CRM Forge
Navigation

Legal

Privacy Policy

What this product collects, why, who else sees it, and what you can ask us to do about it.

Effective
6 September 2026
Last updated
22 September 2026
Version
2026-09-22

Who we are

This notice is given by CRM Forge (AlgoForgeX LLC, a Texas limited liability company), whose registered address is 13423 Blanco Road, San Antonio, TX 78216, USA. Where this notice says we or us, it means that entity.

Our representative for data protection matters in the European Union and the United Kingdom: No representative is appointed in the European Union or the United Kingdom: the controller is established in the United States and does not offer the service to persons in the European Union or the United Kingdom at this time..

The two different roles we have

We are the controller of the information about you as a user of this product: your account, what you agreed to, how you use the service and what it costs.

We are a processor for the information you put into your workspace about other people, such as your contacts and the companies you sell to. For that information you decide what is collected and why, we act on your instructions, and the section below on a data processing addendum is how you put those instructions in writing.

What we collect about you

Your account: the name and email address you give us, a hashed password, whether you confirmed your address, the version of the terms you accepted and when, whether you opted in to marketing messages and when, and the times you signed in.

Your profile: a display name and a profile picture, both optional, and collected only where the profile features are switched on for the service you are using. If you set either, colleagues in a workspace you share with them can see it, and so can the people who operate this service. Where those features are switched on you can change or remove either of them at any time from your account, and removing a picture deletes it.

Your workspaces: the records you create or import, the notes and tasks you write, and the activity history the product keeps of what changed and when.

Your usage of AI features: which feature ran, which model answered, how many tokens it used, how long it took and what it cost. This is what your credit balance is calculated from and it is what an operator sees on the usage page.

Billing: your plan, seat count and payment result. Card details are entered on the payment processor's own page and never reach this product.

Fault records: when something fails, we record the error, the page it happened on and enough context to fix it.

Searches you start from the command palette: the words you searched for appear in the page address, so they are kept in your own browser's history like any other address, and they reach our hosting provider's request logs if you reload or share that address.

Visits to this public site: the page path, the referring address and the day, counted as a daily total. No cookie, no identifier and no record of an individual visit.

Why we use it, and on what basis

To provide the service you asked for, which covers your account, your workspaces and everything you do inside them. That is performance of our contract with you.

To keep the service working and safe: rate limits, abuse controls, error diagnosis and backups. That is our legitimate interest in running a service that stays up and is not abused.

To take payment and keep the records tax law requires. That is a legal obligation.

To send you marketing messages, if and only if you opted in. That is your consent, and the section below says how to take it back.

Marketing messages and how to withdraw consent

The marketing opt-in on the registration form is a separate, unticked box. Nothing about creating an account opts you in, and declining it changes nothing else.

You can withdraw that consent at any time, and it is as easy to withdraw as it was to give: reply to any marketing message we send you and say so, or write to us at the address on our contact page. We record the withdrawal and stop.

Withdrawing marketing consent does not stop the messages the service has to send you to work, such as address confirmation, password resets and billing receipts. Those are part of the contract rather than marketing, and they stop when your account does.

Who else processes your information

We use a small number of other companies to run this product: a hosting platform, a mail service, an AI provider, a payment processor and a map service. Each of them is named on our sub-processor page, with what they do, what reaches them and where.

Two of those are worth stating here. Our mail is sent through Azure Communication Services, whose data location is set to the United States, so the content of a message we send you is processed there. Our AI calls are answered by Anthropic, whose commercial terms say your content is not used to train their models.

One more works differently, and it is worth being plain about. Where the interactive map is switched on for the service you are using, the map's background imagery is fetched by your own browser directly from OpenFreeMap, a service operated from Hungary. That tells them which map tiles you asked for, which is the part of the world on your screen. When the map first opens that is the wide region your own records sit in, because it opens fitted around them - or around the one company a link named, at the same width, when you came from a link to a single company; after that it is wherever you have moved to. Either way it is a region rather than a street. It also tells them your internet address, which any site your browser fetches from receives. Nothing else about your workspace goes with it: no company, no contact, no address and no marker. Your companies and their positions are drawn by this product, on top of that imagery, and are never sent to them. The request carries no cookie of ours, and they state that they set none of their own.

We do not sell your personal information and we do not share it for cross-context behavioural advertising.

Where your information is held

In the United States. The application runs in the West US 2 region of Microsoft Azure and its database and secrets are in Central US. If you are outside the United States, using this product means your information is transferred there.

How long we keep it

Your account and workspace data for as long as you have an account, and then for a short period while backups age out.

Billing and tax records for as long as tax law requires, which is longer than your account.

Fault records and the public site's daily visit counts for a limited period, measured in weeks rather than years.

Your rights

You can ask us for a copy of your information, ask us to correct it, ask us to delete it, ask for it in a portable format, object to a use of it, or withdraw a consent you gave. Two of those you can do yourself right now: signed in, the personal data page in your account settings downloads your data and deletes your account.

For anything else, write to us at the address on our contact page. We answer within one month. If you are unhappy with the answer you can complain to your data protection supervisory authority.

Deleting your account is refused in three cases, and only these: while you are the only owner of a workspace that other people are in; while you are the only owner of a billing account that other people are on; and while a billing account that is yours alone has a subscription that will renew. The first two would leave people with records and a balance nobody could manage, and the third a card that would be charged again with nobody left who could stop it. A workspace or a billing account that nobody else is in does not stop you: the workspace is closed when you go.

The refusal names what to do first. For a workspace or a billing account other people are in, make somebody else an owner of it. For a subscription, cancel it on your billing page; once the cancellation is scheduled you can delete your account, and the subscription runs to the end of the period you have paid for and then stops. Deleting your account does not cancel it for you.

If you are a California resident, the rights above cover the requests the CCPA gives you. We do not sell or share personal information, so there is no opt-out for us to offer you.

A data processing addendum

Where we process your customers' information on your behalf, a data processing addendum is available on request. Write to us at the address on our contact page and we will send you one to sign.

AI features and automated decisions

AI features run when you ask for them. What they send is the records the feature is working on, and what comes back is a draft, a summary or a set of findings that you read and accept before anything is written to a record or sent to anybody.

Nothing in this product makes a decision about a person automatically and acts on it. A person is always the one who accepts a finding, sends a message or changes a record.

Security

Each workspace is isolated from every other one in the data layer, on every read and every write, and that isolation is checked by a test suite that has to pass before anything ships. Secrets are held in a managed key vault, connections are encrypted, and sign-in cookies are protected by a key ring the application does not keep on disk.

Children

This product is for business use and is not directed at children. Do not create an account if you are under 16.

Changes to this notice

This notice carries a version and an effective date at the top. When it changes materially we tell account owners before the new version takes effect.