Privacy Policy

01Who we are

SuperForge is a customer relationship management (CRM) platform built and operated by VERSEATILE (“we”, “us”), New Delhi, India. This policy covers superforge.co and the SuperForge app.

We process personal data in line with India’s Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules. Where other laws apply to you (for example the GDPR if you are in the EU/UK), we honour the rights they give you.

02What we collect

You give us

• Account details: name, email address, profile photo and sign-in method (email, Google or Microsoft).
• Workspace details: workspace name, members and their roles.
• Content you add: contacts, companies, deals, tickets, notes, tasks and imported files (see Your CRM data).
• Sales enquiries: your work email when you use “Get started” or “Talk to sales” on our website.
• Connected social accounts: if you connect Facebook or Instagram, we store your Page and account names, profile pictures and an encrypted access token so we can publish the posts you schedule and show your Instagram insights (reach, follower cities, post performance). If you connect a Meta ad account, we also store its ID and an encrypted token so we can show your campaign results and, only when you click, create or pause campaigns, change budgets you approve, and create audiences. Contact lists you upload as audiences are normalised and SHA-256 hashed in SuperForge before they are sent to Meta. We don’t read your messages. Disconnect any time in Marketing Forge → Social posts, or remove SuperForge in your Facebook settings. See data deletion.
• Connected Google accounts: if you connect Google Analytics or Google Ads, we store your Google account email, the property and ad account you choose, and an encrypted refresh token. We use them only to show your Analytics reports and Ads campaigns inside SuperForge and, when you ask, to create or pause a campaign in your Ads account. See Google user data.
• Billing details: plan, seat count, currency and billing contact. Card, UPI and bank details are entered directly with Razorpay; we never see or store full payment details.
• Messages you send to our support team.

Collected automatically

• Usage and device data: IP address, browser, device type, pages visited, timestamps and error logs.
• Security signals: bot-protection checks (Google reCAPTCHA Enterprise via Firebase App Check) that help us tell people from automated abuse.
• AI usage counts: how many Forge AI credits and model tokens each workspace or user uses each month, so we can apply plan limits.
• Cookies and local storage: see our Cookie Policy.

03How we use it

• To create and secure your account, sign you in and keep your workspace separate from everyone else’s.
• To provide the service: store your records, run pipelines and tickets, and generate Forge AI briefs and drafts when you ask for them.
• To bill you, manage subscriptions and meet tax and accounting obligations.
• To prevent fraud, spam and abuse, and to enforce plan limits and our Terms.
• To respond to your enquiries and send service messages (security alerts, billing receipts, important changes).
• To understand and improve SuperForge using aggregated, non-identifying information.

We rely on your consent, on performing our contract with you, on complying with the law, and on legitimate uses permitted by law (such as security). We do not sell your personal data, and we don’t show third-party ads.

04Your CRM data

The contacts, companies, deals, tickets and notes your team stores in SuperForge belong to your organisation. For that data your organisation is the data fiduciary (controller) and we act as its data processor: we process it only to provide the service and as your workspace instructs.

You are responsible for having a lawful basis to store the people you add to your CRM. Every record is scoped to its workspace by database-level access rules, and only members of that workspace can see it.

05Forge AI

When you press a Forge AI button (for example “Brief me” or “Draft follow-up”), we send that record and its recent timeline to Anthropic, which runs the Claude model that writes the response. Only data you can already see is sent, and only when you ask.

Under Anthropic’s commercial terms, content sent through its API is not used to train its models. We store the number of AI credits and tokens used, not the AI conversation itself. AI output can be wrong, so please review it before you rely on it or send it.

05aGoogle user data

SuperForge’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• What we access: read-only Google Analytics reports (analytics.readonly) and your Google Ads accounts and campaigns (adwords), plus your Google account email to label the connection.
• How we use it: only to show those reports and campaigns to members of your workspace, and to create, pause or resume Ads campaigns when a member asks. New campaigns are created paused.
• What we don’t do: we don’t sell Google user data, use it for advertising, share it with third parties (except our hosting providers listed below, to run the service), send it to AI models, or let people read it except with your consent, for security, or to comply with law.
• Storage and deletion: tokens are encrypted at rest; reports are fetched live and not stored. Disconnecting in Marketing Forge deletes the stored tokens immediately, and you can also revoke access at myaccount.google.com/permissions.

06Service providers

We share data only with providers that help us run SuperForge, under contracts that limit how they use it:

We may also disclose data if the law requires it, to protect people’s safety or our rights, or as part of a merger or acquisition (in which case this policy continues to apply).

07Where data is stored

Our providers may process data in India, the United States, the European Union and other countries. When data leaves India we rely on the safeguards our providers offer and transfer it only where Indian law permits.

08Retention

• Account and workspace data: kept while your account is active. When you delete your workspace or ask us to close your account, we delete it within 30 days. Copies in backups age out within a further 30 days.
• Billing records: kept for as long as tax and accounting law requires, typically 8 years.
• Security logs: kept for up to 180 days unless we need them to investigate an incident.
• Sales enquiries: kept for up to 24 months unless you ask us to delete them sooner.

09Security

Data is encrypted in transit (HTTPS) and at rest. Database row-level security keeps each workspace separate, admin access is limited and logged, payment details stay with Razorpay, and our forms are protected against bots. No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.

10Your rights

Subject to applicable law, you can:

• access a summary of the personal data we hold about you;
• correct or update inaccurate data (most of it directly in your profile);
• ask us to erase your data, or withdraw consent you have given;
• nominate another person to exercise your rights if you die or become incapacitated;
• raise a grievance with us, and then with the Data Protection Board of India (or your local regulator).

Email astra@verseatile.live to make a request. We may need to verify who you are. If your data sits in another organisation’s workspace, we’ll pass your request to that organisation, because they control that data.

11Children

SuperForge is a business tool and isn’t meant for anyone under 18. We don’t knowingly collect children’s data. If you think a child has given us data, contact us and we will delete it.

12Changes

We may update this policy. When we change it, we’ll update the date at the top. If a change is significant, we’ll notify you by email or in the app before it takes effect.

13Contact & grievances

We acknowledge grievances within 48 hours and aim to resolve them within 30 days.