Legal · Privacy policy · Last updated 29 October 2026. Section 2 now names Vercel Web Analytics, which counts visits to the public pages, and sections 9 and 10 say who holds those records and for how long; before 29 October 2026 the site counted no visits. Section 9 names JobTech (Arbetsförmedlingen), whose public job ads are read by a company's organisation number; it receives no personal data, and the hiring signal is not switched on in the app today. Section 9 names TED (Publications Office of the European Union), whose public procurement notices are read by a company's organisation number; it receives no personal data, and the tender signal is not switched on in the app today. Section 9 names the outside-in scan's public sources, which receive a company's website domain and never a person; the scan is not switched on in the app today. A partner may now connect their own LinkedIn account, to post on their own feed and, in the EEA and with their consent, to bring their own LinkedIn data into Forgeby through LinkedIn's Member Data Portability service (section 6). That LinkedIn data is not received today.

Privacy policy

How Forgeby handles personal data: on this website, at the door, and inside the Forgeby platform. If you are here because someone used Forgeby to contact you, or you were told your details are in our records, the page written for you is the privacy notice for business contacts. This policy does not vary that notice.

1. Who we are

Forgeby is a service of Zmart Com West AB, Swedish organisation number 559019-9161, Gothenburg, Sweden. A registered name change to Forgeby AB is in progress; it is the same company either way. That company is the data controller for the personal data described on this page: it decides what is held and why, and it is responsible for it under the General Data Protection Regulation (GDPR).

For privacy matters write to privacy@forgeby.com. For anything else, partner@forgeby.com.

2. What this website collects

When you email us, you actively provide:

• your name
• your company name
• your email address
• the message you choose to send

That data is used solely to respond to you and, where relevant, to discuss a potential engagement. It is not shared with third parties, not sold, and not used for marketing communications.

The site runs two scripts from Vercel, its hosting provider: Speed Insights, which measures how fast a page loads, and Web Analytics, which counts which public pages are read and from where. Neither sets a cookie or writes anything to your browser. Vercel is named in Annex B of the data processing agreement. The cookies page describes exactly what each one sends.

Speed Insights measures how fast a page loads and sends that measurement, the page URL and a connection-speed class to Vercel. It sets no cookie and writes nothing to your browser, so it cannot recognise you on a later visit, and it does not read the referrer.

Web Analytics records, each time you open a public page that carries it, the page; the address of the page that linked to it, as your browser reports it (usually only the site itself), sent with the first page view and only when you arrive from another site; any campaign tags in the address of the page itself (utm_ tags and ref, and no other part of its query string); your country, region and city; and the type of device, browser and operating system. It tells repeat visits apart within one day only, by a hash that Vercel creates from the incoming request and discards after 24 hours, and no IP address is stored with the record. It counts the public pages only. In the signed-in app, and on any page a seller sends a buyer, your browser drops the record before it leaves, so nothing is sent. It sets no cookie and writes nothing to your browser. The legal basis is legitimate interest (GDPR Article 6(1)(f)): knowing which public pages are read and which sites send readers to them.

Until 24 August 2026 this page named Plausible, which was never loaded; that was corrected, and this describes what runs.

Like any web server, ours writes access logs (IP address and browser user agent). They exist for security and abuse prevention only, are not used to profile anyone, and are purged at 90 days.

This site has two forms that collect a work email. The waitlist is so we can tell you when the door opens. The demo workspace request is so the founder can open a workspace by hand. Neither form creates an account or a tenant. A demo-workspace request is the request class: your work email, the company domain you named, and that you consented. The legal basis is that you asked (GDPR Article 6(1)(b)), and you ticked the box. We delete that row when you ask, or when the founder has acted. There is no automatic clock on it. Write to privacy@forgeby.com to withdraw.

3. What we deliberately do not load

There is no cookie banner on this site because there is nothing to consent to. The marketing site loads no advertising tags, no Google Tag Manager, no LinkedIn Insight Tag, and no visitor-identification service such as Albacross. No consent-gated tracker of any kind is loaded. If that ever changes, a consent step will come first and this page will say so. The cookie policy describes the full picture, including the session state the app keeps in your own browser.

4. Before sign-in

The public market search is retired. The site runs no search for visitors, and the only library figures it shows are totals about companies, never about people. The two forms in section 2 are the only way in before sign-in.

5. Signing up and signing in

Sign-up is for B2B sellers and go-to-market teams. You sign in with your work email address; there is no Google login and no social login of any kind. At sign-up we verify the domain of your email address is a company mailbox; a personal mailbox does not get an account.

What we process for your account: your work email address, your name, and the company you sign up under. The legal basis is GDPR Article 6(1)(b): taking steps at your request before entering a contract, and then performing it. In your browser, the app keeps your sign-in session in a first-party HttpOnly cookie, and your interface preferences in local storage. Neither is a tracking mechanism. Detail is in the cookie policy.

6. The Forgeby platform and customer data

Separately from this website, we operate the Forgeby platform (formerly Alloy) for those customers. In the platform, Forgeby processes business-contact data of prospects (name, work title, business email and phone, public professional profile, employer) to identify and manage B2B opportunities. For business prospecting the lawful basis is legitimate interest (documented, and available on request). Forgeby is the controller for the library. You are the controller of your own outreach. Where Forgeby processes a customer's own data on their behalf, Forgeby acts as a data processor under our Data Processing Agreement.

Workspace records are stored in Stockholm (eu-north-1) and encrypted in transit and at rest, with row-level isolation between customers. The services that run outside the EU are named in section 8 and in Annex B. Public pages show people by role only. People open inside a workspace, behind sign-in, with a named owner and a route out.

When a seat connects a CRM, Forgeby reads companies, contacts, deals and owners from it with that seat's own token, under the customer's own instructions. It writes back to a deal three things only: the stage (the outcome, moved forward and never to closed), the next step, and one note that names each change and the words and the source it came from. Each is written only on a card the seat approves, with that seat's own sign-in, and nothing else in the CRM is changed. The CRMs a seat will be able to connect are HubSpot and Salesforce, through WorkOS; that connection is not switched on today. Lime, webCRM and OnePageCRM have no connection. Each CRM processes that data under its own terms, and where a connected CRM processes data outside the EU/EEA the transfer is covered by Standard Contractual Clauses.

A workspace admin may connect the workspace's own FullEnrich account. Forgeby then calls FullEnrich with that workspace's key, the same way it reaches a connected mailbox. Results stay in that workspace and are never pooled. FullEnrich Corp is a sub-processor only while a managed FullEnrich key is switched on for Forgeby's own work. That switch is off.

If a customer switches listening on, Forgeby's AI notetaker, named “Forgeby (AI notetaker)”, may join a Google Meet or Microsoft Teams call, post a chat notice that says it is an AI, and take notes. SAS Spoke (Meeting BaaS) records the audio. AssemblyAI transcribes it. The processing region is not pinned through Meeting BaaS as of 26 September 2026. Removal within five minutes deletes the capture. A follow-up from the meeting leaves only under the mailbox rules below. Zoom stays off.

A seller may call a business contact from Forgeby, in the browser, to a number already on that contact in their workspace, in Sweden, Norway, Denmark, Finland or the United Kingdom. Only the seller's click starts a call; Forgeby never dials on its own. The call is carried by 46elks, a telecom operator in Sweden, as an independent operator and not as Forgeby's processor. A call is recorded only while transcription is switched on, and the recording is sent for transcription only after the seller has told the other person, at the start of the call, that it is recorded and transcribed. AssemblyAI transcribes it at its EU endpoint in Ireland, and its copy is deleted when Forgeby collects the transcript. Forgeby keeps the transcript and the notes made from it, never the audio, and the seller and the workspace's admins can read them. A seller can choose not to keep a call; then nothing from it is kept, and a copy already sent for transcription is deleted. The carrier keeps its own copy of a recording for at least 72 hours, and Forgeby checks after 72 hours that it is gone.

A partner may connect their own mailbox and calendar, Outlook or Google, so that Forgeby can prepare a meeting before they walk into it, and so that a message or a meeting can leave from their own account under the rules below. It is optional, it is never a condition of using Forgeby, and one person connects it for their own seat rather than for a company. The sign-in is brokered by WorkOS, which holds the resulting token; Forgeby never receives or stores a mailbox password or any other provider credential.

A mailbox connection can read and send mail. A connected mailbox lets a message leave from your own account only with your permission: when you approve it, or under a standing rule you set, with limits, a 2-minute hold and Undo. A first mail to someone new always waits for your approval. A connection without send permission cannot send. Calendars are read. A meeting is booked only if the calendar connection includes write permission, and only after that user approves that specific booking in Forgeby.

What Forgeby actually reads is narrower than the connection allows:

• from the calendar, the events in the day being prepared
• from the mailbox, for a meeting brief, the subject line, the sender and the date only, and only for the outside people attending that meeting, at most five messages each
• from the mailbox, when the partner asks Forgeby to read the inbox, a short preview of recent messages
• from the mailbox, in a thread Forgeby sent, the new messages in that thread only: a reply, an automatic reply or a delivery notice. Never the rest of the inbox

A reply in a thread Forgeby sent is read every 15 minutes, on that seat's own token. Code decides the safety effects first: an unsubscribe or a complaint stops the sequence and suppresses the address, a bounce suppresses or pauses it, and an automatic reply delays it. Then the AI inference services named in section 9 read only the person's own new text, with the quoted history removed, to sort the answer and to draft a reply card that the seller reads, edits and approves. Nothing is sent by this. The text is not kept: the card carries a gist of at most 90 characters, and the account keeps short quoted facts of at most 280 characters. A reply is never used to train or tune any model, and never becomes a lesson.

A meeting brief is read at the moment it is asked for. When the partner asks for an inbox preview, this app stores that preview in the record of what was said for the workspace they have chosen. Each row holds the sender, the date, the provider message id, and the preview text: the Gmail snippet or the Outlook body preview, at most 8,000 characters. The write uses that seat's own token and that workspace's tenant id. A later read uses a token that can see that tenant. A caller who cannot see that tenant is refused. The row is keyed to the seat that connected the mailbox. This app does not delete those rows when the mailbox is disconnected, and it does not run a retention clock on them. A partner can disconnect a mailbox or a calendar at any time from the integrations page, which withdraws that access.

Google Workspace data, and the Limited Use rule. Forgeby's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms, and these are commitments rather than a restatement: Gmail and Google Calendar data reaches a human only when that person asks Forgeby to prepare their own meeting or to read their own mailbox; it is never sold, never transferred to anyone except to provide or improve that feature at the partner's direction or where the law requires it, and it is never used to train generalised or foundation models. A meeting brief is read to answer one question. An inbox preview the partner asks for is stored in that workspace's record of what was said, as set out above.

A partner may also connect their own LinkedIn account. It is optional, one person connects it for their own seat, and the sign-in happens at LinkedIn. WorkOS holds the resulting token, as it does for a mailbox; Forgeby never receives a LinkedIn password. Two things can come from it.

• Posting. A post goes on the partner's own LinkedIn feed only when they press Publish. Forgeby never posts by itself, and never sends a LinkedIn message or invitation.
• Your own LinkedIn data, with your consent. For partners in the European Economic Area, LinkedIn's Member Data Portability service, under the EU Digital Markets Act, gives Forgeby a copy of the partner's own LinkedIn data when they consent at LinkedIn: their first-degree connections (name, position, company and the date they connected), the invitations they sent and received, and the messages in their LinkedIn inbox, then new activity as it happens. Forgeby uses it to show who the partner already knows at an account, to count LinkedIn conversations on a record, and to notice a reply. It stays in the partner's workspace and is never sold or shared. LinkedIn has not yet approved Forgeby for this service, so no such data is received today.

Those messages include words written by other people. Forgeby processes them for the partner on the basis of the partner's legitimate interest in following up their own conversations, and a person in them can object with the one email in section 7: Forgeby then stops processing what they wrote and records the objection, so no one reaches them from Forgeby again. Disconnecting LinkedIn on the integrations page, or closing the account, deletes every piece of LinkedIn portability data Forgeby received for that seat at once. A partner may also upload the file of their own connections that LinkedIn gives every member on request (Connections.csv); Forgeby reads that file only. Forgeby never scrapes LinkedIn or copies anything from a LinkedIn page.

7. Business contacts, and where their data came from

Some of what the platform holds is business contact information we did not collect from the person it describes. GDPR Article 14 requires us to tell those people what we hold, where it came from, why, and how to make it stop. The authoritative version of that is the privacy notice for business contacts. In brief, the sources are four: public company records (the public business registers: Bolagsverket and SCB in Sweden, Brønnøysund in Norway, PRH in Finland, Companies House in the United Kingdom, and each other market's own register), licensed business-data providers, public web pages and public search results (web pages are read by the Forgeby crawler, which names itself in your logs and obeys robots.txt, and decision-makers found in public search results, including public professional profiles those results return, are resolved by Serper), and our founder's own professional network export. We do not log in to or crawl a social network. The people in a partner's own LinkedIn connections come from that partner: their own export, or their own LinkedIn data with their consent. The people in their LinkedIn inbox come only from that data (section 6). We hold professional information in a professional context only: no home addresses, no personal email, nothing about anyone's private life, and we profile companies, not people.

Some register rows describe a sole trader: a person trading under his or her own name. In Sweden that is an enskild firma, whose organisation number is the owner’s personal identity number. We do not use sole-trader register rows for outreach. They are suppressed, so they never appear in a search or a list.

8. Where data lives, and the AI that touches it

Forgeby's own database lives in the EU, self-hosted on Forgeby's AWS infrastructure in Stockholm (eu-north-1). Some services named in section 9 keep data in the United States: WorkOS holds sign-in records and mailbox tokens, and Composio keeps connected-app tokens and a call log. AWS acts as a data processor under GDPR Article 28. Forgeby's own service mail is sent through Amazon SES in Stockholm, from alerts@send.forgeby.com. Mail to a buyer leaves only from the seller's own connected mailbox. The website and the Forgeby web application run on Vercel, with serverless functions pinned to Stockholm (arn1).

AI processing runs on Amazon Bedrock using EU inference profiles, which route each call within EU regions; search embeddings for account facts run in Frankfurt (eu-central-1). For tasks that need live web search, and as a fallback when the EU route is unavailable, one model path runs with Anthropic PBC in the United States under Standard Contractual Clauses. A prompt on that path can carry the company being researched and business contact details; it is not used to train models.

Email correspondence is hosted by GoDaddy, the domain and email provider for Forgeby's mailboxes. Their practices are described at godaddy.com/legal. Transfers outside the EU are safeguarded under standard contractual clauses where they occur.

9. Sub-processors

The full, current sub-processor list is Annex B of the Data Processing Agreement. In summary: Amazon Web Services (hosting, database, AI inference via Amazon Bedrock, transactional email, EU Stockholm), Vercel Inc. (hosting of the web application, with serverless functions in EU Stockholm; page-load performance measurement; and the counting of public page views through Web Analytics; Vercel does not say where it stores the records of either, as read on 29 October 2026), WorkOS, Inc. (sign-in, identity and the optional mailbox and calendar connection, United States, Standard Contractual Clauses), AssemblyAI, Inc. (speech-to-text when a user dictates or records a phone call, EU Ireland), Serper.dev (web search to read public company pages and descriptions, for a company's website, a business contact's public professional profile link, and decision-makers found in public search results, and a company's public switchboard number, United States, Standard Contractual Clauses), Anthropic PBC (AI inference for tasks needing live web search and as fallback, United States, Standard Contractual Clauses), Sampark, Inc., trading as Composio (the tool layer that holds a seat's connections to its own apps and runs the read-only calls Forgeby makes on that seat's behalf; each call's content passes through it and is logged; no new connection is made through it since 7 October 2026, United States), BLITZ API SAS, trading as BlitzAPI (the built-in global B2B database since 15 October 2026: company and business contact data and work emails; a lookup of one named person carries only that person's public professional profile link; European Union, Germany, as BlitzAPI states; its data processing agreement is being signed), SAS Spoke (meeting capture after the seller switches listening on; region not pinned through Meeting BaaS as of 26 September 2026), Slack Technologies (Forgeby in Slack, only for a workspace a customer connects; not switched on today), the CRM a seat chooses to connect (HubSpot or Salesforce, read, and written back to only on a card its user approves, each per its own region; not switched on today), and a workspace's own FullEnrich account when an admin connects it. FullEnrich Corp is a sub-processor only while a managed key is on. That switch is off. Forgeby does not speak aloud today, so no voice-synthesis service receives anything. Customers get at least 30 days' prior notice of an intended addition or replacement. Objection is sent to privacy@forgeby.com. A sustained objection that we cannot accommodate is a ground to terminate; unused prepaid fees for the remaining term are refunded pro rata. The procedure is in section 3 of the data processing agreement.

Google favicon service: receives a company's website domain from our server, to draw its logo. Never a person, never who looked.

JobTech (Arbetsförmedlingen), Sweden's public job ads: receives a Swedish company's organisation number, never a sole trader's, to read that employer's open ads. An ad's contact person and any other personal data are dropped when it is read and never stored. Never who looked. The hiring signal is not switched on in the app today.

TED (Publications Office of the European Union), the EU's public procurement notices: receives a Swedish company's organisation number, never a sole trader's, to read the contract award notices that name that company as a winner. A notice's contact points and any other personal data are dropped when it is read and never stored. Never who looked. The tender signal is not switched on in the app today.

The outside-in scan's public sources: Cloudflare (DNS over HTTPS, and its published IP range list), Amazon Web Services and Google Cloud (their published IP range lists) and SSLMate Cert Spotter (public certificate logs). Each receives a company's website domain, or only a request for a published list. Never a person, never who looked. The scan is not switched on in the app today.

10. How long data is kept

11. Your rights under GDPR

You have the right to:

• request access to the personal data Forgeby holds about you
• request correction of inaccurate data
• request deletion of your data (the “right to be forgotten”)
• object to processing, or request restriction of processing
• request your data in a portable format
• withdraw consent at any time, where processing rests on consent (for example, a recorded meeting)
• lodge a complaint with the Swedish Authority for Privacy Protection (IMY), or with the supervisory authority where you live

To exercise any of these rights, email privacy@forgeby.com. Requests are handled within 14 days, half the one month the law allows.

12. Changes to this policy

This policy may be updated as Forgeby's practices evolve. The date at the top of this page reflects the most recent revision, and a change never lowers a protection described here without notice.

13. Contact

For any privacy-related question or request:
Forgeby, a service of Zmart Com West AB (org.nr 559019-9161), Gothenburg, Sweden
privacy@forgeby.com