Privacy Policy

1. What we collect

Account information — name, email address, and firm name for anyone who creates or is invited to a ForgePay account.

Payment metadata — when a payment is made through the Service, we store the amount, card brand, the card's last four digits, and a receipt number. We never receive or store full card numbers, expiration dates, or security codes — those are entered directly into our payment gateway's hosted fields and go straight to the gateway.

Usage information — basic technical information (such as IP address and browser type) generated by using the application, for security and troubleshooting purposes.

2. How we use it

We use the information above to operate and secure the Service, generate and deliver receipts, respond to support requests, and meet legal and recordkeeping obligations. We do not use payment metadata or account information for advertising.

3. Cookies

The ForgePay application sets a single session cookie needed to keep you signed in. We do not use advertising or tracking cookies in the portal or on client-facing payment pages.

4. Service providers

We share information with a small set of service providers who help us run the Service, under obligations to protect it:

• Our payment gateway (Electronic Merchant Systems / NMI), which processes card payments and holds cardholder data.
• Our hosting and content-delivery provider (Cloudflare).
• Our workflow infrastructure, which delivers transactional emails such as receipts on our behalf.

We do not sell personal information to any third party.

5. Retention

We retain account and payment metadata for as long as your firm's account is active and afterward as needed to meet legal, accounting, and dispute-resolution obligations.

6. Security

Data in transit is encrypted with TLS. Payment gateway credentials are encrypted at rest. Access to firm data within the application is restricted by account role.

7. Your rights

You can request access to, correction of, or deletion of your personal information by contacting [email protected]. Some information may need to be retained where required by law or to preserve accurate financial and trust-accounting records.

8. Children

The Service is directed at law firms and their business users. It is not directed to, and we do not knowingly collect information from, anyone under 18.

9. Changes to this policy

We may update this policy from time to time. If we make material changes, we'll update the effective date above.

10. Contact

Questions about this policy, or requests regarding your information, can be sent to [email protected].