ForgeOne™ CRM Legal

Privacy Policy

Effective October 11, 2026

1. Scope

This Privacy Policy explains how ForgeOne™ CRM LLC (“ForgeOne,” “we,” “us,” or “our”) collects, uses, discloses, and protects information when you use ForgeOne™, visit ForgeOne pages, create an account, join a company workspace, use measurement and estimating tools, enable integrations with third-party platforms, place a Print and Merch order, communicate with support, or interact with customer-facing links generated through the platform.

2. Information We Collect

2.1 Account and Company Information. We collect names, email addresses, login credentials, company names, contact details, roles, permissions, branding, and subscription or billing information.

2.2 Customer and Operational Data. Users may submit customer contacts, property addresses, leads, opportunities, jobs, insurance and claim details, estimates, contracts, invoices, payments, production schedules, messages, photos, files, signatures, and other business records (“Customer Data”).

2.3 Measurement and Property Data. When you use ForgeOne’s measurement and estimating tools, we collect and store information associated with your measurement activities, including:

Property addresses and geographic coordinates used to locate properties within the measurement tools;
Contractor-drawn roof sections, dimensions, pitches, edge classifications, and calculated quantities created through the DIY Roof Measurement Tool;
Aerial or satellite reference imagery displayed through the tool and any image calibration details you enter;
Contractor-uploaded overhead images, drone orthophotos, or scaled roof plans that you provide for use with the measurement tools;
Interior room measurements, including wall, floor, ceiling, door, and window dimensions, and 3D model files generated through the Interior LiDAR Tool using Apple’s RoomPlan technology; and
Generated 2D measurement reports, exported PDF files, and available 3D model files.

Interior LiDAR scanning is performed on your device using Apple’s RoomPlan technology. The initial room capture and neural-network processing occur locally on your device, not on Apple’s servers. When you review and confirm a room scan, the resulting measurements and scan artifacts are uploaded to ForgeOne’s cloud-based system and stored with the associated job record in your CRM workspace.

Measurement data is treated as Customer Data under this Privacy Policy.

2.4 Print and Merch Order Information. When you place an order through ForgeOne™ CRM Print and Merch, we collect the information necessary to process and fulfill your order, including shipping name and address, order details, product selections, design files and artwork you upload (“Print Content”), and payment information. Shipping addresses collected for Print and Merch orders are used solely for order fulfillment and related communications.

2.5 Usage and Technical Information. We may collect login activity, feature usage, audit events, support requests, IP addresses, browser and device information, session identifiers, push-notification registration data, error logs, and performance data.

2.6 Mobile Device Permissions. On supported mobile devices, ForgeOne may request access only when a related feature is used: (i) foreground location for property verification, mapping, field work, storm intelligence, or route planning; (ii) the camera for document scanning, jobsite or inspection capture, and interior LiDAR room scanning; (iii) the LiDAR sensor on compatible devices (iPhone Pro or iPad Pro) for interior 3D room measurement scanning; (iv) the microphone for user-initiated Camera + Voice inspection narration; (v) the photo library or system photo picker for files you choose to attach; and (vi) notifications for operational alerts you choose to receive. ForgeOne does not request background location access in the current mobile app.

2.7 Sensitive Data. Certain information we collect may be considered sensitive under applicable state privacy laws, including precise geolocation data. We collect sensitive data only with your consent, which is obtained through device-level permission prompts or other affirmative opt-in mechanisms before collection begins.

3. How We Use Information

We use the information we collect to:

Provide, operate, secure, and maintain ForgeOne;
Authenticate users and enforce organization roles and permissions;
Generate documents, reports, customer portals, emails, and workflow records requested by users;
Process, store, and associate measurement data, scan artifacts, and generated measurement reports with your CRM job records;
Transmit Customer Data to third-party platforms through User-Configured Integrations at your instruction, as described in Section 5.3;
Process, fulfill, and deliver Print and Merch orders, including transmitting order details and shipping information to fulfillment providers;
Provide support, investigate errors, and respond to feedback;
Prevent fraud, abuse, unauthorized access, and security threats;
Analyze performance and improve product reliability and usability; and
Comply with legal obligations and enforce applicable agreements.

We do not use personal information for targeted advertising. We do not sell or share personal information as those terms are defined under applicable state privacy laws, including for monetary or other valuable consideration or for cross-context behavioral advertising.

4. Organization Control and Company Workspace Separation

ForgeOne separates company workspaces by organization. Authorized administrators within an organization control membership and may access, manage, export, or delete information in that workspace according to their permissions.

If your account is provided by an employer or another organization, that organization may control your ForgeOne access and the records you create. Questions about its internal privacy practices should be directed to that organization.

5. How Information May Be Shared

5.1 Service Providers. We share information with service providers that help us host, store, secure, email, process payments, monitor, support, or operate ForgeOne. For Print and Merch orders, we share order details, shipping names, and shipping addresses with third-party print fulfillment providers solely for the purpose of manufacturing and delivering your order. All service providers receive information only as needed to perform services on our behalf and are bound by contractual obligations to protect it.

5.2 Measurement and Mapping Providers. When you use ForgeOne’s measurement tools, geographic coordinates or mapping requests may be transmitted to third-party mapping providers to display interactive imagery. Specifically:

Apple Maps and Apple MapKit may receive mapping requests and geographic coordinates to render interactive satellite imagery within the measurement tools. Apple’s handling of that data is subject to Apple’s privacy policy.
Aerial imagery may be retrieved from U.S. Geological Survey (USGS) National Agriculture Imagery Program (NAIP) services. USGS imagery is publicly available U.S. government data.
If you use optional HOVER, EagleView, or other third-party measurement integrations, information necessary to fulfill your measurement request (such as property address and coordinates) is shared with the applicable third-party provider under their own terms and privacy practices. ForgeOne shares this information only when you initiate a request through the integration.

5.3 User-Configured Integrations. ForgeOne offers integration features that allow you to connect your workspace to third-party platforms through outbound webhooks, native application integrations (such as Zapier), direct API connections, or other methods (“User-Configured Integrations”). When you enable an integration and a configured trigger event occurs (such as a job status change), ForgeOne transmits the data fields associated with that event to the third-party platform you selected. Transmitted data may include customer names,

email addresses, phone numbers, mailing addresses, property addresses, job details, and other Customer Data associated with the triggering event.

Data transmitted through a User-Configured Integration is sent at your instruction. ForgeOne acts as a processor carrying out your data-sharing instruction. Once the data reaches the receiving platform or any middleware service used to route the transmission, that platform’s own privacy practices and terms govern the data. ForgeOne does not control how the receiving platform uses, stores, or shares the transmitted data.

If you use Zapier as integration middleware, Customer Data passes through Zapier’s systems in transit to the destination platform. Zapier’s handling of that data is subject to Zapier’s privacy policy and data processing terms.

You are responsible for obtaining any required consents or authorizations from individuals whose personal information is transmitted through an integration before enabling the integration. This includes any consents required under the Telephone Consumer Protection Act (TCPA), CAN-SPAM Act, or applicable state privacy laws before the receiving platform sends communications to those individuals on your behalf.

5.4 At Your Direction. In addition to User-Configured Integrations described in Section 5.3, information may be shared at a user’s direction through document review links, customer portals, invitations, exports, email delivery, measurement report sharing, or records made visible to customers and business partners.

5.5 Legal and Safety. We may disclose information when required by law, legal process, or a valid government request; to protect rights, safety, and security; or as part of a merger, financing, acquisition, or sale of assets subject to appropriate safeguards.

5.6 No Sale or Sharing for Advertising. We do not sell personal information for monetary or other valuable consideration. We do not share personal information for cross-context behavioral advertising. No categories of personal information have been sold or shared in the preceding 12 months. Data transmitted through User-Configured Integrations at your instruction is not a sale or sharing of personal information by ForgeOne; it is a disclosure directed by you as the data controller.

6. SMS and Mobile Messaging

When you voluntarily opt in to receive text messages from ForgeOne™ CRM LLC, we may use the mobile number you provide to send account and service communications, customer support messages, reminders, status updates, invoice and payment notifications, document links, and other requested service-related communications. Message frequency varies based on account activity, requested services, and your interactions with ForgeOne. Message and data rates may apply. You may reply STOP to opt out or HELP for assistance.

Mobile information, including mobile phone numbers, SMS or MMS opt-in data, and messaging consent, will not be sold, rented, transferred, or shared with third parties or affiliates for their marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. Service providers acting on our behalf may process messaging information solely as necessary to enable and deliver the messaging service, or when disclosure is required by law.

Consent to receive text messages is optional and is not a condition of purchasing or using ForgeOne services.

7. Cookies and Session Technologies

ForgeOne uses session cookies and similar technologies necessary to keep users signed in, protect accounts, remember preferences, and operate application features. Browser settings may allow you to block cookies, but essential functions may stop working.

8. Universal Opt-Out Signals

ForgeOne recognizes and honors Global Privacy Control (GPC) and similar browser-based or device-based universal opt-out signals. When we detect a GPC signal, we treat it as a valid request to opt out of the sale or sharing of personal information and of targeted advertising, as required by applicable state privacy laws including those of Texas, California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, and Oregon.

You do not need to take any additional action beyond enabling GPC in your browser or device.

9. Data Retention

We retain information for as long as reasonably necessary to provide ForgeOne, maintain business and audit records, comply with law, resolve disputes, enforce agreements, and protect the service. Retention may vary by data type, plan, account status, legal requirement, and organization instruction.

Measurement data, including property coordinates, drawn measurements, uploaded images, interior scan artifacts, 3D model files, and generated reports, is retained as part of your Customer Data associated with the applicable job in your CRM workspace. Measurement data follows the same retention principles as other Customer Data. Precise retention periods and deletion practices specific to measurement data and interior property scans will be documented in a supplemental data retention schedule as those practices are finalized.

Print and Merch order records, including shipping addresses and order details, are retained for as long as necessary to fulfill the order, process returns or refunds, comply with tax and accounting obligations, and resolve disputes.

ForgeOne does not retain copies of Customer Data transmitted through User-Configured Integrations beyond what is already stored in your CRM workspace as part of the underlying job or customer record. Integration transmission logs may be retained for a limited period for troubleshooting and audit purposes.

Deleted information may remain temporarily in backups or logs before secure deletion or overwriting.

10. Account Deletion

ForgeOne users may delete their user account directly from Settings, then My Profile. A web-based deletion path is also available at forgeonecrm.com/account-deletion for users who no longer have the app installed.

Deleting a user account removes or de-identifies the user’s ForgeOne profile identity and removes authentication credentials, active sessions, passkeys, push-notification registrations, organization memberships, and other personal account-access records. The deleted login email may later be used to create a new ForgeOne account, but that new account is a separate identity.

Customer, project, financial, insurance, document, measurement, property scan, production, audit, and other records entered into a company workspace may be controlled by that organization rather than by the individual user. Those company-owned records, including measurement data and interior property scans stored within a job, are not automatically erased when an employee or other individual deletes a user login. ForgeOne may retain such records, with the deleted user de-identified where practicable, when reasonably necessary for legitimate business records, security, fraud prevention, legal obligations, dispute resolution, or audit integrity.

Organization administrators may request deletion of specific measurement data, property scans, or other job-associated records through their workspace controls or by contacting support@forgeonecrm.com.

11. Security

We use administrative, technical, and organizational safeguards designed to protect information, including authentication, role-based access, organization-scoped data controls, private file storage, and secure transmission. No system can guarantee absolute security, and users are responsible for protecting credentials and managing access appropriately.

12. Data Breach Notification

If we become aware of a security breach involving personal information, we will investigate promptly and, where required by applicable law, notify affected individuals and relevant authorities within the timeframes those laws require. If ForgeOne processes Customer Data on behalf of a business customer and a breach affects that data, we will notify the customer promptly so that the customer can meet its own legal notification obligations.

13. ForgeOne as a Data Processor

When ForgeOne processes Customer Data on behalf of a business customer, ForgeOne acts as a data processor (or “service provider” under California law). In that role, we process Customer Data only according to the customer’s instructions and the terms of our agreement, and we do not use Customer Data for our own independent purposes beyond providing and securing the service. Transmission of Customer Data through a User-Configured Integration is a processing activity carried out at the customer’s instruction.

Business customers who need a written Data Processing Addendum (DPA) to meet their obligations under applicable privacy laws may request one by contacting support@forgeonecrm.com.

14. Your Privacy Rights by State

Depending on where you reside, applicable state privacy laws may give you specific rights regarding your personal information. This section describes those rights and how to exercise them.

14.1 Rights Available Under Applicable State Laws. If you are a resident of a state with a comprehensive privacy law, including but not limited to Texas, California, Virginia, Colorado, Connecticut, Utah, Oregon, Montana, Iowa, Indiana, Tennessee, Delaware, New Hampshire, New Jersey, Kentucky, Nebraska, Minnesota, Maryland, and Rhode Island, you may have some or all of the following rights:

Right to Know and Access. Request confirmation of whether we process your personal information and obtain a copy of the specific personal information we have collected about you.
Right to Correct. Request correction of inaccurate personal information we maintain about you.
Right to Delete. Request deletion of personal information we have collected from or about you, subject to certain legal exceptions.
Right to Data Portability. Obtain a copy of your personal information in a portable, readily usable format.
Right to Opt Out of Sale or Sharing. Direct us not to sell your personal information or share it for cross-context behavioral advertising. ForgeOne does not sell or share personal information, so there is currently no sale or sharing to opt out of.
Right to Opt Out of Targeted Advertising. Direct us not to use your personal information for targeted advertising. ForgeOne does not engage in targeted advertising.
Right to Opt Out of Profiling. Where applicable, direct us not to process your personal information for profiling in furtherance of decisions that produce legal or similarly significant effects.
Right to Limit Use of Sensitive Data. Where applicable, direct us to limit our use of sensitive personal information to what is necessary to provide the service you requested.
Right to Non-Discrimination. We will not discriminate against you for exercising any of these rights.

14.2 Texas Residents (TDPSA). The Texas Data Privacy and Security Act provides Texas residents acting in an individual or household capacity with the rights described above, including the right to access, correct, delete, and obtain a portable copy of personal data and to opt out of targeted advertising, the sale of personal data, and certain profiling. ForgeOne honors Global Privacy Control signals as a valid opt-out request under the TDPSA. Data collected and processed solely in a business-to-business context is exempt from the TDPSA, though we extend the rights described in this section to all users who request them.

14.3 California Residents (CCPA/CPRA). If the California Consumer Privacy Act applies to ForgeOne based on applicable statutory thresholds, California residents have the rights described above plus the right to know the categories and specific pieces of personal information collected, the categories of sources from which information was collected, the business or commercial purpose for collection, and the categories of third parties with whom information is shared. California residents may also designate an authorized agent to submit requests on their behalf. ForgeOne does not sell or share personal information as defined under California law.

14.4 How to Exercise Your Rights. You may submit a privacy rights request by:

Emailing support@forgeonecrm.com; or
Calling (844) 933-1276.

We will verify your identity before processing your request. We will respond to a verified request within 45 days of receipt. If we need additional time, we will notify you of the extension and the reason, up to an additional 45 days.

14.5 Appeals. If we decline your privacy rights request in whole or in part, you may appeal by contacting us at support@forgeonecrm.com with “Privacy Appeal” in the subject line. We will respond to appeals within the timeframe required by applicable law. If your appeal is denied, we will inform you of your right to contact your state attorney general’s office.

15. Children

ForgeOne is a business service and is not directed to children under 13. We do not knowingly collect personal information directly from children for their own use of the service.

16. Changes to This Privacy Policy

We may update this Privacy Policy as ForgeOne, legal requirements, or data practices change. We will provide at least 30 days’ advance notice of material changes by email to the address associated with your account. Material updates may also be presented in the application. The effective date above identifies the current version.

17. Contact

Privacy questions may be sent to support@forgeonecrm.com or by calling (844) 933-1276.