Last updated: May 2026
Forge is operated by Shanova AB, a Swedish limited company (aktiebolag) registered in Sweden. If you have any questions about this policy or how we handle your personal data, contact us at privacy@shanova.se. Shanova AB acts as the data controller under the General Data Protection Regulation (GDPR) for personal data processed through the Forge platform. As a Swedish company, we are subject to Swedish data protection law and the GDPR.
Account data. When you create an account, we collect your email address. Your password is handled entirely by Supabase Auth — we never store or see your password in plain text. Supabase hashes it using industry-standard methods before it ever reaches persistent storage.
Run data. The briefs, titles, and outputs you create while using Forge are stored in our Supabase database. This content is yours. We store it so you can retrieve and review your work, compare runs, and build on previous outputs over time.
Usage data. We do not use analytics tools, tracking pixels, or behavioural monitoring. We do not collect browser fingerprints, IP addresses for profiling, session recordings, or any form of tracking data beyond what is strictly necessary to operate the platform.
Company profile. If you fill in your company profile (company name, capabilities, certifications, day rates, reference projects), that information is stored and injected into your runs as context for the AI agents. You can update or delete this information at any time from your settings.
To operate the platform. Your briefs and company context are sent to Azure AI Foundry to run agent pipelines. The outputs are returned and stored so you can retrieve them from your run history. Without this processing, the platform cannot function.
To authenticate you. Your email address is used for login, password reset, and account management. We do not use it for marketing unless you have explicitly opted in.
We do not sell your data to any third party. We do not use your content for advertising purposes. We do not train AI models on your content without your explicit consent. Your outputs remain yours.
To operate Forge, we share data with the following processors. Each one has agreed to handle data in compliance with applicable law.
Supabase (supabase.com) — provides database storage, authentication, and real-time subscriptions. Your account data and run data are stored in Supabase. Data may be stored in the EU or US; where US storage applies, it is covered by Standard Contractual Clauses.
Microsoft Azure — provides AI inference via Azure AI Foundry, blob storage for run outputs, and serverless function execution. Your briefs are sent to Azure AI models to generate outputs. This processing is covered by Microsoft's Data Processing Agreement and their responsible AI practices. Microsoft does not use customer data to train their foundation models.
Forge uses only strictly necessary cookies. We set a Supabase session cookie to keep you signed in between page loads. We do not use analytics cookies, advertising cookies, social media tracking pixels, or any other non-essential cookies. For full details, see our Cookie Policy.
Your runs and outputs are retained for as long as your account is active. You can delete individual runs directly from the platform at any time. To delete your account and all associated data, including your company profile, run history, and outputs, contact us at privacy@shanova.se. We will process deletion requests within 30 days.
If you are located in the EEA, UK, or Switzerland, you have the following rights under GDPR:
To exercise any of these rights, contact privacy@shanova.se. We will respond within 30 days.
All data is encrypted in transit using TLS and encrypted at rest by our storage providers. Access to production data is restricted to authorised personnel. We use Azure Key Vault for managing application secrets. We follow security best practices and review our controls regularly.
We may update this policy from time to time. If we make material changes — changes that meaningfully affect how we collect or use your data — we will notify you by email or through an in-app notice before the changes take effect. The "last updated" date at the top of this page always reflects the most recent version.
Shanova AB · privacy@shanova.se · shanova.se · Sweden