryption for uploaded objects;
login-code expiration and attempt controls;
rate limiting;
infrastructure logging and monitoring;
restricted access to production systems;
payment processing through a specialized third-party payment provider rather than direct storage of full card credentials in the ordinary FORGE database.

No internet service can guarantee absolute security. You are responsible for securing your email account, devices, browser sessions, internal team access, and any credentials or authentication factors under your control. Notify us promptly if you believe your account or workspace has been compromised.

10. International and interstate processing

FORGE is operated by a U.S. company and currently uses service providers that may process information in the United States and other jurisdictions. If you access FORGE from outside the United States, information may be transferred to and processed in a country whose data-protection laws differ from those in your location.

Market-specific legal documents and transfer mechanisms may apply to non-U.S. surfaces. This U.S. Privacy Policy does not, by itself, replace any Standard Contractual Clauses, U.K. transfer addendum, Brazilian data-processing clause, or other transfer mechanism that a non-U.S. law may require.

11. Children

FORGE is a business service and is not directed to children. You must be at least 18 years old, or the age of legal majority where you live if higher, to open or administer a paid FORGE account unless a separate written agreement expressly permits otherwise.

We do not knowingly collect personal information directly from children under 13 through a child-directed service, and we do not knowingly sell or share personal information of children under 16. If you believe a child has provided personal information to FORGE in a manner inconsistent with this Policy, contact us at reach@prime88.studio.

Customers must not use FORGE to build profiles of children or to store unnecessary sensitive information about minors.

12. Your choices and rights

Depending on where you live and whether a particular privacy law applies to Mediator Solutions in the relevant context, you may have rights to:

request confirmation of whether we process your personal information;
request access to personal information;
request correction of inaccurate personal information;
request deletion, subject to legal exceptions;
request a portable copy of certain personal information;
opt out of sale, sharing, or targeted advertising where applicable;
limit certain uses or disclosures of sensitive personal information where applicable;
withdraw consent where processing relies on consent;
appeal a denial of a privacy request where applicable state law provides an appeal right;
receive equal service and not be unlawfully discriminated against for exercising privacy rights.

To submit a request, email reach@prime88.studio with the subject FORGE Privacy Request and describe the right you wish to exercise. If you already have a FORGE account, we may ask you to submit or confirm the request through the authenticated account or through the email address associated with the account.

We may need to verify your identity or authority before completing certain requests. Verification may include matching information in your request to information already associated with the account, sending a confirmation to the account email, or requesting additional information reasonably necessary to prevent unauthorized disclosure or deletion.

If you use an authorized agent, we may require evidence that you authorized the agent and may also ask you to verify your identity directly where permitted by law.

We will respond within the time required by applicable law. We may deny or limit a request where an exception applies, where we cannot reasonably verify the requester, or where honoring the request would adversely affect the rights of another person. If we deny a request and applicable law gives you a right to appeal, our response will explain how to appeal.

13. California privacy disclosures

This section supplements the rest of this Policy for California residents to the extent the California Consumer Privacy Act, as amended (CCPA), applies to Mediator Solutions in the relevant context.

13.1 Categories of personal information

During the preceding 12 months, depending on the features used, we may have collected the following CCPA categories:

Identifiers, such as email address, IP address, account identifiers, customer or contact names, and phone numbers;
Customer records information, such as business contact details, addresses, and account information;
Commercial information, such as subscription status, products or add-ons purchased, invoices, estimates, receipts, and transaction records;
Internet or electronic network activity, such as browser, device, login, request, security, and diagnostic information;
Professional or employment-related information, if a customer enters a business role or similar work-related information into Customer Data;
Geolocation information, generally approximate location inferred from network information or service address information that a customer chooses to enter;
Audio, electronic, visual, or similar information, such as uploaded photos or attachments;
Inferences, only to the limited extent operational or security systems infer risk, fraud, service state, or similar technical conclusions from account activity;
Sensitive personal information, only if an individual or customer enters information that qualifies as sensitive under California law or if account credentials or precise information fall within a statutory sensitive category. FORGE is not designed to require most sensitive categories for ordinary use.

The purposes, sources, and recipients associated with these categories are described throughout this Policy.

13.2 California rights

Subject to the CCPA's applicability, verification rules, and exceptions, California residents may have the right to know, access, delete, correct, opt out of sale or sharing, limit certain uses or disclosures of sensitive personal information, and receive non-discriminatory treatment for exercising CCPA rights.

FORGE does not currently sell personal information for money or share personal information for cross-context behavioral advertising. If that changes, we will provide the legally required Do Not Sell or Share My Personal Information or equivalent privacy-choice mechanism and honor qualifying GPC signals.

13.3 Retention criteria

We do not retain each category of personal information for a single universal fixed period. We use the retention criteria described in Section 8, including service necessity, account duration, security, legal claims, tax/accounting requirements, backup cycles, and contractual obligations.

13.4 Financial incentives

FORGE may offer ordinary discounts, promotional pricing, or a referral discount program. We do not currently offer a program that requires a consumer to sell personal information in exchange for financial compensation. If we introduce a California financial-incentive program governed by the CCPA, we will provide a separate notice describing the material terms before enrollment.

14. Other U.S. state privacy laws

Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with comprehensive privacy statutes may have additional or similar rights if and when the relevant law applies to Mediator Solutions and the relevant processing.

FORGE will process qualifying verified requests in accordance with the law that applies to the requester. Where applicable law requires an appeal mechanism, universal opt-out recognition, or a particular disclosure about targeted advertising or sale, we will provide it.

This paragraph is not a representation that every listed statute applies to FORGE in every circumstance. Many state statutes contain revenue, volume, entity, employment, business-to-business, nonprofit, or other scope thresholds and exemptions.

15. Email and electronic communications

We use email for authentication, security, billing, service, legal, and support communications. Some messages are necessary to operate the account and cannot be opted out of while you continue to use the relevant Service feature.

If we send promotional marketing email, that message will include an unsubscribe method where required by law. Unsubscribing from marketing does not prevent transactional or legally required communications.

16. Third-party websites and services

The Service may link to or redirect you to third-party services, including payment-provider pages. Third parties operate under their own terms and privacy policies. Their processing may be outside our control, particularly where the third party acts as an independent business or controller.

You should review the privacy terms of third-party services you choose to use.

17. Changes to this Policy

We may update this Policy when our practices, technology, Service, vendors, or legal obligations change. The Last updated date will identify the current version.

If a change materially affects how we use personal information already collected, we will provide additional notice where required by law, such as through the Service, email, the public website, or another reasonable channel. We will seek consent before applying a materially different use retroactively where applicable law requires consent.

18. Contact

Mediator Solutions LLC

Email: reach@prime88.studio

For ordinary product support, use the support route shown in the Service. For privacy requests concerning data that a FORGE customer entered about you, you may also contact that customer directly.