1. Who We Are

AI Job Boost Limited trading as Forge Content ("Forge Content", "Forge", "we", "us") operates the FORGE content production and marketing platform. This Privacy Policy describes how we collect, use, share, and protect personal information when you use our Service. It is written to meet our obligations under the EU and UK General Data Protection Regulation (GDPR), the UK Privacy and Electronic Communications Regulations (PECR), and applicable data-protection law.

For the purposes of GDPR, AI Job Boost Limited is the data controller for the personal data of our account holders. For the personal data of your own customers, leads, and contacts that you process through the Service, you are the controller and we are your processor (see clause 12).

Legal entity: AI Job Boost Limited trading as Forge Content. Registered address: 9B Kinsey Terrace, Sumner, Christchurch, Canterbury 8081, New Zealand. Company registration number: 9338424 (NZBN 9429052801976), a registered New Zealand limited company. Data protection / privacy contact: [email protected].

2. Information We Collect

2.1 Account Information

When you create an account we collect: your name, email address, business name, hashed access code or password, plan and billing information (billing is processed securely through Stripe). We do not store full credit card numbers. We use this to create and operate your account and to provide the Service you have requested.

2.2 Brand Profile Data

To produce content we ask you to provide: your brand voice, target audience profile, content pillars, business story, offers, and examples of content you like. This information is stored in our system and used to generate content for your account.

2.3 Buyer Persona Information

Our Brand Profile includes fields for describing your audience's psychology including their desires, beliefs, fears, and goals. This information relates to your customers, not to you personally. It is used solely to improve the quality of content we produce for your brand.

2.4 Uploaded Media

Media you upload (images, video, audio, logos and brand assets) is stored and processed so we can produce and publish content for you. AI image and video models may process these files to generate derivative content at your request.

2.5 Usage and Analytics Data

We collect standard usage logs including: login timestamps, page views within the Client Portal, post approval actions, and regeneration requests. On our public website, with your consent, we collect aggregate, anonymous analytics (see clause 9). This data is used to operate, secure, and improve the Service and is never sold.

2.6 Connected Account Tokens

To act on your behalf, we store access tokens for the accounts you choose to connect: social media platforms (to publish content), Google and Microsoft (to send email from your inbox and to read availability and create calendar events), Zoom (to create meetings), Stripe (to take payments through your account) and ManyChat (to send WhatsApp or chat messages). Tokens are encrypted at rest, used only to deliver the features you enable, and can be revoked by you at any time from the Connections screen or from the provider.

2.7 Leads and Contacts You Import

When you use the funnel features, we store the leads and contacts you capture through your forms, landing pages and imports (such as name, email, phone and message), and a record of the outbound communications sent to them. You are the controller of this data and we process it on your behalf to operate your pipeline and follow-up (see clause 12).

2.8 Engagement Tracking on Outbound Email

Outbound emails you send to your leads through Forge include a small tracking image (a 1x1 pixel) and, where links are used, redirect tracking. When the recipient's email client loads that image or the recipient clicks a tracked link, we record that the message was opened or clicked, the time, and a count, on that lead's record in your pipeline. This is how your open and click statistics are produced. Tracking is not applied to a lead who has opted out. Recipients can prevent open tracking by disabling remote images in their email client, and every message carries an opt-out link.

2.9 Engagement Can Trigger an Automated AI Phone Call

Where you have switched on automated follow-up and enabled the relevant trigger, an email open or a form submission can cause the platform to place an automated AI phone call to that lead a short time later (by default about two minutes after an open), because they are engaged at that moment. This is a real processing purpose and we describe it plainly here. It is gated: the call is only placed if the lead gave contact consent through your form or landing page, has not opted out, has a phone number, came from an opt-in source rather than cold prospecting, and only within their own local calling hours. Cold and hand-added contacts are never auto-dialled by this trigger. You control the trigger and its delay in your automation settings, and you can switch it off.

2.10 AI Call Outcomes, Summaries and Lead Scores

Automated AI phone calls are handled by our voice provider (ElevenLabs) over telephony (Twilio). After a call, a summary of the conversation, the outcome, the needs the person described and a lead score are written to that person's contact card in your pipeline and are visible to you and your team. The call itself is processed by the voice provider under its own terms. The AI agent discloses on the call that it is an automated, AI-driven assistant.

3. Why We Process Your Data and Our Lawful Bases

Under GDPR we rely on the following lawful bases:

• Performance of a contract: to create and operate your account, produce and publish content, run your funnel and pipeline, process payments, and provide support. This covers account, brand profile, uploaded media, connected-account, and lead data that is necessary to deliver the Service.
• Legitimate interests: to secure the platform, prevent fraud and abuse, keep service logs, and improve our product using aggregated and anonymised data, where this is not overridden by your rights and interests.
• Consent: for optional website analytics cookies (clause 9) and for any optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Legal obligation: to keep records we are required to retain (for example, tax and billing records) and to respond to lawful requests.

We do not use your brand data or content for any purpose other than delivering the Service to you, and we improve our AI quality only using anonymised, aggregated data.

4. How We Use Your Information

• To produce, quality-review, and deliver content as described in our Terms of Service
• To send you service emails including batch notifications, approval requests, and weekly digests
• To send you occasional product tips, updates, tips and offers about Forge Content itself, but only if you opted in to marketing emails (for example the opt-in checkbox at signup). These are separate from service emails. Every marketing email carries a one-click unsubscribe link, and you can withdraw consent at any time by using it or by emailing [email protected]; we honour opt-outs promptly. Declining marketing emails never affects your account or the service emails you need.
• To send, on your behalf and at your direction, outbound communications to the leads and contacts you capture (email, automated AI phone calls, and WhatsApp or chat messages), and to book appointments on your connected calendar
• To measure engagement with the outbound emails you send (opens and clicks) so your pipeline shows who is interested, and, where you have enabled it, to trigger a follow-up action such as an automated AI phone call to an engaged, consented lead (see clauses 2.8 and 2.9)
• To record AI call outcomes, summaries and lead scores on the relevant contact card so you can act on the conversation (see clause 2.10)
• To process payments and manage your subscription
• To respond to support requests
• To secure the Service and to improve our AI quality using anonymised, aggregated data only

5. Sub-processors and Data Sharing

We share personal data only as needed to provide the Service. The providers below act as our processors or sub-processors under their own data-processing agreements (DPAs) and may only use the data to perform their function. We do not sell your data and we do not share it with any third party for advertising or marketing purposes.

Each provider only receives the data needed to perform its function. Their own privacy policies and terms apply to their handling of that data.

6. International Transfers

Some of our providers are located outside the European Economic Area (EEA) and the United Kingdom, including in the United States. Where personal data is transferred outside the EEA or UK, we rely on the safeguards offered by those providers, which typically include the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), and, where applicable, the provider's certification under the EU-US Data Privacy Framework. We take reasonable steps to ensure your data continues to be protected to the standard required by applicable law.

7. Data Retention

We retain your account data for as long as your account is active and for a period of 12 months after you cancel or delete your account, after which it is deleted or anonymised, except where we are required to keep certain records longer (for example, billing and tax records). Published post content and brand profile data are retained for up to 24 months to allow for audit and dispute resolution. Leads and contacts you import are retained while your account is active and deleted or returned on termination in line with clause 12.

Leads, prospects and call summaries. Our published default retention periods for the contact data held in your pipeline are: cold prospects that were never engaged, 180 days from discovery; leads with no activity of any kind, 730 days; leads closed Lost, 365 days; AI call summaries and transcript text on a contact card, 365 days. Contacts marked Won are retained while your account is active because they represent a customer relationship. These periods are configurable per account, and your administrator can review exactly what a given policy would affect before anything is applied. We do not currently run an automatic purge against these periods: they are applied on request and on account closure. If that changes we will notify you in advance under clause 15. Regardless of these periods, an opt-out or erasure request is honoured as described below and in clause 8.

Opt-out and erasure of a contact. When one of your leads or prospects unsubscribes, asks to be removed, or tells our AI caller they are not interested, we mark them opted out immediately and permanently delete their contact details within 24 hours. So that the deletion cannot accidentally undo the opt-out, we keep a one-way cryptographic hash of their email address, phone number and website domain on a suppression list. That hash cannot be reversed into a person's details and is never used to contact anyone. It exists solely so that our prospecting tools recognise and skip that person if they are ever discovered again.

You can delete your account at any time from the in-app "Delete account" option, or by emailing [email protected]. On a full account erasure we remove your account record, your posts, your leads and contacts, your forms and landing pages, your feedback and alert records, your connected-platform records, and your stored files (media library, email campaigns and reward records). Your connected-account access tokens are held encrypted on your account record and are removed with it; you can also revoke them at any time from the provider. Two things are not removed by that operation and we say so plainly: billing and payment records held by Stripe, which we are required to retain for tax and accounting purposes, and any copies already held by the sub-processors listed in clause 5, which must be requested from those providers directly. You may also request deletion of specific data under clause 8.

8. Your Rights

Subject to applicable law, you have the right to:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate or incomplete data
• Erasure: request deletion of your data (subject to our legal obligations to retain certain records)
• Restriction: request that we limit how we process your data in certain circumstances
• Portability: request an export of your brand profile and post history in a machine-readable format
• Objection: object to processing based on our legitimate interests, and to direct marketing at any time
• Withdraw consent: withdraw any consent you have given (for example, analytics cookies) at any time, without affecting prior processing

To exercise any of these rights, email [email protected]. We will respond within one month, as required by GDPR, and will let you know if we need an extension for complex requests. You also have the right to lodge a complaint with a data-protection supervisory authority. In the UK this is the Information Commissioner's Office (ICO, ico.org.uk); in the EEA it is your local supervisory authority.

9. Cookies and Cookie Policy

We use two categories of cookies and similar technologies:

• Essential cookies and session storage: the FORGE Client Portal uses browser session storage and strictly necessary cookies to keep you signed in and to operate the Service. These are required for the site to function and are set on the basis of our legitimate interest in providing a secure, working service.
• Optional analytics cookies: with your consent, our public website uses Google Analytics 4, which sets first-party analytics cookies and identifiers to measure aggregate, anonymous usage such as page views and sessions (with IP anonymisation enabled). We do not use advertising or cross-site tracking pixels, and we do not sell any data.

When you first visit our public site you are shown a cookie banner. Analytics cookies are not set until you click Accept. If you click Decline, Google Analytics is never initialised. Your choice is remembered in your browser. You can change your choice at any time by clearing the "forge_cookie_consent" value in your browser storage, or by using the "Cookie settings" link in our footer where available, which re-shows the banner. You can also opt out using Google's browser opt-out add-on or your browser's cookie controls.

10. AI and Automated Content

AI can make mistakes. Content, images, video, voice, on-page chat replies and phone calls produced through the Service may be generated by artificial intelligence and can contain inaccuracies, outdated information, or errors. You are responsible for reviewing every post, message, and call script before it is published or sent, and for the accuracy of any claims, offers, prices, or statements. AI output carries no guarantee of accuracy, non-infringement, or fitness for a particular purpose, and human review is advised.

AI transparency to the people you reach. Where the Service interacts with your customers and leads on your behalf, it identifies itself as AI: the on-page AI chat assistant and the automated AI phone agent disclose that the person is interacting with an automated, AI-driven system. This is intended to support transparency obligations such as those under the EU AI Act. You remain responsible for how you deploy these features and for any additional disclosures your own use case or jurisdiction requires.

Which AI providers process which data. The AI providers we use, and the data they receive, are listed in the sub-processor table in clause 5 (Anthropic, OpenAI, Google, FAL and ElevenLabs). We send these providers only the prompts, brand inputs, reference media, and call or message content needed to perform the requested generation.

Training. To the best of our knowledge, content sent to Anthropic, OpenAI and Google through their paid API tiers is not used by default to train their general models. Other AI providers are used under their standard API terms. We do not control these providers' practices, which may change, and we encourage you not to submit sensitive personal data into content prompts.

11. Data Security

We implement reasonable, industry-standard security measures including: encryption in transit (TLS), encryption at rest for sensitive secrets and connected-account tokens, signed session credentials, access controls that limit staff access to client data on a need-to-know basis, bot and abuse protection at signup, and periodic security reviews. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. When You Are the Controller (Your Customers and Leads)

For the personal data of your own customers, leads, and contacts that you collect, import, or generate through the Service, you are the data controller and Forge acts as your processor, processing that data on your documented instructions to provide the funnel, pipeline, and outbound features you enable. In that capacity we commit to:

• process this data only on your instructions and to provide the Service, unless required otherwise by law;
• keep it confidential and ensure persons authorised to process it are bound by confidentiality;
• apply appropriate technical and organisational security measures (see clause 11);
• use sub-processors only as listed in clause 5 and ensure they are bound by equivalent obligations;
• assist you, so far as reasonably possible, in responding to data-subject requests and in meeting your security, breach-notification, and impact-assessment obligations; and
• delete or return this data on termination, subject to the retention periods in clause 7 and any legal retention requirement.

You are responsible for having a lawful basis and any required consent to collect and contact these individuals, as set out in the Terms of Service.

12a. Prospecting and Outbound Outreach

The Prospecting and Boost features help you discover businesses that may be a fit for your services, find the verified business email or LinkedIn profile of a decision-maker at a company you target, and reach out by email, LinkedIn, or AI-assisted phone call. Because you decide who to contact, you are the sender and the data controller for this outreach, and you are responsible for using it lawfully. By enabling Prospecting you confirm and agree that:

• Lawful basis and purpose. You will only contact businesses you have a genuine, legitimate reason to approach, for relevant business-to-business purposes, and you will comply with all applicable marketing, anti-spam and privacy laws in your jurisdiction and the recipient's (for example GDPR/UK GDPR, PECR, CAN-SPAM, CASL, and the New Zealand Unsolicited Electronic Messages Act).
• Identification and opt-out. Every outbound email identifies you as the sender and provides a clear, working way to opt out. Opt-out and unsubscribe requests are recorded on a suppression list and honoured automatically on future runs.
• AI-assisted calls. AI phone calls are off by default. If you enable them, the call discloses that it is AI-assisted, and you confirm that automated or AI-assisted calling to the businesses you target is permitted in both your and the recipient's location. Some jurisdictions restrict or prohibit automated calls; you are responsible for checking before enabling them.
• Data sources. Business details are gathered from publicly available sources and third-party data providers. Forge does not guarantee the accuracy or completeness of discovered details, and you are responsible for verifying them before relying on them.
• EU and UK prospects. Cold, unsolicited outreach into the European Economic Area and the United Kingdom is subject to stricter rules than in many other markets. As a safety default, our automated cold outreach skips prospects we detect as being in the EEA or the UK unless you deliberately switch that control off for your account. Detection is a best-effort check on the country, address, website domain and phone country code we hold, it is not a legal determination, and it does not apply to people who opted in through your own form or landing page, or to messages you send by hand. Switching the control off is your decision and your responsibility.
• Volume and conduct. You will use sensible sending volumes and will not use Prospecting to send unlawful, deceptive, harassing or bulk unsolicited messages. Forge may suspend the feature for misuse.
• Contact discovery and enrichment. Where you use Email or LinkedIn outreach, Forge queries a third-party B2B data provider (Prospeo) to return a verified business contact for the company you specify. These are business (work) contacts provided for legitimate B2B outreach. You remain responsible for having a lawful basis to contact each person and for honouring opt-outs. LinkedIn connection notes are drafted for you to review and send by hand from your own LinkedIn account, in line with LinkedIn's terms; Forge does not automate LinkedIn actions.
• Forge's role. Forge provides the tooling and acts as your processor for this activity. Forge is not responsible for your decisions about who to contact or what you send, and provides no legal advice; if in doubt, seek your own advice before running outbound campaigns.

13. Breach Notification

If we become aware of a personal data breach that is likely to result in a risk to the rights and freedoms of affected individuals, we will notify the relevant supervisory authority without undue delay and, where required, within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to you or to data subjects, we will also notify the affected individuals without undue delay. Where we act as your processor (clause 12), we will notify you without undue delay after becoming aware of a breach affecting your data so that you can meet your own notification obligations.

14. Children

The Service is intended for businesses and is not directed at children. It is not for use by anyone under 18 years of age, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

15. Changes to This Policy

We will notify you by email of material changes to this Privacy Policy at least 14 days before they take effect. The current version is always available at forgecontent.io/terms.

16. Contact

AI Job Boost Limited trading as Forge Content
Privacy enquiries: [email protected]
General support: [email protected]
Registered address: available on request