Draft. This text has not had legal review, and the company and contact details are still to be added.

Privacy Policy

Version 2026-10-20

This policy explains what NextForge collects, why, who it goes to, and the rights you have over it.

Who we are

The company name and contact address will be added here before launch.

What we collect

• Account details: your name, email address, profile picture, organization, and a hash of your password. If you turn on two-step verification, we also store its secret and recovery codes.
• Your work: the issues, comments, documents, files, meeting details and chat messages you add.
• Sessions and activity: your IP address, browser or device, and a security log of actions such as signing in.
• Agreements: which version of these policies you accepted and when, and your marketing choice.

Why we use it

We use this information to run the service, keep accounts secure, send the emails you need (such as password resets and assignments), and meet our legal duties.

Who we share it with

We do not sell your data. We share it only with the services that help us run NextForge:

• Amazon Web Services stores uploaded files.
• Our email providers deliver account and product emails.
• Google Calendar receives meeting details, only if you connect your calendar.
• Our AI service receives the text of a document when you ask it to generate issues from that document.

People in your organization can also see the work you add there, depending on their role.

Cookies and browser storage

We use one cookie to keep you signed in. Your browser also stores your session details and your light or dark mode choice. We do not use advertising or analytics trackers.

How long we keep it

• The security log is kept for 400 days.
• Expired sessions and one-time links are removed after 30 days.
• Deleting your account takes effect after a 30-day grace period, which you can cancel.

When your account is erased, we remove your name, email address, password, two-step details and sessions. Work you added stays with your organization and shows as “Deleted user”, and your security log entries lose their IP address and device details.

Your rights

Depending on where you live, you can ask to see, correct, export or delete your data, withdraw your marketing consent, or complain to your data protection authority. To make a request, use the contact details above.