Forged Studios / Legal
Privacy Policy
Effective Date: September 24, 2026
This Privacy Policy explains how Forged Studios (“Forged,” “we,” “us,” or “our”) collects, uses, discloses and protects personal information.
Forged is a Calgary, Alberta business. We handle personal information with Alberta's Personal Information Protection Act (PIPA) in mind. Other Canadian privacy laws, including the federal Personal Information Protection and Electronic Documents Act (PIPEDA), may also apply in some situations, such as when information moves across provincial or national borders in the course of commercial activity.
1. About This Privacy Policy
This policy applies to personal information Forged handles through forgedstudios.ca, including our contact form and our online sign-up and order form, and through our business relationship with our customers.
Forged also builds and runs websites, booking systems and business software for other businesses. When we process information about those businesses' own customers, we do so on the business's behalf. Section 14 explains how that works and how it differs from the rest of this policy.
2. Information We Collect
When you contact us through our contact form, we collect:
- your name;
- your business name;
- your email address;
- your type of business;
- the plan you are interested in and what you are looking for, if you tell us; and
- anything you choose to write in your message.
When you sign up for a plan through our online order form, we collect:
- your business name, your name, your email address and your phone number;
- your current website, if you have one;
- your type of business;
- setup details you choose to give us, such as your business address, services and prices, business hours, social media and Google Business links, an existing booking link, listings to feature, your domain preference and your choice of starting design;
- the plan you selected, the price and terms shown to you, and the date and time you accepted our Subscription Terms; and
- an order reference.
If you choose a logo file in the order form, it stays in your own browser. It is not uploaded to Forged through the form; we ask you to send it to us by email instead.
When you email us or work with us as a customer, we collect the information you send us, such as your messages, logos, photographs, content for your website and business information.
When you visit our website, our hosting and network providers automatically process technical information such as your IP address, browser type, device type, the pages you request and the time of the request.
When you submit a form, your IP address is used briefly to limit repeated submissions. If our anti-spam checks are triggered, the IP address involved may be recorded in our service logs.
3. How We Collect Information
We collect personal information:
- directly from you, when you fill in a form on our website, email us, or talk to us;
- automatically, when your browser requests pages from our website; and
- from people acting on behalf of your business, such as an owner, employee or representative who contacts us for the business.
We do not buy personal information from data brokers.
4. How We Use Personal Information
We use personal information to:
- respond to enquiries and demo requests;
- process orders and set up the services you sign up for;
- send you payment links, invoices and receipts, and manage billing;
- provide, maintain and support your services;
- communicate with you about your account, your project and changes to our terms or services;
- keep our website and services secure, including detecting spam, abuse and fraud;
- understand how our website is used in general, so that we can improve it; and
- meet our legal, tax and accounting obligations.
We do not sell personal information.
5. Consent
By submitting a form on our website, emailing us, or signing up for our services, you consent to Forged collecting, using and disclosing your personal information for the purposes described in this policy. We may also rely on consent that is implied where the purpose is obvious and you choose to give us the information.
You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. If you withdraw consent, we may not be able to continue providing some or all of our services. For example, we cannot manage an active subscription without contact and billing information.
6. Payments
Forged's website does not ask for, collect or store payment card numbers.
Payments for Forged subscriptions are handled by Square, our payment processor. When you pay, you enter your card details on Square's secure payment page, not on Forged's website. Square handles your card information under its own terms and privacy policy. Forged receives information about the payment, such as the amount, the date, whether it succeeded and limited card details Square makes available, like the card type or last four digits.
After you place an order on our website, we email you a secure Square payment link. Your subscription starts when that first payment is completed. Nothing is charged through our website itself.
7. Service Providers and Third Parties
We use service providers to run our business. They may process personal information on our behalf, only as needed to provide their services to us. These include providers of:
- website hosting and content delivery (Google Firebase Hosting);
- network, security and website analytics services (Cloudflare);
- cloud computing, used to send the messages submitted through our website's forms (Google Cloud);
- email (Google);
- payment processing, when you pay a Forged subscription (Square); and
- for the products we run for our business customers, database, authentication, email delivery and payment services (see Section 14).
We may also disclose personal information:
- to professional advisers, such as accountants and lawyers;
- where required or permitted by law, such as in response to a valid legal request; or
- as part of a sale, merger or reorganization of Forged's business, subject to appropriate protections.
Links to other websites, such as Instagram, are governed by those websites' own privacy policies.
8. Information Stored or Processed Outside Alberta/Canada
Some of our service providers store or process information outside Alberta and outside Canada, including in the United States. For example, the messages submitted through our website's forms are processed on cloud servers in the United States and delivered by email through Google, and our hosting and network providers operate servers in many countries.
When information is stored or processed outside Canada, it is subject to the laws of that country and may be accessible to its courts, law enforcement and national security authorities.
If you have questions about how our service providers outside Canada handle personal information, contact us using the details in Section 18.
9. Cookies and Similar Technologies
Our website's own code does not set cookies. Our network provider, Cloudflare, may set strictly necessary security cookies in some circumstances, for example to tell real visitors apart from automated traffic.
Our online order form saves your answers in your own browser's local storage, so you can leave and come back without starting again. This information stays on your device until you clear it. If you return more than 30 days after your last change to an unfinished form, the old draft is discarded and you start again. After you place an order, your answers stay in your browser so you can return to your setup checklist. You can remove this information at any time by clearing your browser's site data for forgedstudios.ca.
Our website uses Cloudflare Web Analytics to understand, in general terms, how the site is used and how quickly pages load. It collects information such as the pages visited, the referring page, and browser and device information. Cloudflare states that this service does not use cookies to track visitors. We do not use advertising or retargeting technologies on our website.
10. How We Protect Information
We use reasonable physical, administrative and technical safeguards appropriate to the sensitivity of the information. These include encrypted connections to our website, access limited to the people who need it, reputable service providers, and measures that detect and limit spam and abuse of our forms.
No method of transmitting or storing information is completely secure, and we cannot guarantee absolute security.
11. Retention and Deletion
We keep personal information only as long as reasonably needed for the purposes it was collected for, and we do not keep information simply because we have room to store it. When it is no longer needed, we delete it or irreversibly anonymize it.
Messages sent through our website's forms reach us as emails in our business email account. Our website does not keep a separate database of them.
Enquiries and orders that do not become a paid subscription: this includes contact form messages, demo requests and orders placed on our website that are never paid. We keep them for 12 months from our most recent meaningful contact with you, such as your order, a follow-up email, an updated quote or an active conversation about working together. After 12 months without an active business relationship, we delete them or irreversibly anonymize them.
Active customers: while your subscription is active, we keep the information reasonably needed to provide and support your services.
After a subscription ends: we keep the operational information for your service for 90 days, so that you can request an export, reverse an accidental cancellation, or receive final support, and so that we can close your account. After those 90 days, we delete or irreversibly anonymize operational personal information we no longer need.
Financial, tax and contract records: records such as invoices, payment and subscription billing records, refund records, GST and accounting records, your order and your acceptance of our Subscription Terms are kept separately from operational information. They are not deleted after 90 days. We keep them for as long as the law requires, which for Canadian tax records is generally six years from the end of the last tax year they relate to, and longer where the law requires it.
Legal matters: if information is reasonably needed for an active dispute, legal claim, chargeback, tax inquiry, privacy investigation, unresolved security incident or other legal requirement, we may keep it for as long as that matter reasonably requires, and no longer.
Our service providers also keep some information under their own schedules. For example, the service logs of the cloud platform that sends our form messages are kept for 30 days, and Square keeps payment records under its own terms and legal obligations. Deleted information may remain in our service providers' backups for a period before it is removed in the ordinary course.
12. Accessing or Correcting Personal Information
You may ask for access to the personal information Forged holds about you, and ask us to correct information you believe is inaccurate or incomplete. Send your request to us using the details in Section 18. We may need to confirm your identity before responding.
We will respond within the time required by law. Under Alberta's PIPA, that is generally within 45 days. In limited cases the law allows or requires us to refuse access; if so, we will tell you why, where we are permitted to.
13. Marketing Communications
We do not currently send marketing emails or run a mailing list. Filling in our contact or order form does not sign you up for one.
If we ever send commercial electronic messages, we will do so in line with Canada's Anti-Spam Legislation (CASL), with your consent where it is required, and with a simple way to unsubscribe.
We will still send you messages about your enquiry, your order, your account and your services.
14. Business Customer Data
Forged provides websites, booking systems and business software to other businesses, such as sports facilities, coaches, automotive shops, real estate professionals and contractors. Through those products, Forged may process personal information about that business's own customers, members, clients, staff and other users, such as names, contact details, bookings, account logins, payment records and messages. In some products this can include information about children, for example when a parent books for a child.
When we process this information, we do so on behalf of the business and under its instructions. The business decides what information is collected and why, and is responsible for its own privacy obligations to its customers. Forged does not own that data and does not use it for its own marketing.
These products rely on service providers such as Google Cloud and Firebase for hosting, databases and account logins, email delivery providers for booking confirmations and other notices, and payment processors such as Square. Some of these providers store or process information in the United States.
If you are a customer of a business that uses a Forged product and you have a question about your personal information, please contact that business first. We will help the business respond.
15. Children's Information
Forged's own website and services are intended for businesses and adults. We do not knowingly collect personal information from children through forgedstudios.ca.
Information about children that is processed through a product we run for a business customer is covered by Section 14 and handled on that business's behalf.
16. Privacy Incidents
If a privacy incident involving personal information under our control happens, we will take reasonable steps to contain it and assess the risk. Where there is a real risk of significant harm to individuals, we will notify affected individuals and the Office of the Information and Privacy Commissioner of Alberta, and any other regulator, as required by law.
If an incident affects information we process for a business customer, we will notify that business without unreasonable delay and help it meet its own obligations.
17. Changes to This Privacy Policy
We may update this Privacy Policy as our services and practices change. We will post the updated version on this page with a new effective date. If a change materially affects how we handle information you have already given us, we will tell you through reasonable means, such as by email.
18. Contacting Forged About Privacy
Questions, requests for access or correction, and complaints about how Forged handles personal information can be sent to:
Forged Studios
Calgary, Alberta, Canada
Please include “Privacy” in the subject line.
If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner of Alberta. Where PIPEDA applies, you may also contact the Office of the Privacy Commissioner of Canada.