Skip to main content

Privacy Policy

Last updated: May 14, 2026

ForgeLabs Consulting ("ForgeLabs," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and safeguard your information when you visit our website at forgelabsconsulting.com (the "Site") or engage our consulting services. It also describes the rights you have over your personal information and how to exercise them. This Policy is incorporated by reference into our Terms of Service.

The Site is operated from the United States. If you access the Site from outside the United States, please review the "International Data Transfers" section below.

1. Information We Collect

Information You Provide

When you use our contact form, take our service recommendation quiz, or book a call through our scheduling tool, you may provide us with:

  • Name
  • Email address
  • Company name (optional)
  • Message content
  • Quiz responses (stored locally in your browser, transmitted to us only if you submit the contact form or follow the booking link)
  • Calendar booking details when scheduling a call

Information Collected Automatically

When you visit our Site, certain information is collected automatically through Google Analytics and our hosting infrastructure, including:

  • IP address (anonymized by Google Analytics)
  • Approximate geographic location (city or region level, derived from IP)
  • Browser type, version, and language
  • Operating system and device type
  • Pages visited, time spent, and referral source
  • Screen resolution

2. Categories of Personal Information (CCPA Disclosure)

For California residents, the California Consumer Privacy Act (CCPA, as amended by the CPRA) requires us to disclose the categories of personal information we have collected in the preceding 12 months. We collect or have collected the following categories:

  • Identifiers (Cal. Civ. Code § 1798.140(v)(1)(A)): name, email address, IP address
  • Customer records information (§ 1798.140(v)(1)(B)): name, email, company name
  • Internet or other electronic network activity (§ 1798.140(v)(1)(F)): browsing history on the Site, interaction with our content
  • Geolocation data (§ 1798.140(v)(1)(G)): approximate location derived from IP, city or region level only
  • Professional or employment-related information (§ 1798.140(v)(1)(I)): company name if you provide it, role context if you include it in a message
  • Inferences (§ 1798.140(v)(1)(K)): quiz-based service recommendations

We do not knowingly collect sensitive personal information (as defined under the CPRA), biometric information, or precise geolocation.

3. How We Use Your Information

We use the information we collect to:

  • Respond to your inquiries and contact form submissions
  • Provide personalized service recommendations through the quiz
  • Schedule and conduct discovery calls
  • Deliver our consulting services under a Statement of Work
  • Operate, maintain, and secure the Site
  • Understand how the Site is used and improve its content and design
  • Detect, prevent, and respond to abuse, fraud, and security incidents
  • Comply with legal obligations, court orders, and government requests

We do not sell, rent, or share your personal information with third parties for cross-context behavioral advertising or their independent marketing purposes.

4. Legal Bases for Processing (GDPR)

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with similar requirements, we rely on the following legal bases under Article 6 of the EU and UK GDPR to process your personal information:

  • Performance of a contract or pre-contract steps (Art. 6(1)(b)): responding to your inquiries, conducting discovery calls, and providing consulting services
  • Legitimate interests (Art. 6(1)(f)): operating and securing the Site, understanding usage, preventing abuse, and limited transactional communications with prospects and clients
  • Consent (Art. 6(1)(a)): where we ask for it explicitly, for example through cookies that are not strictly necessary, or marketing communications you opt into
  • Legal obligation (Art. 6(1)(c)): retaining records as required by tax, accounting, or other applicable law

Where we rely on legitimate interests, you may object as described in the "Your Rights" section.

5. How We Share and Disclose Information

We share personal information only with the following categories of recipients:

  • Service providers and processors that operate the Site and our business under contract, such as those listed in the "Third-Party Services" section. They are restricted to processing personal information only for the purposes we direct.
  • Legal and regulatory disclosures, including in response to valid subpoenas, court orders, government requests, or to comply with applicable law.
  • Protection of rights and safety, where disclosure is reasonably necessary to investigate or prevent fraud, abuse, security incidents, or harm to you, us, or others.
  • Business transfers, in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our assets. We will require successors to honor the commitments in this Policy.
  • With your consent or at your direction, for example when you ask us to introduce you to a third party.

6. Third-Party Services

We use the following third-party services to operate the Site and deliver our business. Each acts as a data processor or independent controller and is bound by its own privacy commitments:

  • Google Analytics for website usage analytics (IP anonymization is enabled)
  • Resend for transactional email delivery of contact form submissions
  • Cal.com for appointment scheduling
  • DigitalOcean for website hosting
  • Cloudflare for DNS, network security, and content delivery

Each of these providers maintains its own privacy policy. We encourage you to review their practices independently.

7. Cookies, Tracking, and Do Not Track

The Site uses cookies and similar technologies that fall into two categories:

  • Strictly necessary: cookies and storage used to operate the Site, such as your browser's localStorage to save quiz progress so you do not lose your answers when navigating away. These also include the small record that remembers your cookie consent choice.
  • Analytics: Google Analytics cookies that help us understand how visitors interact with the Site. These are not used for advertising or retargeting. Loaded only after you opt in.

Consent banner. On your first visit, a banner anchored to the bottom of the Site asks whether you accept analytics cookies. Until you make a choice, Google Analytics runs in Google Consent Mode v2 with all storage denied: it does not write cookies and does not track individual sessions, though aggregated and cookieless measurement pings may still be sent. If you accept, analytics cookies are loaded and the site can measure individual visits. If you reject, no analytics cookies are written and your choice is remembered locally.

Changing your choice later. You can change your cookie preferences at any time by clicking the "Cookie preferences" link in the footer of any page. You can also disable cookies through your browser settings, or use the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout.

Do Not Track. Our Site does not currently respond to Do Not Track browser signals because no consistent industry standard exists for interpreting them. The consent banner and the controls described above are the practical equivalent.

Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we silently honor it: the consent banner does not appear, analytics stays denied, and your choice is recorded as a rejection. You can still open the "Cookie preferences" link in the footer to override this if you wish.

Fonts. Our typography (Literata and Archivo) is self-hosted at build time through Next.js's built-in font pipeline. No runtime requests are made to Google Fonts or any other third-party font provider when you load a page.

8. Data Retention

We retain personal information only for as long as needed to provide the Site and our services, satisfy legitimate business purposes, and comply with legal obligations. Indicative retention periods:

  • Contact form submissions: up to 24 months from last contact, or longer where required by law or where an ongoing engagement justifies it
  • Client communications and project records: for the duration of the engagement plus up to 7 years to meet tax, accounting, and statute-of-limitations obligations
  • Quiz responses: stored in your browser's localStorage until you clear it or submit the contact form, then handled as a contact form submission
  • Google Analytics data: retained per Google's default retention settings (currently 14 months for event-level data)
  • Server access and security logs: typically 30 to 90 days for routine logs, longer where needed to investigate an incident

You may request deletion of your personal information at any time, subject to limited exceptions described in the "Your Rights" section.

9. International Data Transfers

We are based in the United States and process personal information there. If you access the Site from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your jurisdiction.

For transfers of personal information from the European Economic Area, the United Kingdom, or Switzerland to the United States, we rely on appropriate safeguards including the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum where applicable, or, where neither applies, your explicit informed consent to the transfer.

10. Automated Decision-Making and AI

The service recommendation quiz uses a rules-based scoring algorithm to suggest services that may be a good fit. The output is a recommendation, not a binding decision. We do not use solely automated decision-making that produces legal effects or similarly significant effects on you within the meaning of Article 22 of the GDPR.

We may use AI tools to assist with drafting blog content, internal research, or operational tasks. We do not feed your contact form submissions or quiz responses into public or third-party AI training datasets. AI vendors we use as service providers process information only under our instructions and contractual restrictions on training and retention.

11. Marketing Communications

We do not maintain a marketing mailing list and we do not send unsolicited marketing emails. If you ask to receive specific communications from us, you can unsubscribe at any time by replying to the email or contacting us at hello@forgelabsconsulting.com. We comply with the CAN-SPAM Act and equivalent laws in jurisdictions where they apply.

12. Data Security and Breach Notification

We implement reasonable administrative, technical, and physical safeguards designed to protect your information, including HTTPS for data in transit, access controls on our hosting infrastructure, secured deploy keys, and ongoing security review of our third-party processors. No method of transmission over the internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security.

If we become aware of a breach of your personal information that meets the notification threshold under applicable law, we will notify affected individuals and regulators as required and within the timeframes those laws set.

13. Your Rights

Depending on where you live, you may have one or more of the rights below. To exercise any right, contact us at hello@forgelabsconsulting.com. We will verify your request before acting, and we will respond within the timeframes required by applicable law. We will not discriminate against you for exercising a right.

All Users

  • Request access to the personal information we hold about you
  • Request correction of inaccurate or incomplete information
  • Request deletion of your personal information, subject to limited legal and operational exceptions
  • Receive a copy of your information in a portable format
  • Withdraw any consent you previously gave, without affecting prior lawful processing

EU, UK, and Swiss Residents (GDPR / UK GDPR)

In addition to the rights above, you may:

  • Object to processing that we base on legitimate interests
  • Request restriction of processing in certain circumstances
  • Lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office at ico.org.uk)

California Residents (CCPA / CPRA)

In addition to the rights above, you may:

  • Request that we disclose the categories of personal information we collect, sources, business purposes, and the categories of third parties with whom we share information (see Section 2 and Section 5)
  • Opt out of any sale or sharing of personal information (we do not currently sell or share personal information as those terms are defined under the CCPA)
  • Limit the use of sensitive personal information (we do not knowingly collect sensitive personal information)
  • Designate an authorized agent to make a request on your behalf, in which case we may require proof of authorization and verification of your identity

California's "Shine the Light" law (Cal. Civ. Code § 1798.83) permits California residents to request information about disclosures of personal information to third parties for those parties' direct marketing purposes. We do not make such disclosures.

Other U.S. State Residents

If you reside in a U.S. state with a comprehensive privacy law (including Colorado, Virginia, Connecticut, Utah, Texas, Oregon, Montana, and others as they take effect), you have rights substantially similar to the rights described above. Contact us using the email below to exercise them.

14. Children's Privacy

The Site and our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date, and we will use reasonable efforts to provide notice through the Site or, where appropriate, by email. Your continued use of the Site after any changes constitutes your acceptance of the updated Policy.

16. Contact Us

If you have questions about this Privacy Policy or wish to exercise any privacy right, contact us at:

ForgeLabs Consulting
Email: hello@forgelabsconsulting.com

We are based in the United States. We do not currently have an EU or UK representative because our processing of EU and UK personal data is occasional, does not involve large-scale processing of special-category data, and is not likely to result in a high risk to data subjects under Article 27 of the GDPR. If that changes, we will update this Policy to designate a representative and provide contact details.