Privacy Notice
The short version
- We collect only what we need to answer demo requests and to run the customer portal for our restaurant customers.
- We don't sell your personal information or share it for targeted advertising.
- We don't use advertising or analytics cookies. The portal uses one cookie to keep you signed in, and nothing else.
- We don't track whether you open our emails or click their links.
- You can ask us for a copy of your information, or ask us to correct or delete it, by emailing privacy@forgeserve.io.
Who we are
Forge Serve Applications ("ForgeServe", "we", "us") is based in the United States. We run the website at forgeserve.io, the demo request form on it, and the ForgeServe customer portal.
The best way to reach us about privacy is by email: privacy@forgeserve.io.
What this notice covers
- Our website, forgeserve.io.
- Our demo request form, for people who ask us for a demo.
- The customer portal at forgeserve.io/portal. Staff of restaurants that use ForgeServe sign in there to message us, raise support tickets and check their app's status.
This notice does not cover information that restaurants hold about their own guests and employees in ForgeServe's restaurant software. The restaurant decides how that information is used, and our agreement with the restaurant covers how we handle it. If you are a guest of a restaurant, please contact the restaurant.
Information we collect
When you visit our website
- Technical data. Like every website, our hosting provider (Cloudflare) receives your IP address, browser type, and the pages you request, so it can deliver the site and protect it from attacks.
- Fonts. Our main page loads fonts from Google Fonts. Your browser connects to Google to fetch them, so Google receives your IP address and browser details. This page loads no fonts from Google.
- Prices in your currency. If your device's language settings suggest a currency other than US dollars, your browser asks a public exchange-rate service (api.exchangerate-data.com, or open.er-api.com as a backup) for the current rate. That service receives your IP address. We send it nothing else.
- Language choice. If you pick a language, your browser remembers it (see Cookies).
When you request a demo
- Your first and last name, work email address, restaurant name, restaurant size, number of locations, current POS system, and the language you were using on the site.
- Your IP address and browser user agent, and the date and time of your request. We use these to stop spam and abuse of the form.
- Whether, and when, you confirmed your request using the link we emailed you.
When you use the customer portal
- Your account. Your work email address, and your name if your organisation gave it to us. We also record which restaurant account you belong to, when your access was set up, and when you last signed in. We create portal accounts only for people our customer asks us to add; there is no self sign-up.
- Sign-in and security information. When you ask for a sign-in link or use the portal, we record your IP address, your browser's user agent, and the date and time. Sign-in links and session cookies are never stored in readable form. We keep only a one-way code (a hash) of them.
- What you send us. Messages, support tickets and comments, including anything you type into them, along with our replies and our team's internal notes on your tickets.
- Application status. We check whether your ForgeServe app is online and how quickly it responds. This is information about the app, not about you.
Please don't put card numbers, passwords, or your guests' or employees' personal details in messages or tickets. Use order or reference numbers instead.
We don't ask for sensitive information such as government ID numbers, financial account details, health information or precise location, and we don't collect payment card data through the website or the portal.
How we use it
| What we do | Information used |
|---|---|
| Answer your demo request and follow up about it | Demo form details |
| Confirm a demo request really came from you before our team sees it | Email address, a one-time confirmation link |
| Stop spam and abuse of the demo form and sign-in | IP address, user agent, email address (rate limits) |
| Give you access to the portal and send you sign-in links | Account details, email address |
| Answer your messages and support tickets | What you send us, our replies and notes |
| Send you service emails: invitations, sign-in links, and alerts that we replied or a ticket changed status | Email address |
| Keep the website and portal secure and investigate incidents | Sign-in and security information, activity records |
| Show your app's status | Application status (not personal information) |
| Meet legal obligations and protect our rights | Any of the above, only as needed |
We don't use your information to make automated decisions about you that have legal or similarly significant effects. If we start using automated or AI-assisted tools to help handle support requests, we will update this notice first.
Emails we send
- Demo confirmation. One email with a link to confirm your request. It doesn't repeat what you typed into the form. If you don't click the link, our team never sees the request.
- Portal emails. Invitations, one-time sign-in links, and alerts when we reply or a ticket's status changes. They don't contain the text of your messages.
These emails are part of a service you asked for, so they aren't marketing. We have turned off open and click tracking, so we don't know whether you opened an email or clicked a link in it. We don't currently send marketing emails. If we ever do, every one will identify us and include a way to unsubscribe.
Cookies and similar technologies
| Name | Where | What it does | How long |
|---|---|---|---|
__Host-fs_portal (cookie) | Customer portal | Keeps you signed in. Strictly necessary: the portal can't work without it. It's sent only to forgeserve.io, over HTTPS, and page scripts can't read it. | 7 days, or until you sign out |
CF_Authorization (cookie) | ForgeServe staff area only | Signs in ForgeServe staff. Customers and visitors never receive it. | Session length set by our provider |
Cloudflare security cookies, such as __cf_bm | Any page, only if our hosting provider needs them | Help protect the site from bots and attacks. Strictly necessary. | Short-lived |
fs-lang (browser storage, not a cookie) | Website | Remembers the language you picked. It stays in your browser and isn't sent to us. | Until you clear your browser data |
The marketing website sets no cookies of its own. We don't use advertising or social media tracking cookies or pixels, and we don't use analytics cookies. Everything in the table above is either strictly necessary or remembers a choice you made, so we don't show a cookie banner. If we ever add anything else, we will update this notice and ask for your consent where the law requires it.
Website statistics. The marketing website uses Cloudflare Web Analytics to count visits and see which pages are used and how fast they load. It doesn't set cookies, doesn't store anything in your browser, and doesn't build a profile of you or follow you across other websites. We only see totals (for example, page views per day, by country and by browser type), not individual visitors. The customer portal doesn't run it.
Do Not Track and Global Privacy Control. We don't track visitors across other websites and don't sell or share personal information for advertising, so these browser signals have nothing to switch off here. We still treat a Global Privacy Control signal as a request to opt out of any sale or sharing.
Who we share it with
We don't sell your personal information, and we don't share it for cross-context behavioral (targeted) advertising. We share it only with service providers that handle it for us under contract and only to provide their service to us:
| Provider | What for |
|---|---|
| Cloudflare | Website and portal hosting, databases, security, cookie-free website statistics, and sign-in for our staff |
| Resend | Sending our emails (demo confirmations, sign-in links, invitations and alerts) |
| Google (Google Workspace) | Our team's email. It receives confirmed demo requests and portal activity alerts. |
Your browser also contacts Google Fonts and an exchange-rate service directly when you visit our main page, as described under Information we collect.
We may also disclose information:
- if the law requires it, or to respond to valid legal process
- to protect the rights, safety and security of our customers, users, the public or ForgeServe
- to a buyer or successor if our business is reorganized or sold. This notice would continue to apply to your information.
Our providers store and process information in the United States and may also process it in other countries where they operate.
How long we keep it
| Information | How long |
|---|---|
| Unconfirmed demo requests | Deleted automatically after the 24-hour confirmation link expires |
| Confirmed demo requests | Deleted 12 months after you sent the request, together with the notification copy in our team mailbox. We remove the IP address and user agent after 30 days. If you become a customer, we keep what we need for your account under our agreement with you. |
| Portal sign-in links (stored only as a hash) | Links expire 15 minutes after you request them. Their records are deleted about a day later. |
| Portal sessions, including IP address and user agent | Deleted when you sign out, or when the session expires (at most 7 days) |
| Rate-limit records | 24 hours |
| Security and activity records | IP address and user agent removed after 90 days; the record is deleted after 12 months. Records of failed or unrecognized sign-in attempts are deleted after 30 days. |
| Your portal account | While your organisation's access continues. If your access is removed, we anonymize your account within 90 days. |
| Messages, tickets and notes | While your organisation is our customer, and for 12 months afterwards, unless we need them longer for a legal claim or obligation |
| Backups kept by our database provider | A short rolling window, up to 30 days. After that, deleted data is gone from backups too. |
Clean-up runs automatically, but it may happen a little after the times above. Our email provider keeps delivery records for a limited time under its own retention settings.
How we protect it
- All connections to our website and portal are encrypted (HTTPS).
- The portal signs you in with one-time links instead of passwords. Links and session cookies are stored only as hashes.
- Each customer organisation can see only its own information.
- The portal loads no third-party scripts.
- Our staff need multi-factor sign-in to reach the admin area.
- We keep a log of security-relevant actions.
No system is perfectly secure. If a security breach affects your personal information, we will notify you and the authorities as the law requires.
Your choices and rights
Wherever you live, you can ask us to:
- tell you what personal information we hold about you and give you a copy
- correct information that is wrong
- delete your information. We may keep some of it where we have a good reason, for example security records or the record of support we gave your organisation, and we'll tell you if we do.
- stop sending you a particular kind of email, where it isn't needed to provide the service
Some US states give their residents these rights by law, along with the right to opt out of the sale or sharing of personal information (we don't sell or share it) and the right to appeal our decision on a request. We won't treat you differently for using any of your rights.
How to make a request: email privacy@forgeserve.io from the address we have on file, or tell us how to contact you.
- We may need to confirm it's you before we act.
- You can use an authorized agent, but we'll need proof that they're acting for you.
- We'll reply within 45 days, or sooner where the law requires.
- If we turn down your request, you can appeal by replying to our decision. We'll respond to the appeal within the time the law allows.
For portal access, your organisation decides who has an account. You can also ask your organisation's account owner to remove your access.
Visitors from the EEA, UK and Switzerland
If you are in the European Economic Area, the United Kingdom or Switzerland, data protection laws there may apply to our handling of your information, and Forge Serve Applications is the controller.
Our legal bases are:
- Steps you asked us to take before a possible contract: answering your demo request.
- Contract, where you personally are our customer, and otherwise our legitimate interests in providing the portal and support to the organisation you work for.
- Legitimate interests in keeping our services secure and preventing abuse, which covers the security records, rate limits and spam checks.
- Legal obligation, where the law requires us to keep or disclose information.
Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for details.
Your information is processed in the United States and other countries. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses (and their UK and Swiss equivalents) or a provider's certification under the Data Privacy Framework. You can ask us for more information.
Your rights:
- access, correction, deletion, restriction, data portability
- to object to processing based on legitimate interests
- to withdraw consent at any time where we rely on it
- to complain to your local data protection authority (in the UK, the Information Commissioner's Office). We'd appreciate the chance to help first.
We'll reply within one month.
Children
Our website and portal are business services for restaurants and their staff. They are not meant for children, and we don't knowingly collect personal information from anyone under 16. If you believe a child has given us information, email us and we'll delete it.
Changes to this notice
We'll update this notice when our practices change, and change the "Last updated" date at the top. If a change materially affects how we use information we already hold, we'll tell portal users by email or in the portal before it takes effect.
Contact us
For questions, requests or complaints about privacy, email privacy@forgeserve.io. We'll get back to you as soon as we can.