Version 1.2 - Last updated: January 2025
Overview: At Forge APIs ("we", "our", or "us"), we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our products including DupeCheck, RiskScore API, and other services.
By using our services, you agree to the collection and use of information in accordance with this policy.
What we process:
What we store:
What we process:
What we store:
We process personal data based on the following legal grounds:
We use the collected information for:
We do not sell, trade, or rent your personal information. We may share information with:
We implement appropriate technical and organizational measures to protect your data:
However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
We retain your information for as long as necessary to provide our services and comply with legal obligations:
Depending on your location, you may have certain rights regarding your personal data:
To exercise these rights, please contact us at privacy@forgeapis.com.
For users in the European Economic Area (EEA) and United Kingdom:
California residents have additional rights under the California Consumer Privacy Act:
To exercise these rights, California residents can contact privacy@forgeapis.com.
We use minimal browser storage for functionality:
Our services are strictly for users 18 years and older.
We do not knowingly collect personal information from individuals under 18. If you believe we have inadvertently collected information from a minor, please contact us immediately at privacy@forgeapis.com for deletion.
In the event of a data breach that poses risk to your rights and freedoms:
No, we never sell your personal data. We do not sell, rent, or trade your personal information to third parties for marketing purposes or any other reason. Your data is used solely to provide our services to you. We may share data with essential service providers (like payment processors) but only to the extent necessary to operate our services.
DupeCheck never stores your actual invoice data. When you upload a file, we process it entirely in server memory and immediately delete it after analysis. We only retain high-level summaries (like "analyzed 500 invoices, found 12 duplicates on January 15th") for 90 days to show in your dashboard history. We never store vendor names, amounts, invoice numbers, or any sensitive financial information.
Yes, we are fully GDPR compliant for EU and UK users. We act as a data processor for your data, implement appropriate security measures, respect all data subject rights (access, deletion, portability, etc.), maintain processing records, provide data breach notifications within 72 hours, and use Standard Contractual Clauses for any data transfers outside the EEA. You can exercise your GDPR rights by contacting privacy@forgeapis.com.
Retention periods vary by data type: DupeCheck analysis summaries are kept for 90 days then automatically deleted; API request logs are retained for 30 days; account information is kept while your account is active plus 90 days after closure; payment records are retained for 7 years (legal requirement); and uploaded files are immediately deleted after processing. You can request deletion of your data at any time by contacting us.
We implement industry-standard security including: TLS 1.3 encryption for all data transmission, bcrypt password hashing (never storing plain text), encrypted API key storage, regular security audits, rate limiting to prevent abuse, secure data centers with physical security, limited staff access on a need-to-know basis, and automatic session expiration. However, no internet transmission is 100% secure, so we recommend you also follow security best practices like using strong passwords and enabling two-factor authentication.
Yes, you have the right to data portability. You can request a complete export of your personal data in a machine-readable format (JSON or CSV) by emailing privacy@forgeapis.com with your account details. We'll respond within 30 days with your data export. This includes your account information, analysis summaries, API usage logs, and any other personal data we hold about you.
We use minimal tracking. DupeCheck stores authentication tokens and user preferences in localStorage, plus an anonymous device identifier for free usage limits (automatically deleted after 7 days). We do not use advertising cookies, social media trackers, or third-party analytics cookies. Our APIs authenticate via headers and don't use cookies at all. The dashboard may use session cookies only for login authentication, which expire when you close your browser.
In the unlikely event of a data breach affecting your personal information, we will notify affected users within 72 hours of discovery via email. We'll explain what data was compromised, what we're doing to address it, and steps you can take to protect yourself. We'll also notify relevant supervisory authorities as required by GDPR and other privacy laws. All breaches are documented and investigated thoroughly to prevent recurrence.
Yes, you can delete your account at any time through your account settings or by contacting privacy@forgeapis.com. Upon deletion, we immediately remove access to your account and schedule all associated data for permanent deletion. Most data is deleted within 90 days, except payment records which we must retain for 7 years for legal compliance. You'll receive confirmation once the deletion is complete.
Access to personal data is strictly limited on a need-to-know basis. Only authorized employees and contractors who require access to provide or improve our services can view your data. All staff sign confidentiality agreements and receive privacy training. We use role-based access controls, audit logs to track data access, and revoke access immediately when no longer needed. We never share access credentials and require multi-factor authentication for all internal systems.
For questions about this Privacy Policy or our data practices:
By using Forge APIs services, you acknowledge that: