Privacy policy

For the data of people who use Forge (owners, managers, workers, clients who sign documents), the company that holds the account is the controller and Day One Web Studio, Cyprus, is the processor acting on its instructions. For the account itself (the Owner's email and billing details) Day One Web Studio is the controller.

Account data: name, email, password (stored as a hash, never readable), language, role in the company.

Site data your company records: projects, tasks, check-ins with the time and, if the phone allowed it, the GPS position at check-in and check-out, photos, daily and weekly reports, safety checklists and incidents, defects, documents, and on the Company plan budgets, invoices, materials and subcontracts.

Signatures collected on documents: the signer's name, the time, the IP address, the browser used and a hash of the document, kept with the signed PDF as evidence.

Billing: your company's billing address, VAT number if given, and the Stripe customer and subscription references. Card numbers are held by Stripe only.

Technical data: sign-in events, failed sign-in attempts and IP addresses used for rate limiting, kept in the activity log.

To provide the service you asked for (contract), to bill for it (contract and legal obligation), to keep the service secure and prevent abuse (legitimate interest), and to send the emails the service needs: invitations, password resets, the morning brief and instant notifications your company switched on. We do not send marketing email.

The database and uploaded files are hosted by Supabase in Frankfurt, Germany (EU). The application runs on Vercel and the background worker that renders PDFs and sends email runs on Fly.io in Frankfurt. Payments are processed by Stripe. Email is delivered by Resend. If a Company-plan account connects Microsoft 365, copies of its documents and finance workbooks are written to that company's own SharePoint.

These providers act under contracts that bind them to process data only for us. Where a provider transfers data outside the EU, it does so under the EU standard contractual clauses.

For as long as the company account exists. Records you delete are kept for 30 days so mistakes can be undone, then removed, unless a legal hold applies. The activity log is kept for the life of the account. When a company account is closed its data is deleted after the same 30-day period; invoices and billing records are kept as long as tax law requires.

You can access, correct, export and delete your data. Owners do this directly in the app: every list exports to Excel, a full company export is in Settings, and members can be removed at any time. Workers and other members should ask their company first, because the company decides what it keeps; you can also write to us and we will pass the request on or act on it where we are the controller.

You have the right to complain to the Commissioner for Personal Data Protection of Cyprus.

The service uses only the cookies it needs to keep you signed in and to remember your language. There are no advertising or analytics cookies on the application.

We update this policy when the service or our providers change. The date at the top tells you when. Material changes are announced in the app.