Data Processing Addendum

01Scope and roles

In this DPA, “Customer” means the owner of a Team or Agency workspace, and “Customer Personal Data” means personal data that Customer or its members upload to, or create in, the workspace (for example, photos, videos, voices, names, and client details). For Customer Personal Data, Customer is the controller (or a processor acting for its own client) and Forgeborn is the processor (or sub-processor).

This DPA covers processing under the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act (together, “Data Protection Laws”). It does not cover account, billing, and usage data that Forgeborn processes as a controller under its Privacy Policy.

This DPA stays in effect for as long as Forgeborn processes Customer Personal Data, even after the plan ends. If this DPA and the Terms of Service conflict, this DPA prevails for Customer Personal Data.

02Details of the processing

• Subject matter and nature: hosting, storing, and processing content with AI models to provide the Forgeborn service.
• Purpose: to provide the service to Customer as described in the Terms of Service, and for no other purpose.
• Data subjects: people whose personal data Customer uploads or creates, such as workspace members, Customer’s clients, and people shown or heard in content.
• Categories of data: names and contact details, images and videos showing people, voice recordings, text that mentions people, and technical data such as IP addresses of members.
• Sensitive data: Customer must not upload special categories of data (such as health data or government ID numbers) unless needed for the content and lawful. Forgeborn does not use images or voices to identify people.
• Duration: for the term of the plan, plus the return and deletion periods below.

03Customer instructions

Forgeborn processes Customer Personal Data only on Customer’s documented instructions. The Terms of Service, this DPA, and Customer’s use and settings of the service are those instructions. If Forgeborn believes an instruction breaks Data Protection Laws, it will tell Customer. Forgeborn may process Customer Personal Data otherwise only where the law requires it, and will tell Customer first unless the law forbids that.

Customer is responsible for having a lawful basis for the processing, for giving the notices and getting the consents Data Protection Laws require (including from people shown or heard in content, as our Terms require), and for the accuracy of Customer Personal Data.

04Confidentiality

Forgeborn makes sure that people it authorizes to process Customer Personal Data are bound by confidentiality and access it only as needed to provide, support, secure, and maintain the service.

05Security measures

Forgeborn uses technical and organizational measures appropriate to the risk to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. They include:

• encryption of data in transit over public networks, and encrypted storage with our cloud providers;
• access controls based on roles and least privilege, unique accounts, and strong authentication for staff access;
• separation of each workspace’s data, with workspace roles (owner, admin, member) controlling who can see work;
• hashed passwords and protection against automated sign-up and sign-in abuse;
• logging and monitoring of system activity, and incident response procedures;
• keeping systems patched and up to date, and testing changes before release;
• backups and recovery procedures with our hosting providers.

06Sub-processors

Customer generally authorizes Forgeborn to use sub-processors. The categories of sub-processors we use, what each is for, and the data it handles are listed on our Sub-processors page. Our payment provider (Merchant of Record) acts as an independent controller for payment data.

Forgeborn has written contracts with its sub-processors with data protection terms no less protective than this DPA, and remains responsible for their work.

Adding or replacing a provider or model within a listed category needs no notice. Before Forgeborn adds a new category, it will email the workspace owner at least 15 days before the new category takes effect. Customer may object to a new category on reasonable data protection grounds by emailing support@forgeborn.ai within 15 days of the notice. If we cannot resolve the objection, Customer may end the affected plan and receive a refund of any prepaid fees for the period after it ends.

Forgeborn does not use Customer Personal Data to train AI models. We choose AI model providers whose terms do not allow them to train their models on customer data, and we review this when we add a provider.

See the list of sub-processors

07Data subject requests and assistance

Customer can view, download, and delete workspace content in the service. If Forgeborn receives a request from a data subject about Customer Personal Data, it will pass it to Customer and will not answer it itself unless the law requires. Forgeborn will reasonably help Customer respond to such requests and, taking into account the information available to it, with data protection impact assessments, consultations with authorities, and security obligations.

08Personal data breach notification

If Forgeborn becomes aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data, it will notify Customer without undue delay by email to the workspace owner. The notice will describe, as far as then known, what happened, the data and people affected, the likely consequences, and the steps taken or proposed. Forgeborn will take reasonable steps to contain the breach and will provide updates as more information becomes available. Notification is not an admission of fault.

09International transfers

Forgeborn and its sub-processors may process Customer Personal Data outside the country where it was collected. Where a transfer from the EU/EEA, the UK, or Switzerland goes to a country without an adequacy decision, the EU Standard Contractual Clauses (Module 2 or Module 3, as applicable) apply and are incorporated into this DPA, with Customer as data exporter and Forgeborn as data importer. For UK transfers, the UK International Data Transfer Addendum applies to those clauses; for Swiss transfers, the clauses apply with references to the GDPR read as references to Swiss law and the Swiss FDPIC as the competent authority. If a new lawful transfer mechanism is adopted, Forgeborn may use it instead.

10US state privacy laws

For personal information covered by US state privacy laws, Forgeborn acts as a service provider, contractor, or processor. Forgeborn will not sell or share it; will not retain, use, or disclose it for any purpose other than providing the service, or outside its direct business relationship with Customer; will not combine it with personal information from other sources except as those laws allow; and will tell Customer if it can no longer meet its obligations under those laws.

11Audits

Forgeborn will make available the information reasonably needed to show compliance with this DPA, for example by answering a security questionnaire. If that is not enough, or a data protection authority requires it, Customer may audit Forgeborn once a year with at least 30 days’ written notice, during business hours, at its own cost, and under confidentiality obligations.

12Return and deletion

During the plan, Customer can download or delete workspace content at any time. When a plan ends, the workspace keeps view-and-download access for 14 days, as described in the Terms of Service, so Customer can take a copy. Customer may email support@forgeborn.ai to ask Forgeborn to delete Customer Personal Data, and Forgeborn will delete it within 30 days of the request, unless the law requires it to keep some data. Copies in backups are deleted on the normal backup cycle and are kept protected until then.

13Liability and changes

Each party’s liability under this DPA is subject to the limits in the Terms of Service, except where Data Protection Laws or the Standard Contractual Clauses do not allow such limits. Forgeborn may update this DPA to keep it compliant with Data Protection Laws, but will not materially reduce the protection of Customer Personal Data without telling Customer first.

14Contact

Questions about this DPA, notices, and requests can be sent to support@forgeborn.ai.

Read the Terms of Service