Privacy Policy

1. Introduction and Scope

IRIS Systems LLC, a Texas limited liability company, operates ForgeSystems. This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you interact with ForgeSystems as an agency owner, team member, developer, website visitor, or end client of an organization using the platform.

This policy applies to all services provided through ForgeSystems, including Invoicing & Payments, Contracts & E-Signatures, Custom Forms, Scheduling & Booking, Client Messaging, Email & SMS Marketing, Client Feedback, Onboarding & Checklists, Portfolio & Case Studies, Landing Pages, and Analytics & Reporting.

2. Our Role: Data Controller and Data Processor

Because ForgeSystems operates as a white-label platform, our privacy responsibilities depend on the type of data involved. We operate under a three-tier model:

ForgeSystems as Data Controller

We act as the Data Controller for information related to agency accounts, billing, and platform usage. This includes the data agencies provide when they sign up, their payment information, and how they use the platform. We decide why and how this data is processed.

ForgeSystems as Data Processor

When agencies use ForgeSystems to manage their own clients, we act as a Data Processor. We process agency client data on the agency's behalf and according to their instructions. We do not use this data for our own purposes beyond providing the service.

Agencies as Data Controllers

Agencies that use ForgeSystems are Data Controllers for their own clients' data. They determine what data to collect, why, and how it is used within the platform. Agencies are responsible for maintaining their own privacy policies that inform their clients about data practices.

3. Information We Collect

3.1 Information You Provide

• Account registration: Name, email address, business name, and other details provided during sign-up
• Payment and billing data: Payment is processed through Stripe. We do not store full credit card numbers on our servers. Stripe handles card data in accordance with PCI DSS Level 1 standards.
• Client data uploaded by agencies: Contact information, project details, files, and other content agencies add to the platform for their clients
• Communication content: Emails, SMS messages, and chat messages sent through the platform
• Support requests: Information you provide when contacting our support team

3.2 Automatically Collected Information

• Usage analytics: How you interact with the platform, features used, and frequency of use
• Technical information: IP address, browser type, device type, operating system, and screen resolution
• Performance metrics: Page load times, error logs, and service performance data
• Server logs: Access logs including timestamps, request URLs, and response codes

3.3 Cookies and Tracking

• Essential cookies: Required for authentication, session management, and security. These cannot be disabled without breaking core functionality.
• Analytics cookies: Help us understand how the platform is used so we can improve it. These can be managed through your browser settings.

You can control cookies through your browser settings. Disabling essential cookies may prevent certain features from working correctly. Disabling analytics cookies will not affect your ability to use the platform.

3.4 ShopForge and Shopify App Data

If you install or use the ShopForge Shopify app, we collect and process the minimum information needed to connect your Shopify store to your ForgeSystems workspace and provide store, checkout, and shipping controls. This may include your Shopify shop domain, Shopify installation/session records, the ForgeSystems workspace identifier you link to the store, Shopify API access tokens, Storefront API tokens, product and inventory data, selling plan metadata, checkout validation status, and technical logs related to app installation and operation.

ShopForge Public does not store Shopify customer records in the public app database. Shopify customer privacy webhooks for data requests and redaction are handled by acknowledging the request and confirming that the public app does not maintain customer records. Shopify shop redaction requests delete local app sessions and the linked shop record.

4. How We Use Your Information

We use information for the following purposes, each tied to a legal basis:

• Providing our services (contractual necessity) — Operating the platform, delivering features, and managing your account
• Processing payments (contractual necessity and legal obligation) — Handling subscriptions, invoicing, and payment transactions through Stripe
• Sending communications on agencies' behalf (contractual necessity) — Delivering emails, SMS messages, and notifications that agencies configure for their clients
• Platform security and fraud prevention (legitimate interest) — Detecting abuse, preventing unauthorized access, and maintaining service integrity
• Analytics and improvement (legitimate interest) — Understanding usage patterns to improve features, performance, and user experience
• Legal compliance (legal obligation) — Meeting tax, financial reporting, and other regulatory requirements

5. How We Share Your Information

We do not sell personal information. We share data only in the following circumstances:

• Service providers: With sub-processors necessary to operate the platform (see Section 6 below)
• Agency access: Agency client data is accessible to the agency that manages the client relationship
• Legal requirements: When required by law, regulation, legal process, or enforceable governmental request
• Business transfers: In connection with a merger, acquisition, or sale of assets, with prior notice to affected users

6. Sub-Processors

We use third-party service providers to operate ForgeSystems. The current provider categories and purposes are maintained in our Subprocessor List. A provider processes only the data needed for enabled services and integrations.

Provider	Purpose	Data Processed
Amazon Web Services (AWS)	Email delivery via SES, infrastructure	Email content, recipient addresses, delivery metadata
Stripe	Payment processing (PCI DSS Level 1 certified)	Payment card details, billing addresses, transaction amounts
Supabase	Database hosting, authentication, file storage	Account data, application data, uploaded files, auth credentials
Netlify	Application hosting, serverless functions	Request data, access logs, function execution data
Shopify	ShopForge app installation, product and inventory synchronization, storefront access, checkout and shipping validation	Shop domain, app installation/session data, product data, inventory data, selling plan metadata, checkout validation metadata, Storefront API token data

For details on how each provider handles data, see their respective privacy policies:

• AWS Privacy Policy
• Stripe Privacy Policy
• Supabase Privacy Policy
• Netlify Privacy Policy
• Shopify Privacy Policy

7. Data Retention

We retain data for the minimum period necessary to fulfill the purposes described in this policy. Specific retention periods are:

Data Type	Retention Period
Account data	Duration of account + 90 days post-deletion
Payment and billing records	7 years (legal requirement)
Communication logs (email, SMS, chat)	24 months
ShopForge Shopify app installation and linked shop records	Duration of active installation, then deleted or anonymized after uninstall, shop redaction, or account deletion as legally required
Usage analytics	24 months
Server and access logs	90 days
Agency client data	Deleted within 30 days of agency request or account termination

When data reaches the end of its retention period, it is securely deleted or anonymized so it can no longer be linked to an individual.

8. Data Security

We take the security of your data seriously and implement multiple layers of protection:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (HTTPS)
• Encryption at rest: Stored data is encrypted using industry-standard encryption methods
• Access controls: Strict role-based access ensures only authorized personnel can access data, and only the data they need
• Security monitoring: We continuously monitor for suspicious activity, unauthorized access attempts, and vulnerabilities
• Incident response: We maintain documented procedures for responding to security incidents, including containment, investigation, and notification

9. International Data Transfers

ForgeSystems's infrastructure is hosted primarily in the United States through AWS and other US-based providers. If you are located outside the US, your data may be transferred to and processed in the United States.

For transfers of personal data from the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms, to ensure an adequate level of data protection.

10. Your Privacy Rights

10.1 GDPR Rights (EU/EEA/UK Residents)

If you are located in the European Union, European Economic Area, or the United Kingdom, you have the following rights under the General Data Protection Regulation:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data, subject to legal retention requirements
• Right to restriction: Request that we limit how we process your data in certain circumstances
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests or direct marketing

We respond to all GDPR requests within 30 days. You also have the right to lodge a complaint with your local supervisory authority if you believe your data has been mishandled.

10.2 CCPA/CPRA Rights (California Residents)

If you are a California resident, the California Consumer Privacy Act and California Privacy Rights Act provide you with the following rights:

• Right to know: Request details about what personal information we collect, use, and disclose
• Right to delete: Request deletion of your personal information, subject to certain exceptions
• Right to correct: Request correction of inaccurate personal information
• Right to opt out of sale or sharing: We do not sell or share personal information as defined by the CCPA (see Section 11)
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights

We respond to all CCPA/CPRA requests within 45 days.

10.3 Other US State Privacy Laws

We comply with applicable state privacy laws, including those in Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy legislation. If your state provides additional privacy rights, please contact us to exercise them.

11. Do Not Sell or Share

ForgeSystems does not sell personal information. We do not share personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act (CCPA). Because we do not engage in these practices, a "Do Not Sell or Share My Personal Information" link is not necessary, but we honor such requests regardless if received.

12. Email and SMS Communications

CAN-SPAM Compliance

ForgeSystems provides controls designed to help senders comply with the CAN-SPAM Act. Senders remain responsible for configuring and using those controls correctly. Commercial email should include:

• A clear and functioning unsubscribe mechanism
• Accurate "From" and "Reply-To" headers
• A valid physical postal address
• Honest subject lines that reflect the content

Unsubscribe requests are honored within 10 business days.

TCPA Compliance for SMS

ForgeSystems provides consent, sender-identification, and opt-out controls designed to support compliant messaging. Use of those controls does not itself make a campaign lawful. Senders remain responsible for the TCPA, carrier rules, provider policies, and other requirements that apply to their messages. See the Messaging Terms.

• Prior express consent is required before sending marketing or promotional SMS messages
• Opt-out requests (e.g., replying STOP) are honored immediately
• Messages include sender identification and opt-out instructions

Agency Responsibilities

Agencies using ForgeSystems are responsible for obtaining proper consent from their contacts before sending communications. ForgeSystems provides the tools for compliance, but agencies must ensure they have the appropriate permissions and consents in place.

13. Children's Privacy

ForgeSystems is a business platform and is not directed at children under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 16, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at the email address listed below.

14. Data Breach Notification

In the event of a data breach that affects your personal information, we will:

• Notify affected users without undue delay
• Provide clear information about what happened, what data was affected, and what steps we are taking
• Report to relevant supervisory authorities within 72 hours where required by GDPR
• Cooperate with agencies to help them fulfill their own breach notification obligations to their clients

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Notify you by email and through a platform notification at least 30 days before the changes take effect
• Clearly describe what has changed and why
• Update the "Last Updated" date at the top of this page

Continued use of ForgeSystems after the notice period constitutes acceptance of the updated policy. If you disagree with any changes, you may close your account before the changes take effect.

16. Contact Us

If you have questions about this Privacy Policy, want to exercise your privacy rights, or have concerns about how your data is handled, please reach out:

Operational publication prepared for licensed-attorney review. This status does not represent attorney approval.