Data Processing Addendum
The ContentForge Inc.
Last updated: 10/27/2026
This Data Processing Addendum (the "DPA") is part of the Terms of Service between The ContentForge Inc. ("ContentForge", "we", "us") and the business that holds the ContentForge account ("Agency", "you"). It applies whenever we process personal information in Customer Data for you. Words defined in the Terms or the Privacy Policy mean the same here. If this DPA and the Terms conflict about personal information in Customer Data, this DPA wins.
1. Roles
For personal information in Customer Data, you (and, where relevant, your Client) are the controller, or the "business" under the California Consumer Privacy Act, and ContentForge is your processor, or "service provider". Where you act for a Client, you confirm you have that Client's authority to give us instructions about its data. You are responsible for having a lawful basis for the processing and for giving Client Users and End Customers any notices the law requires.
2. Subject matter and duration
We process Customer Data to provide the Services to you under the Terms. We do so for as long as you use the Services, and afterwards only until the data is deleted as described in section 12.
3. Nature and purpose
We host, store, organize, analyze, send and display Customer Data, and run the tasks you ask for, such as hosting websites, sending email and text messages, placing calls, taking bookings and store orders, running reports, and having Zeus write and analyze. We do this only to provide, secure and support the Services.
4. Types of personal information
The personal information depends on how you and your Clients use the Services. It can include:
- contact details: names, email addresses, phone numbers and addresses;
- website form submissions, including uploaded files, the time, page and consent choices;
- contacts and companies in The Pantheon and Business Hub, with their tags, custom fields, notes, files, opportunities, tasks and Activity history;
- email, website chat and text-message conversations, call records, voicemails, and call recordings and transcripts where the business turns recording on;
- bookings and appointments, and online store orders, payment status, refunds, shipments and tracking (card details are entered only in the payment provider's own fields; we never see or store full card numbers);
- the Assistant's knowledge base and the conversations it answers;
- prospect tool leads, and Client Users' names, emails, permissions, approvals and uploads in the client portal;
- IP addresses and request logs of visitors to sites hosted on Mount Olympus;
- any other personal information you or your Clients put into the Services.
Section 2.3 of the Privacy Policy describes this in more detail.
5. People the data is about
End Customers (your Clients' customers, leads, shoppers, members and website visitors), Client Users, and anyone else whose information you or your Clients put into, or collect through, the Services.
6. Our obligations
- We process Customer Data only on your documented instructions. The Terms, this DPA, and how you use and set up the Services are your instructions. If we believe an instruction breaks data protection law, we will tell you.
- If the law requires us to process Customer Data in another way, we will tell you first, unless the law forbids it.
- We do not sell or "share" Customer Data, and we do not use it for advertising. We do not keep, use or disclose it for any purpose other than providing the Services to you, or combine it with personal information we get from elsewhere, except as the law allows.
- We may use aggregated, de-identified data as described in section 8 of the Terms.
7. Confidentiality
Everyone at ContentForge who can access Customer Data is bound by a duty of confidentiality and accesses it only as needed to provide, secure and support the Services. Staff access to customer accounts is logged.
8. Security
We protect Customer Data with the technical and organizational measures described in section 12 of the Privacy Policy, including:
- encryption in transit (TLS) everywhere, and encryption at rest for the database and storage;
- AES-256-GCM encryption for connected-account tokens and integration secrets;
- passwords stored only as salted hashes; two-step verification with an authenticator app for team members and client portal users, which an Agency can require;
- database-level access rules that keep each Agency's data separate;
- emails for sensitive account events (new device remembered, two-step verification turned on or off, recovery code used);
- logging of staff access to customer accounts;
- automatic backups and restore.
We may change these measures as the Services change, without lowering the overall level of protection.
9. Sub-processors
You give us general permission to use sub-processors. Our current sub-processors are listed in section 9 of the Privacy Policy. Each is bound by a contract that limits its use of the data to providing its service to us, and we remain responsible for their work under this DPA.
Before we add or replace a sub-processor, we will update that list and tell account owners by email or in the app. If you object on reasonable data protection grounds, email support@the-contentforge.com. We will work with you in good faith to find a solution; if we can't, you may stop using the affected part of the Services or close your account.
Services you connect yourself (such as Google, Facebook, Figma, HubSpot or Mailchimp) and the payment and shipping providers a business connects to its online store act for you or that business, not for us, so they are not our sub-processors.
10. Helping with privacy requests
We will help you respond to people who use their privacy rights (such as access, correction, deletion or export), mostly through the tools in the app. If someone contacts us directly about Customer Data, we will pass the request to you and help you respond. We will also give reasonable help with data protection impact assessments and consultations with data protection authorities, using the information we have.
11. Security breaches
If we become aware of a breach of security that leads to the accidental or unlawful loss, destruction or change of Customer Data, or to unauthorized access to or disclosure of it, we will tell you without undue delay by email to the account Owner. We will give you the information we have that you reasonably need to meet your own obligations (such as what happened, the data and people affected, and what we are doing about it) and keep you updated as we learn more.
12. Deletion or return at the end
For 30 days after your account ends you can ask us to let you export your data, as described in section 16 of the Terms. After that, we delete Customer Data as described in section 11 of the Privacy Policy, except where the law requires us to keep it. Database backups roll off within 35 days after that.
13. Information and audits
On reasonable written request to support@the-contentforge.com, we will give you the information reasonably needed to show that we meet this DPA, such as written answers to security questionnaires and descriptions of our measures. Where the law gives you a right to an audit that this information doesn't satisfy, we will cooperate with a reasonable audit, on reasonable notice and under a duty of confidentiality.
14. International transfers
We are based in the United States, and Customer Data is stored in the United States. Some sub-processors work in other countries, as listed in section 9 of the Privacy Policy.
Where the GDPR, UK GDPR or Swiss data protection law requires it for a transfer of Customer Data out of the EEA, the UK or Switzerland, the European Commission's Standard Contractual Clauses (Module 2, controller to processor, or Module 3, processor to processor, as applies) are incorporated into this DPA by reference, with the UK Addendum for UK transfers and the changes Swiss law requires for Swiss transfers. Where the Clauses offer choices, the options are the ones that match this DPA (for example, general permission for sub-processors). If this DPA and the Clauses conflict, the Clauses win. Where a provider is certified under the EU-U.S. Data Privacy Framework, we may rely on that instead.
15. Liability
Each party's liability under this DPA is subject to the limits in section 18 (Limitation of liability) of the Terms, except where the law or the Standard Contractual Clauses don't allow those limits.
16. Changes
We may update this DPA as laws and the Services change. We will post changes on this page and update the date at the top, and tell account owners about material changes in advance, as described in section 20 of the Terms.
17. Contact
The ContentForge Inc.
1351 Brentwood Ave.
Thermal, CA 92274, United States
Support, legal, privacy, security and DMCA: support@the-contentforge.com
Help center: https://contentforge-agency.com/help