Privacy Policy - Automated Forge

1. Introduction

AutomatedForge Sp. z o.o. ("we", "us", "our", or "AutomatedForge") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our services, in compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Polish Personal Data Protection Act of 10 May 2018, and other applicable data protection laws.

This policy covers the following services:

AutomatedForge — business automation, AI integration, and consulting services (automatedforge.com)
GroundWorks Manager — SaaS application for landscape and construction project management
LinguaAI — SaaS application for AI-powered language learning

2. Data Controller Information

Company Name: AutomatedForge Sp. z o.o.

Registered Address: ul. Szlak 77/222, 31-153 Kraków, Poland

KRS: 0001242839

NIP: 6762721310

REGON: 544915184

Contact Email: info@automatedforge.com

Phone: +48 730 769 959

Website: automatedforge.com

For any questions or concerns regarding your personal data, please contact us at info@automatedforge.com.

Data Protection Officer (DPO): AutomatedForge Sp. z o.o. has not appointed a Data Protection Officer as we are not required to do so under Article 37 GDPR. All inquiries regarding data processing should be directed to info@automatedforge.com.

3. Personal Data We Collect — Common Across All Services

The following categories of personal data are collected across all our services:

3.1 Contact and Identity Information

Full name
Email address
Phone number (optional)
Job title and company name (for B2B clients)
Business address

3.2 Account and Authentication Data

Username and password (hashed using industry-standard algorithms — we never store plaintext passwords)
Account preferences and settings
OAuth tokens (when you sign in via third-party providers such as Google)

3.3 Billing Information

Company name and registration details (for B2B)
Tax identification number (NIP / VAT ID / EIN)
Billing address
Payment information — processed exclusively by Lemon Squeezy Inc. (our Merchant of Record). We do not store or have access to your full payment card details.
Invoice history

3.4 Technical and Usage Data

IP address (anonymized where possible)
Browser type and version
Device information (operating system, screen resolution)
Pages visited and time spent on our website
Cookies and similar tracking technologies (see Section 10)
Server logs and error reports

3.5 Communication Data

Correspondence via email, support chat, or other communication channels
Support tickets and customer service interactions
Feedback and survey responses

4. Service-Specific Data Collection

4.1 AutomatedForge — Automation Agency Services

When you engage us for business automation services, we may additionally process:

Login credentials and API keys for systems you authorize us to integrate with (e.g., CRM, email platforms, payment gateways) — stored encrypted, accessible only to authorized personnel, used solely as you instruct
Business process data — workflows, customer records, lead information, and other operational data you provide for automation
Custom integration data — as required by your specific automation needs

We act as a Data Processor for personal data you upload or grant us access to during service delivery. A separate Data Processing Agreement (DPA) governs this relationship and is available upon request.

4.2 GroundWorks Manager

When you use GroundWorks Manager, we additionally process:

Project data — site plans, measurements, geodesy points, dimensions, project specifications
Drawings and exports — PDF/image exports you generate within the application
Project metadata — project names, dates, status, notes

This data is stored in your dedicated workspace within our database. You retain ownership of all content you create.

4.3 LinguaAI

When you use LinguaAI, we additionally process:

Learning data — your progress, exercises completed, scores, language proficiency level
Audio recordings — your voice recordings for pronunciation assessment (processed temporarily for evaluation, then deleted unless you opt-in to storage for progress tracking)
Conversation history with AI — text-based conversations with the AI tutor, stored for continuity and learning analytics
Custom learning preferences — selected topics, difficulty level, target language goals

Important: AI Processing Notice. LinguaAI uses Anthropic's Claude AI for conversation and grammar feedback. Your conversation content is transmitted to Anthropic for AI processing. Anthropic operates under a Data Processing Agreement with us and does not use your data to train their models (per Anthropic's commercial API policy). See Section 7 for full details on this processor.

5. Legal Basis for Processing

We process your personal data based on the following legal grounds under Article 6 GDPR:

5.1 Contractual Necessity (Article 6(1)(b))

Processing is necessary for the performance of our contract with you, including:

Providing our services (agency, SaaS applications)
Creating and maintaining your account
Processing payments and invoicing
Providing customer support

5.2 Legal Obligation (Article 6(1)(c))

Processing is required to comply with legal obligations:

Tax and accounting requirements (invoices retained 5 years under Polish tax law)
Anti-money laundering regulations
Response to lawful requests from public authorities

5.3 Legitimate Interests (Article 6(1)(f))

Processing is necessary for our legitimate business interests, balanced against your fundamental rights:

Improving and developing our services
Analyzing aggregated usage patterns
Preventing fraud and ensuring security
Direct marketing to existing clients for similar services (soft opt-in, easy to withdraw)
Responding to inquiries submitted via contact forms

Where required by law, we obtain your explicit consent for:

Marketing communications and newsletters
Non-essential cookies and tracking technologies
Storage of voice recordings beyond temporary processing (LinguaAI)

You have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

6. How We Use Your Data

We use your personal data for the following purposes:

6.1 Service Delivery

Providing automation services, SaaS applications, AI features
Maintaining your account and subscriptions
Technical support and troubleshooting
Service updates and important notifications

6.2 Business Operations

Processing payments via Lemon Squeezy (our Merchant of Record)
Generating invoices for tax compliance
Account management

6.3 Analytics and Improvement

Analyzing aggregated usage patterns to improve services
Conducting research and development
Testing new features
Performance monitoring

6.4 Marketing and Communication

Sending service updates and important notices (essential, not requiring consent)
Providing marketing communications (only with your consent or under soft opt-in for existing clients)
Surveys and feedback collection (optional)

6.5 Legal and Security

Complying with legal obligations
Preventing fraud and unauthorized access
Enforcing our Terms of Service
Protecting our rights and interests

We work with the following carefully selected service providers (sub-processors). All of them are bound by Data Processing Agreements (DPAs) and implement appropriate security measures.

7.1 Infrastructure & Hosting

Processor	Purpose	Location	Safeguards
Netlify, Inc.	Web hosting, CDN	USA (with EU regions)	DPA, EU Standard Contractual Clauses (SCCs)
Supabase Inc.	Database, authentication, file storage	EU (Frankfurt) by default	DPA, EU SCCs where applicable

7.2 Payment Processing

Processor	Purpose	Location	Safeguards
Lemon Squeezy Inc. (our Merchant of Record)	Payment processing, tax compliance, invoicing	USA	DPA, EU SCCs. Acts as Merchant of Record — sells to end customer as reseller.

When you purchase a subscription, Lemon Squeezy is the legal seller and processes your payment data directly. We receive only the data necessary to provision your service (email, subscription tier, customer ID). We do not have access to your full payment card details.

7.3 AI Processing (LinguaAI only)

Processor	Purpose	Location	Safeguards
Anthropic, PBC	AI conversation, grammar feedback (Claude API)	USA	DPA, EU SCCs. Commercial API: data not used for model training.

7.4 Analytics

Processor	Purpose	Location	Safeguards
Plausible Analytics	Privacy-friendly web analytics (no cookies, no personal data)	EU (Germany)	EU-based, GDPR-compliant by design

We deliberately chose Plausible over Google Analytics to avoid transferring user data to the USA and to minimize personal data collection. Plausible does not use cookies and does not collect any personal data.

7.5 Email Communication

Processor	Purpose	Location	Safeguards
Resend, Inc.	Sending transactional emails (account notifications, password resets, receipts)	USA (with SCCs)	DPA
Google Workspace (Google Ireland Ltd.)	Company email and documents — client correspondence	EU/EEA	Google DPA, GDPR-compliant

7.6 Accounting

Processor	Purpose	Location	Safeguards
Polski Instytut Księgowości Centrala Sp. z o.o.	Accounting services, tax and accounting compliance	Poland	EU-based entity, GDPR-compliant

We share only invoicing data (name, address, tax ID). Legal basis: legal obligation (GDPR Article 6(1)(c)).

7.7 Legal Disclosures

We may disclose your data when required by law or to:

Comply with legal processes or government requests
Enforce our Terms of Service
Protect the rights, property, or safety of AutomatedForge, our users, or others
Prevent fraud or security issues

7.8 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity. We will notify you of any such change and ensure the new entity is bound by privacy commitments at least as protective as this policy.

7.9 Embedded Third-Party Content

Processor	Purpose	Location	Safeguards
Trustpilot A/S	Displaying verified customer reviews via an embedded widget	Denmark (EU/EEA)	EU-based entity, GDPR-compliant. Loaded only after you consent to third-party embedded content.

The Trustpilot widget is loaded from Trustpilot's servers only once you enable "Third-party content" in Cookie Settings. Until then no request reaches Trustpilot and no data about your visit is shared with them. See section 4.5 of our Cookie Policy for details.

A full and up-to-date list of sub-processors is maintained at: /subprocessors

8. International Data Transfers

Some of our processors operate outside the European Economic Area (EEA), primarily in the USA. When we transfer your data internationally, we ensure appropriate safeguards under GDPR Chapter V:

Standard Contractual Clauses (SCCs) approved by the European Commission (2021/914)
Adequacy decisions by the European Commission where applicable
Supplementary measures including encryption, access controls, and contractual commitments

You can request a copy of the SCCs with any specific processor by contacting info@automatedforge.com.

9. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this policy or as required by law.

9.1 Retention Periods

Data Category	Retention Period
Active account data	Duration of account + 6 months after closure
Invoices and financial records	5 years (Polish tax law requirement)
Contract-related data	Duration of contract + 3 years (statute of limitations under Polish Civil Code)
Marketing communications	Until consent withdrawal, or 3 years from last interaction, whichever comes first
Technical logs	12 months maximum
Support communications	3 years after case closure
LinguaAI conversation history	Duration of subscription + 30 days after cancellation (unless earlier deletion requested)
LinguaAI voice recordings	Processed temporarily for assessment, deleted within 24 hours unless explicit consent to retain
GroundWorks Manager project data	Duration of subscription + 30 days after cancellation (data export available throughout)

9.2 Deletion

After the retention period expires, we securely delete or anonymize your personal data unless we are legally required to retain it longer (e.g., invoices). You can request earlier deletion of your data at any time (see Section 11).

10. Cookies and Tracking Technologies

10.1 Our Approach

We minimize the use of cookies and tracking technologies. We use Plausible Analytics, which does not use cookies and does not collect personal data.

10.2 Cookies We Use

Essential cookies: Required for basic functionality (authentication session, security tokens, language preferences). These do not require consent.
Functional cookies: Remember your preferences (theme, dashboard layout). Used only after your consent.

10.3 No Third-Party Marketing Cookies

We do not use Google Analytics, Facebook Pixel, or similar third-party tracking technologies. We do not sell, share, or use your data for advertising purposes.

10.4 Managing Cookies

You can control cookies through your browser settings. Disabling essential cookies will affect application functionality (you will not be able to log in).

You have the following rights regarding your personal data:

11.1 Right of Access (Article 15)

Request a copy of the personal data we hold about you.

11.2 Right to Rectification (Article 16)

Request correction of inaccurate or incomplete data.

11.3 Right to Erasure / "Right to be Forgotten" (Article 17)

Request deletion of your data in certain circumstances. Note: we may be required to retain certain data for legal obligations (e.g., invoices).

11.4 Right to Restriction of Processing (Article 18)

Request that we limit how we use your data in certain situations.

11.5 Right to Data Portability (Article 20)

Request your data in a structured, commonly used, machine-readable format (JSON or CSV).

11.6 Right to Object (Article 21)

Object to processing based on legitimate interests or for direct marketing purposes.

Where processing is based on consent, you can withdraw it at any time.

11.8 Right to Lodge a Complaint (Article 77)

File a complaint with your local data protection authority. In Poland:

Urząd Ochrony Danych Osobowych (UODO) ul. Stawki 2, 00-193 Warszawa Phone: +48 22 531 03 00 Website: uodo.gov.pl

11.9 Exercising Your Rights

To exercise any of these rights, please contact us at info@automatedforge.com. We will respond within 30 days (or 90 days for complex requests, with notification). We may need to verify your identity before processing your request.

12. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

12.1 Technical Measures

Encryption of data in transit (TLS 1.2+) and at rest (AES-256 where applicable)
Password hashing using industry-standard algorithms (bcrypt/argon2)
Authentication via Supabase Auth with optional 2FA
Regular security updates and patch management
Firewall protection and intrusion detection
Secure backup and disaster recovery procedures (Supabase point-in-time recovery)

12.2 Organizational Measures

Access controls based on principle of least privilege
Confidentiality obligations for any contractors
Privacy by design and by default in product development
Regular review of security practices

12.3 Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the Polish supervisory authority (UODO) within 72 hours of becoming aware of the breach, as required by Article 33 GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay (Article 34 GDPR).

13. Content Safety and Moderation (LinguaAI)

This section applies specifically to the LinguaAI service, which uses artificial intelligence for language learning and allows users to create custom conversation scenarios.

13.1 AI Safety Measures

We implement a multi-layered safety system to protect users:

Anthropic's built-in safeguards (Claude model) — automatic refusal of requests violating AI safety policy
Custom content moderation layer — filtering user inputs for crisis-related keywords (suicide, self-harm, violence) across multiple languages
Scenario validation — automated analysis of user-created scenarios before activation
Crisis detection — system recognizes signs of emotional distress in conversation
Reporting mechanisms — in-app "Report" function and info@automatedforge.com

13.2 Purpose of Safety Processing

We use limited data for safety purposes:

Conversation content — analyzed in real-time for threats
Scenario content — validated before first activation
Safety metadata — category of detected issue, threat level, action taken (without personal content)

Legal basis: Legitimate interest (GDPR Article 6(1)(f)) — protecting users and third parties from harm, including protection of life and health (GDPR Article 6(1)(d) for life-threatening situations).

13.3 Safety Data Retention

Safety event logs: 30 days, then aggregated statistics only without identification
Conversation content in detected violations: retained up to 90 days for evidence and potential reporting
User reports: 3 years after case closure

13.4 Crisis Resources

LinguaAI is not a substitute for professional psychological help. In emotional crisis, the AI automatically directs users to:

🆘 Emergency: 112 (European Union)

24/7 Crisis Helplines:

🇵🇱 Poland — adults: 116 123
🇵🇱 Poland — children/youth: 116 111
🇬🇧 UK: 116 123 (Samaritans)
🇺🇸 USA: 988 (Suicide & Crisis Lifeline)
🌍 International directory: https://findahelpline.com

Other important contacts:

📞 Niebieska Linia (domestic violence, Poland): 800 120 002
🆘 Dyżurnet.pl — reporting illegal content (especially involving children): https://dyzurnet.pl

13.5 Cooperation with Authorities

In cases of serious threats, we cooperate with relevant authorities:

Life threat to user or third parties: police, emergency services
CSAM content: Dyżurnet.pl (Poland), NCMEC (USA) — absolute reporting obligation
Terrorist/extremist content: relevant services
Criminal activities: law enforcement

13.6 Reporting Violations

If you notice concerning AI behavior or violations by another user:

In-app: "Report" function
Email: info@automatedforge.com (subject: "Safety report")
Response time: 48 hours for non-urgent; immediate for urgent

Full acceptable use policy: automatedforge.com/aup (Acceptable Use Policy).

14. Children's Privacy and Age Requirements

14.1 Minimum Age Requirements

Service	Minimum age	Basis
AutomatedForge (agency)	18 years (B2B clients)	No contracts with minors
GroundWorks Manager	18 years	Professional application
LinguaAI	16 years	GDPR Article 8 (Polish age threshold)

14.2 LinguaAI — Specific Provisions for 16+

LinguaAI admits users from age 16 in accordance with GDPR Article 8 and Polish implementation (Article 21 of Polish Data Protection Act of 10 May 2018, which sets the threshold at 16 years for independent consent in information society services).

For users aged 16-17:

May independently register and use the service (GDPR and Polish law)
We recommend informing a parent/guardian about using AI-powered application
A parent/guardian may at any time object by contacting info@automatedforge.com

Why 16+ and not lower:

LinguaAI involves AI-generated content that may occasionally be unexpected, user-created scenarios on diverse topics, and open-ended conversations requiring user judgment. These elements make the service unsuitable for younger children.

14.3 No Knowing Collection from Children under 16

We do not knowingly collect personal data from children under 16. At registration, we require age verification.

If we discover an account created by someone under 16:

We immediately close the account
Delete collected data (except minimal incident documentation, 30 days retention)
Notify the user via email
If parent/guardian contacts us — we follow guardian rights under GDPR

14.4 Special Protections for 16-17 Year Old Users

For users in this age range, we apply additional protections:

No personalized marketing — we do not target ads or marketing to minors
No data sharing with third parties for marketing purposes
Enhanced moderation — heightened sensitivity of safety filters
Privacy by default — most protective settings are default
Easier account deletion access

14.5 Reporting Age Violations

If you believe a child under 16 has provided us with personal data, contact us immediately: info@automatedforge.com (subject: "Age violation — urgent").

14.6 Reports Regarding Child Exploitation

For suspected CSAM or other child exploitation related to our services:

Poland: Dyżurnet.pl (https://dyzurnet.pl)
USA: NCMEC CyberTipline (https://report.cybertip.org)
Directly to us: info@automatedforge.com with "URGENT — child safety"

We apply a zero tolerance policy for child safety violations and cooperate fully with law enforcement.

15. Automated Decision-Making and Profiling

We may use automated processing to provide our services (e.g., LinguaAI's AI-driven feedback, automated workflow execution in AutomatedForge agency work).

We do not make solely automated decisions that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR, unless:

It is necessary for entering into or performing a contract with you
It is authorized by law
You have given explicit consent

You have the right to request human intervention, express your point of view, and contest any automated decision.

16. Updates to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or business operations.

Material changes: We will notify you at least 30 days before the changes take effect by:

Posting the updated policy on our website with a new "Last Updated" date
Sending an email notification to your registered email address
Displaying a notice within our services

Non-material changes (e.g., clarifications, typo fixes): We will update the "Last Updated" date without separate notification.

We encourage you to review this policy periodically.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy:

Email: info@automatedforge.com Phone: +48 730 769 959 Address: AutomatedForge Sp. z o.o., ul. Szlak 77/222, 31-153 Kraków, Poland Website: automatedforge.com

We will respond within 30 days.

This appendix provides an overview of our data processing activities:

A.1 Customer Account Management

Purpose: Managing user accounts across all services
Legal basis: Contract performance (Art. 6(1)(b))
Data categories: Contact info, account credentials
Retention: Duration of account + 6 months

A.2 Service Delivery — Agency Work (AutomatedForge)

Purpose: Providing automation services to clients
Legal basis: Contract performance (Art. 6(1)(b))
Data categories: Business data, integration credentials, workflow data
Retention: Duration of contract + 3 years

A.3 Service Delivery — SaaS Applications

Purpose: Operating GroundWorks Manager and LinguaAI
Legal basis: Contract performance (Art. 6(1)(b))
Data categories: Account data, application data, usage data
Retention: Duration of subscription + 30 days

A.4 AI Processing (LinguaAI)

Purpose: Providing AI-driven language learning features
Legal basis: Contract performance (Art. 6(1)(b))
Data categories: Conversation content, audio (temporary), learning progress
Sub-processor: Anthropic, PBC
Retention: As specified in Section 9

A.5 Billing and Invoicing

Purpose: Financial transactions and tax compliance
Legal basis: Legal obligation (Art. 6(1)(c))
Data categories: Billing info, payment metadata
Processor: Lemon Squeezy Inc.
Retention: 5 years (Polish tax law)

A.6 Marketing Communications

Purpose: Newsletters and service updates
Legal basis: Consent (Art. 6(1)(a)) or Legitimate Interest for existing clients (Art. 6(1)(f))
Data categories: Contact info, preferences
Retention: Until consent withdrawal or 3 years from last interaction

A.7 Website Analytics

Purpose: Understanding aggregated website usage
Legal basis: Legitimate interest (Art. 6(1)(f))
Data categories: Aggregated technical data (no personal data, no cookies)
Processor: Plausible Analytics
Retention: Aggregated indefinitely; no individual records kept

A.8 Customer Support

Purpose: Responding to inquiries and providing support
Legal basis: Contract performance / Legitimate interest
Data categories: Communication data, account context
Retention: 3 years after case closure

This Privacy Policy is compliant with GDPR (EU) 2016/679, Polish Personal Data Protection Act of 10 May 2018, and applicable international data protection standards.

End of Privacy Policy