FForgeLeads
Sign in

Privacy Policy

This Privacy Policy describes how ForgeLeads (the "Service", available at getforgeleads.com) collects, uses, stores, and protects personal data, in compliance with the EU General Data Protection Regulation (GDPR) and the Russian Federal Law 152-ФЗ "On Personal Data".

1. Data Controller

The data controller is Борисов Николай Владимирович (Самозанятый (плательщик налога на профессиональный доход)), Taxpayer ID (ИНН): 773391080360 , contact email: njoy13@inbox.ru.

2. Categories of Data Subjects and Personal Data

2.1. Service Users

  • email address;
  • name (if voluntarily provided);
  • IP address and browser technical data;
  • activity data within the Service;
  • payment transaction data (card numbers are not stored — they are processed by Stripe and ЮKassa);
  • user identifier and session tokens (cookies).

2.2. Leads and contact persons (third parties)

When using the company-search and CRM features, users themselves collect and enter data about their leads: name, position, phone, email, address, website, social media. With respect to that data, the Service user is an independent data controller, and ForgeLeads acts as a data processor on behalf of the user.

3. Purposes of Processing

  • providing access to the Service (registration, authentication, account management);
  • token accounting and payment processing;
  • AI generation of sales materials (scripts, objection responses, proposals) on user request;
  • storing the user's lead database in CRM;
  • fulfilling contractual obligations to the user;
  • service and transactional notifications;
  • compliance with applicable law.

4. Legal Basis (GDPR Art. 6)

  • consent of the data subject given upon registration (Art. 6(1)(a));
  • performance of a contract to which the data subject is party (Art. 6(1)(b));
  • legitimate interests of the controller (Art. 6(1)(f)).

5. Retention

Personal data is processed in automated form and retained until consent is withdrawn or processing purposes are achieved. After account deletion, user data is erased within 30 days. Backups containing deleted data may persist for up to 90 days for technical reasons.

6. Third-Party Recipients

The controller shares personal data with the following processors, limited to what is necessary to provide the Service:

  • Supabase Inc. (Singapore, servers in Dublin, Ireland — Amazon Data Services Ireland Limited) — database hosting and authentication;
  • Vercel Inc. (US) — application hosting;
  • Anthropic PBC (US) — AI processing (script / objection / proposal generation);
  • Stripe Inc. (US) — USD payment processing;
  • ЮMoney NCO LLC (Russia) — RUB payment processing via ЮKassa;
  • Google LLC (Places API) — company search (only query parameters, no user PII);
  • Sentry, PostHog — error monitoring and product analytics (only with explicit user consent to analytics cookies).

7. International Data Transfers

Personal data is transferred to recipients in Ireland (EU/EEA), the United States, and Singapore for the operation of the Service. Such transfers occur on the basis of the data subject's explicit written consent, captured at registration via a separate checkbox "I consent to the cross-border transfer of my personal data to Ireland (Supabase EU), the United States (Stripe, Anthropic, Vercel) and Singapore for the operation of the service" (Article 12, Russian Federal Law 152-FZ). Where applicable, Standard Contractual Clauses adopted by the European Commission also apply.

8. Security Measures

  • TLS 1.3 encryption in transit;
  • AES-256 encryption at rest (Supabase);
  • Row-Level Security — users access only their own data;
  • salted password hashing;
  • activity and admin-operation logging;
  • two-factor authentication on administrative access.

9. Data Subject Rights (GDPR Arts. 15-22)

You have the right to:

  • access your personal data;
  • request rectification, erasure, or restriction of processing;
  • data portability;
  • object to processing based on legitimate interests;
  • withdraw consent at any time;
  • lodge a complaint with a supervisory authority.

Requests should be sent to njoy13@inbox.ruwith the subject "GDPR Request". Response time is up to 30 days.

10. Cookies

The Service uses cookies for authentication (necessary — no consent required) and analytics (optional — only after explicit user consent). You can withdraw consent at any time via the cookie banner at the bottom of the page.

11. Changes to this Policy

We may update this Policy. The new version takes effect upon posting at /legal/privacy. For material changes, users will be notified by email at least 14 days in advance.

12. Controller Details

  • Name: Борисов Николай Владимирович
  • Status: Самозанятый (плательщик налога на профессиональный доход)
  • Taxpayer ID (ИНН): 773391080360
  • Email: njoy13@inbox.ru

Effective: 2026-07-15.

Last updated: