Privacy policy

Our commitment VeraForge Technologies Corp. ("VeraForge", "we", "us", "our") handles personal information responsibly and in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and Quebec's Law 25 where it applies. This Privacy Policy explains what we collect, why we collect it, how we use it, who we share it with, how long we keep it, and the choices you have. Who to contact Questions, access, correction, and deletion requests: privacy@veraforge.ca. Mail: VeraForge Technologies Corp., 10 Four Seasons Place, Suite 1000, Etobicoke, Ontario, M9B 6H7, Canada. What we collect and why Account and identity: your name, email, and password hash when you create an account, so we can identify you and protect your account. Content you provide: information you enter into a Forge Brief, into The Blueprint intake, into The Anvil interview and editor, into contact forms, and into chat or booking flows. This can include your business details, project requirements, and any files you upload. We use this to deliver the Service you asked for. Site content and versions: the content of the Sites you build, edit, and publish through the Platform, together with version snapshots so you can review and roll back. We serve this to your visitors when your Site is published. Brand facts and Foundations: the strategic brief we assemble from what you tell us, used to power AI features across the Platform for your account. Form submissions on your Site: when a visitor fills out a contact form on your published Site, we receive the submission on your behalf so we can pass it to you. Usage and telemetry: request timestamps, feature actions, AI usage counts, tokens in and out for AI calls, and error events. Error events are recorded as codes and stack information for debugging. We do not store the content of chat or generation messages inside our error telemetry. Rate-limit and abuse signals: for the free public site checks (Business Grade, Surface Check, and AODA / WCAG), we record a salted one-way hash of your IP address alongside the scan so we can enforce rate limits and detect abuse. Cookies and similar technologies: see the "Cookies and analytics" section below and the cookie policy at veraforge.ca/cookies. Cookies and analytics We ask for your consent to set analytics and marketing cookies. If you decline, or if your browser sends a Do Not Track signal, we treat that as a decline and do not set them. Today we use Google Ads (via gtag) and the Reddit advertising pixel to measure which sources and campaigns bring people to us. We use these signals in aggregate to improve the site. You can change your mind on the cookie policy page at veraforge.ca/cookies. AI processing When you use an AI feature on the Platform (for example the Anvil chat editor, the Foundation assembler, generation and audit features), we send the necessary content to a third-party AI provider through the Lovable AI Gateway. Today the Platform is configured to use Google's Gemini models (Gemini 2.5 Flash and, for deep audits and Foundation assembly, Gemini 2.5 Pro). Providers and model versions can change; we will update this Policy when they do. We do not make any representation about whether these providers use your inputs to train their models beyond what their own terms and policies say at the time of processing, and we recommend you review those. AI output is generated by a probabilistic system and can be inaccurate; treat it as a starting point that you check before you publish or rely on it. Who processes your information (our service providers) We use the following service providers ("processors") to run the Platform. Each processes personal information only on our instructions and for the purposes described here. • Lovable Cloud, backed by Supabase: application hosting, database, authentication, file storage, and edge functions. Data is stored in Supabase-managed infrastructure. • Lovable AI Gateway (Google Gemini models today): AI processing for the features described in "AI processing" above. • Cloudflare: edge network for the forgedbyanvil.ca Network on which free published Sites are served. • Resend, via the Lovable connector gateway: transactional email delivery (for example a copy of your Business Grade readout when you request one, and internal brief notifications). • Calendly: booking of introductory calls, remote consultations, and in-person consultations. If you book, Calendly receives the information you provide during booking. • Google Ads (gtag) and the Reddit advertising pixel: analytics and marketing measurement, only if you consent. • Amazon Web Services (AWS Rekognition): automated content moderation of images you upload to the Platform, so we can detect and reject prohibited categories such as explicit sexual imagery, graphic violence, and hate symbols before they are stored against your account. Visitor data on Sites you publish If you publish a Site on the Platform and it collects personal information from your visitors (for example through its contact form), you are the organization responsible for that information under Canadian privacy law and VeraForge processes it on your behalf. We store submissions so we can pass them to you and delete them automatically after 180 days; export anything you need to keep before then. Visitors who want their information corrected or removed should contact the Site owner first. We will assist appropriately. Automated site checks When you run one of our free site checks (Business Grade, Surface Check, or AODA / WCAG), we make an outbound HTTP request from our servers to the URL you provide and we store a record of the scan. For each of these three checks, that record includes the submitted URL, a timestamp, and a salted one-way hash of your IP address so we can enforce rate limits and detect abuse. We also write internal telemetry rows describing scan outcomes for product analytics and abuse detection. We do not collect your email unless you ask us to send you a copy of the readout, in which case we store the email you provide alongside the scan record. Retention Account records: kept for the life of your account. When you delete your account, we delete the associated personal information within a reasonable period, subject to routine backup cycles that are then overwritten on schedule. Site content and version snapshots: kept while your account is active. We keep the most recent 50 version snapshots per Site so you can review and roll back. Form submissions on your Site: retained for 180 days from the date of submission, after which a scheduled job deletes them automatically. Export what you need to keep before then. AODA scan records and findings: retained for 90 days, after which a scheduled job deletes them automatically. Other check telemetry is retained for product analytics and safety. If you would like a scan record tied to your IP or email removed sooner, contact privacy@veraforge.ca. AI usage counters and internal telemetry: retained as needed for billing accuracy, abuse detection, capacity planning, and product analytics. Safeguards We use encryption in transit, database row-level security policies to isolate accounts, access controls on administrative surfaces, salted one-way hashing for the abuse-detection identifiers described above, and least-privilege service credentials. No system is perfectly secure; if we become aware of a breach that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires. International transfers Some of our processors listed above may store or process personal information outside your province or outside Canada, including in the United States. Personal information processed in another country is subject to the laws of that country, including lawful access by that country's authorities. Your rights under PIPEDA You have the right to ask us for access to the personal information we hold about you, to correct it if it is inaccurate, and to withdraw a consent you previously gave (which may limit what we can do for you going forward). You can also complain to the Office of the Privacy Commissioner of Canada if you believe your privacy has been mishandled. To exercise a right, email privacy@veraforge.ca. We may need to verify your identity before we act on a request. Children The Platform is not directed to individuals under the age of majority in their province or territory. We do not knowingly collect personal information from such individuals. If you believe a child has provided information to us, email privacy@veraforge.ca and we will delete it. Changes to this Policy We may update this Policy. When we do, we will post the new version on the Platform and update the effective date. If a change is material we will take reasonable steps to bring it to your attention.