Privacy Policy
The ContentForge Inc.
Last updated: 10/24/2026
This Privacy Policy explains how The ContentForge Inc. ("ContentForge", "we", "us", "our") collects, uses, shares and protects information when you use our website at https://the-contentforge.com, our web application at https://contentforge-agency.com, and the products inside it, including Mount Olympus, Zeus, the client portal, The Pantheon, Business Hub, Chronos Booking, the prospect tool, our API and our MCP server (together, the "Services").
The ContentForge Inc. is a Delaware C corporation, with its address at 1351 Brentwood Ave., Thermal, CA 92274, United States. You can contact us about privacy, or anything else in this policy, at support@the-contentforge.com.
1. Who this policy is about, and our role
ContentForge is used by marketing agencies ("Agencies") to run work for their own customers, usually local businesses ("Clients"). Clients and their staff may sign in to a client portal or Business Hub ("Client Users"). Clients, in turn, have their own customers, leads and website visitors ("End Customers").
- We are the controller for information about Agencies and their team members (account, billing, support and usage information), for visitors to our own website, and for the Google and Facebook account information described in sections 6 and 7 to the extent we decide how it is processed.
- We are a processor (service provider) for our Agencies for the information Agencies and their Clients put into, or collect through, the Services: client business details, website content, form submissions, contacts, conversations, call recordings, bookings and similar data about Client Users and End Customers ("Customer Data"). The Agency (and, where relevant, its Client) decides why that data is collected and is responsible for having a lawful basis and giving any required notices. We process Customer Data only to provide the Services under our agreement with the Agency and our Data Processing Addendum [link to come].
If you are an End Customer of a business that uses ContentForge (for example, you filled in a form on a website hosted on Mount Olympus, or texted a business through The Pantheon), please contact that business with your privacy questions. We will help them respond.
2. Information we collect
2.1 Information you give us
- Account information: name, email address, password (stored only as a salted hash by our authentication provider), agency name, phone, logo and branding, team member invitations and roles.
- Two-step verification: an authenticator-app secret (stored encrypted), one-time recovery codes (stored hashed), and remembered devices (device name, when remembered and last used).
- Billing information: plan, billing address, tax details and payment history. Card details are collected and stored by our payment processor; we never see or store full card numbers.
- Client information Agencies enter: business names, addresses, phone numbers, services, service areas, opening hours, brand colors, logos, photos, videos, reviews, onboarding answers, owner and team photos, price lists, menus and events.
- Content: website pages, blog posts, images, press releases, social posts, templates, notes and anything else you create or upload.
- Support and communications: messages, tickets, emails and demo requests you send us.
2.2 Information from connected services
When you choose to connect a third-party account, we receive information from it as described when you connect it:
- Google (Search Console, Analytics, Google Ads, Business Profile, Site Verification, Sheets, Calendar, and your Google email address). See section 6 for full detail.
- Facebook and Instagram (the Facebook Pages and Instagram business accounts you connect, to publish the posts you schedule). See section 7 for full detail.
- Figma (to import a design you choose).
- HubSpot, Mailchimp and webhooks (to send a website form's submissions where you choose).
- AI assistants you connect over MCP or an API key (such as Claude or ChatGPT): we receive the requests you make through them, and send back the results you ask for.
2.3 Customer Data collected through the Services (we are a processor)
- Website form submissions on Mount Olympus sites: whatever fields the site's form asks for (for example name, email, phone, message, uploaded files), plus the time, page and consent choices.
- The Pantheon / Business Hub: contacts and companies (names, emails, phone numbers, addresses, tags, custom fields, notes, files), opportunities, tasks, the Activity history, email, website chat and text-message conversations, call records, voicemails, call recordings and transcripts (where the business turns recording on), appointments and bookings, and automation history.
- Chronos Booking: booking details (for example pickup and drop-off addresses, dates, passengers, extras) and payment status. Payments are taken by our payment processor directly into the business's own payment account; we do not store card numbers.
- The Assistant: the business's knowledge base (its web pages, files, FAQs and notes) and the conversations it answers.
- Prospect tool leads: the website address a business owner enters and, when the Agency turns on Lead Capture, their name, email, phone and business details.
- Client portal: Client Users' names, emails, permissions, approvals, review replies and uploads.
2.4 Information collected automatically
- App usage and logs: pages and actions in the app, IP address, browser and device type, time stamps, errors, and a security log of sign-ins, two-step verification events and sensitive actions (such as staff access to an account).
- Cookies and similar technologies: see section 13.
- Visitors to sites hosted on Mount Olympus: our hosting infrastructure processes IP addresses and request logs to deliver pages and stop abuse. A site's owner may add analytics, pixels, maps, video or chat; those load only as that site's cookie banner allows and are the site owner's responsibility.
2.5 Public and licensed data
To run SEO and local search features we look up publicly available information about businesses and websites, such as search results, map rankings, business listings, citations, backlinks, page speed and public weather alerts. This is mostly information about businesses, not individuals.
3. How we use information
We use information to:
- Provide the Services: host websites, run reports, show Google data in your dashboard and your Clients' portals, send email and texts, place calls, take bookings, and everything else you ask the Services to do.
- Run Zeus, ContentForge's built-in intelligence, which writes content, designs sites, analyzes search and ads performance and drafts recommendations (see section 5).
- Bill you, manage credits and the usage balance, and prevent fraud (including one free trial per card).
- Keep accounts secure: authenticate you, enforce two-step verification, detect abuse, rate-limit, and investigate security incidents.
- Support you: answer tickets, fix problems you report, and, with your permission, look at your account to help (see section 6.6 for Google data).
- Communicate with you: service emails (sign-in, security, billing, job finished, low credits, monthly overviews and digests you turn on). Marketing emails from us only where allowed, with an unsubscribe link in every one.
- Improve the Services: understand which features are used and where errors happen, using aggregated and de-identified information. We do not use Google user data for this except as allowed in section 6.
- Comply with law and enforce our Terms of Service.
We do not sell personal information, and we do not use Customer Data, Google user data or Facebook and Instagram data for advertising.
4. Legal bases (EEA, UK and Switzerland)
Where the GDPR or UK GDPR applies, we rely on: contract (to provide the Services you signed up for); legitimate interests (security, fraud prevention, improving the Services, B2B communications, balanced against your rights); consent (where required, such as optional cookies or marketing emails, which you can withdraw at any time); and legal obligation (tax, accounting, responding to lawful requests). For Customer Data, the Agency is responsible for the legal basis.
5. Zeus and automated processing
Zeus is the intelligence built into ContentForge. To do the work you ask for, Zeus sends the relevant information (for example a client's services and reviews, the page you are editing, or a summary of a client's Search Console and Google Ads numbers) to third-party large language model and image generation providers listed in section 9, under contracts that:
- allow them to use that information only to return a result to us;
- prohibit them from training their models on it; and
- limit how long they may keep it (normally up to [30] days for abuse monitoring, unless law requires longer).
Zeus does not make decisions that have legal or similarly significant effects on individuals. Zeus's work is presented to you to review: sites open as drafts, Google changes and posts wait for your approval, and Google Ads campaigns are created paused.
Zeus also learns which recommendations work, for example how often a type of Google Ads fix improves results for a type of business. It does this with aggregated, de-identified statistics (counts and median changes per kind of business and kind of fix), never by training a general-purpose model, and the statistics cannot be used to identify an Agency, a Client or a person.
6. Google user data
This section explains exactly how ContentForge accesses, uses, stores and shares data we receive from Google APIs when you connect a Google account. It is also published on its own at https://the-contentforge.com/google-data-use.
6.1 Limited Use
ContentForge's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6.2 How you connect
An Agency's owner or admin connects a Google account from Settings → Google Connection, and then links each Client's own Search Console property, Google Analytics 4 property, Google Ads account and Business Profile location. Google Sheets is connected separately, per website form. Google shows you each permission before you approve it, and you can approve or decline each one. We only request a permission when you use the feature that needs it.
6.3 What we access and why
| Google permission (scope) | What ContentForge accesses | Why |
|---|---|---|
Your email address (userinfo.email) | The email address of the Google account you connect | To show which Google account is connected, and to tell teammates' connections apart |
Search Console, read (webmasters.readonly) | Search terms, impressions, clicks, average position, pages, devices and sitemaps for the Search Console properties you link | To show search performance in your dashboard, your Client's portal, monthly reports and the MCP reporting tools; to let you pick keywords to track; and for Zeus to find search opportunities |
Search Console, manage (webmasters) | Adding a site to Search Console and submitting its sitemap | Only when you click to set up Search Console for a site published on Mount Olympus |
Site verification (siteverification.verify_only) | Getting a verification token and confirming ownership of a site you publish on Mount Olympus | So ContentForge can verify the site in Search Console for you. We cannot list or remove other owners |
Google Analytics, read (analytics.readonly) | Sessions, traffic sources, key events (conversions), cities and devices for the GA4 properties you link | To show traffic and conversions in your dashboard, Client portal and reports, and for Zeus's monthly scan |
Google Analytics, edit (analytics.edit) | Creating a link between a Client's GA4 property and that Client's Google Ads account | Only to make that one link, when you save the mapping or pick the Ads account. We change nothing else in Analytics |
Google Ads (adwords) | Campaigns, ad groups, keywords, search terms, ads, assets, budgets, conversion actions and performance for the Ads accounts you link | To show the Google Ads tab and portal reports; for the Zeus Ads Review; and to make the changes you choose to apply (for example adding negative keywords, pausing a keyword, creating a campaign in a paused state, setting up conversion tracking) |
Business Profile (business.manage) | The Business Profile locations you can manage: profile details, hours, services, categories, attributes, photos, reviews and replies, posts, and calls, direction requests and website clicks | To show the profile and its performance; to let you or your Client reply to reviews; and to publish posts and profile updates only after you approve them |
Google Sheets (spreadsheets) | Only the spreadsheet you create through ContentForge or whose link you paste for a website form | To add one row per form submission to that sheet. We do not browse or read your other files |
Google Calendar (calendar.readonly, calendar.events) | Busy times on the calendars you choose, and events for appointments booked through The Pantheon | To stop double-booking against your existing calendar, and to add, update and cancel the appointments booked through ContentForge on your calendar |
6.4 What we never do with Google user data
- We never sell Google user data.
- We never use or transfer it for serving advertisements, including retargeting, personalized or interest-based advertising.
- We never use or transfer it to determine creditworthiness or for lending purposes.
- We never use it to develop, improve or train generalized or non-personalized AI or machine-learning models. The providers Zeus uses are contractually prohibited from training on it.
- We never transfer it to data brokers or information resellers.
- We never use it for any purpose other than providing or improving the user-facing features described above.
6.5 Who Google data is shared with
We transfer Google user data only:
- To the people you choose, inside the Services: your Agency's team members, and the Client Users of the Client the data belongs to, in the portal sections you switch on. Sections you hide are never sent to the portal.
- To an AI assistant you connect, when you or your Client User ask it for a report through our MCP server or API (for example "How did Search Console look for Smith Roofing over the last 28 days?"). That assistant's provider then handles the result under its own terms.
- To our service providers, only as needed to provide the features above: our database and hosting providers (to store and serve it) and our language model provider (so Zeus can analyze it). They act on our instructions and are bound to the same restrictions. For example, when you ask for a monthly report summary or another written summary, the Client's Google figures (such as Search Console clicks, Analytics sessions or Google Ads results) are sent to that provider only to write the summary you asked for. The provider does not store them for any other purpose (beyond the short abuse-monitoring period described in section 5) and is contractually prohibited from using them to train its models.
- When required by law, to protect against fraud, abuse or security threats, or as part of a merger or acquisition with the same protections, with notice to you.
6.6 Human access
ContentForge staff cannot read your Google user data unless:
- you give us permission for a specific purpose (for example, you ask support to look at a client's Google Ads tab to fix a problem);
- it is needed for security purposes, such as investigating abuse or a security incident;
- it is needed to comply with applicable law; or
- the data is aggregated and de-identified and used for internal operations as allowed by Google's policy.
Staff access to an Agency's account is logged.
6.7 How Google data is protected
- Google access and refresh tokens are encrypted at rest with AES-256-GCM, with the encryption key held separately from the database.
- All traffic to and from Google, our app and our database is encrypted in transit (TLS).
- Access is limited to the Agency the connection belongs to by database-level access rules, and every team member can be required to use two-step verification.
6.8 Retention and deletion of Google data
- Most Google data is read live when you open a report and is not kept. Some is stored so reports can show history and Zeus can compare periods: for example daily Google Ads metrics, Business Profile snapshots (review count and rating over time), Zeus's findings and Ads reviews, and the record of changes you applied.
- When you disconnect Google (Settings → Google Connection → Disconnect), we always ask Google to revoke ContentForge's access and delete your stored Google tokens straight away. You then choose what happens to the Google data we stored for your Agency (Business Profile snapshots, performance and review summaries, Google Ads metrics, Zeus's Ads and Business Profile history and the Google figures Zeus compares):
- Disconnect and delete the stored Google data (the default): it is deleted straight away. The screen lists what will be deleted before you confirm. If any part can't be deleted at that moment, it is retried automatically and finished within 30 days.
- I'm reconnecting — keep the stored data: it is kept for no more than 30 days after you disconnect, so your history is still there when you reconnect. The screen shows the date it will be deleted. If someone in your Agency connects Google again before that date, it is kept and used as before; if not, it is deleted automatically on that date, exactly as with the first choice. Your tokens are never kept, whichever you choose. Your Clients' links (which Search Console site, Analytics property, Ads account and Business Profile each Client uses) are kept so you can reconnect without relinking; remove them with Remove Mapping or Unlink. Removing a Google Sheets connection from a form revokes and deletes that connection straight away too.
- Stored Google-derived data is otherwise kept while your account is active and the property stays linked. It is deleted automatically within 30 days after you delete the Client, close your account, delete your login or ask us to delete it, and removed from backups within 35 days after that.
- You can ask us to delete your Google user data at any time by emailing support@the-contentforge.com from your account's email address. We delete it automatically within 30 days of your request.
6.9 Revoking access
You can stop ContentForge's access at any time by:
- clicking Disconnect on Settings → Google Connection (and, for Sheets, Stop sending to this sheet on the form), or
- removing ContentForge at https://myaccount.google.com/connections.
After you revoke access, ContentForge can no longer read or change anything in your Google account.
7. Facebook and Instagram data
This section explains how ContentForge accesses, uses, stores and shares data we receive from Meta Platforms, Inc. ("Meta") when you connect a Facebook account to publish to Facebook Pages and Instagram business accounts. Step-by-step deletion instructions are also on their own page at https://the-contentforge.com/data-deletion.
7.1 How you connect
An Agency's owner or admin connects a Facebook account with Facebook Login for Business, then chooses which Facebook Pages, and the Instagram business accounts linked to them, ContentForge may use for each Client. Facebook shows you each permission before you approve it, and you choose which Pages and accounts to share.
7.2 What we access and why
| Facebook permission | What ContentForge accesses | Why |
|---|---|---|
Your Facebook profile (public_profile) | Your name and Facebook user id from Facebook Login | To show which Facebook account is connected, and to tell teammates' connections apart |
Pages you manage (pages_show_list, business_management) | The list of Facebook Pages you manage, including Pages in your business portfolio, with each Page's name and id | So you can pick which Page belongs to each Client |
Page details (pages_read_engagement) | The name and picture of the Pages you link, and the status and link (permalink) of the posts ContentForge publishes for you | To show the right Page, and to confirm a post went live and link to it |
Instagram business accounts (instagram_basic) | The name, username, id and profile picture of the Instagram business account linked to each Page you choose, and the status and link of the posts ContentForge publishes for you | So you can pick which Instagram account belongs to each Client, and to confirm a post went live and link to it |
Publishing (pages_manage_posts, instagram_content_publish) | Creating posts (text, photos, videos and links) on the Pages and Instagram accounts you link | Only to publish the posts you or your Client schedule, at the time you choose. We never post anything you didn't schedule |
We do not read your Page or Instagram insights or analytics, your followers, or other people's messages or comments.
7.3 What we never do with Facebook and Instagram data
- We never sell it or transfer it to data brokers or information resellers.
- We never use it for advertising, ad targeting or retargeting.
- We never use it to build profiles of people, or for surveillance, eligibility or lending decisions.
- We never use it to develop, improve or train generalized AI or machine-learning models.
- We never use it for any purpose other than the features described above, and we follow Meta's Platform Terms and Developer Policies.
7.4 Who it is shared with
We share Facebook and Instagram data only:
- With the people you choose, inside the Services: your Agency's team members, and the Client Users of the Client the Page or account belongs to.
- With our service providers, only as needed to provide the features above: our database and hosting providers, to store and serve it. They act on our instructions and are bound to the same restrictions.
- When required by law, to protect against fraud, abuse or security threats, or as part of a merger or acquisition with the same protections, with notice to you.
7.5 Where it is stored and how it is protected
- It is stored in our database in the United States (see section 9 for our providers).
- Facebook and Instagram access tokens are encrypted at rest with AES-256-GCM, with the encryption key held separately from the database.
- All traffic to and from Meta, our app and our database is encrypted in transit (TLS).
- Access is limited to the Agency the connection belongs to by database-level access rules, and staff access to an Agency's account is logged.
7.6 How long we keep it
- The connection (access tokens, and the ids, names and pictures of your Pages and Instagram accounts) is kept only while it is connected.
- The status and link of each published post are kept with the post, so you can see where and when it went live.
- The posts you write and schedule in ContentForge (their text, images and videos) are your Agency's content and stay in your account like any other content (see section 11).
7.7 Disconnecting and deletion
You can stop ContentForge's access at any time by:
- disconnecting Facebook in ContentForge, or
- removing ContentForge in your Facebook settings under Business Integrations.
When you disconnect, either way, or ask us to delete your data, the connection is deleted immediately: your access tokens, and the ids, names and pictures of your Pages and Instagram accounts. The Page and Instagram ids are also cleared from your posts, and ContentForge can no longer read or post anything. The posts' own text, images and videos stay in ContentForge because they are your Agency's content; delete them there, or close your account, to remove them. Posts already published stay on Facebook or Instagram until you remove them there. Copies in our database backups roll off within 35 days.
7.8 Asking us to delete it
You can ask us to delete your Facebook and Instagram data at any time by emailing support@the-contentforge.com with the subject "Data deletion request". We will confirm your request and delete it as described in section 7.7, always within 30 days. See Data Deletion for step-by-step instructions.
8. How we share information
We share information only as described in this policy:
- With your Agency and the people it chooses: team members, Client Users and the integrations you connect.
- With service providers (sub-processors) who help us run the Services (section 9).
- With carriers and registries for The Pantheon texting and calling, such as The Campaign Registry and mobile carriers, for the business registration required to send text messages (business name, EIN, address, contact person, sample messages).
- For legal reasons: to comply with law, a valid legal request, or to protect rights, safety and the integrity of the Services.
- In a business transfer: if ContentForge is involved in a merger, acquisition or sale of assets, under the same protections.
We do not sell or "share" personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA), and we have not done so in the last 12 months.
Mobile information: we do not share mobile phone numbers or text-messaging opt-in data with third parties or affiliates for their marketing or promotional purposes. Text messaging opt-in data and consent are never shared with any third party, except the service providers that deliver the messages.
9. Sub-processors
We use the following service providers. Each is bound by a contract that limits their use of the data to providing their service to us.
| Provider | What they do for us | Data involved | Location |
|---|---|---|---|
| Supabase, Inc. | Database, authentication and file storage | All account data, Customer Data, encrypted tokens | [United States — confirm region] |
| Vercel Inc. | Application hosting, website hosting for Mount Olympus sites, custom domains and certificates | All data passing through the app; site visitor request logs | United States and global edge network |
| Stripe, Inc. | Subscription billing, credit packs and usage balance payments; Stripe Connect payments for businesses using Chronos Booking | Billing details, card data (held by Stripe), payment records | United States |
| Anthropic, PBC | Language model that powers Zeus (writing, site building, analysis, the Assistant) | Content and data needed for the task, including summaries of Google data | United States |
| Google LLC (Gemini API) | Image generation for Zeus images | Image prompts (descriptions of the image needed) | United States |
| Google LLC (Maps Platform, PageSpeed Insights, reCAPTCHA) | Business lookups, page speed checks, spam protection on forms and sign-up | Business names and addresses, website addresses, form visitor signals | United States |
| Resend (Plus Five Five, Inc.) | Sending and receiving email: account emails, form notifications, support email, and The Pantheon email | Email addresses, message content, delivery and open/click events | United States |
| DataForSEO | Search results, map rankings, keyword data, backlinks, business listings and AI Visibility checks | Keywords, domains, business names and locations | [European Union — confirm] |
| Telnyx LLC | Phone numbers, calls, text messages, voicemail, call recording and transcription for The Pantheon (once calling and texting are live) | Phone numbers, message content, call audio, recordings, transcripts | United States |
| The Campaign Registry and mobile carriers | Required 10DLC registration for business texting | Business registration details and sample messages | United States |
| Mux, Inc. | Video hosting and streaming for uploaded videos | Video files and viewing data | United States |
| Mapbox, Inc. / MapTiler AG | Map tiles on websites and map-scan reports | Map requests, visitor IP addresses | United States / Switzerland |
| PR distribution partner ([PRNow — confirm legal name]) | Distributing press releases you choose to send | Press release content and contact details in it | [confirm] |
| Pixabay GmbH | Stock photo search you choose to use | Search terms | Germany |
| U.S. National Weather Service | Public severe-weather alerts | Service area locations (public) | United States |
10. International transfers
We are based in the United States and our main providers store data in the United States. If you are in the EEA, UK or Switzerland, we transfer personal information to the United States using the European Commission's Standard Contractual Clauses (and the UK Addendum), or the EU-U.S. Data Privacy Framework where our provider is certified, together with additional safeguards where needed.
11. How long we keep information
| Information | How long |
|---|---|
| Account and agency information | While your account is open. After you close the account (Settings → Profile → Close agency) or ask us to delete it, there are 7 days to change your mind; then it is deleted automatically, finished within 30 days of the request |
| A team member's or client user's own login | Until they delete it (Settings → Profile, or Account & security in the client portal) or ask us to; deleted automatically within 30 days, after the same 7 days to change their mind. The work they did for the Agency stays with the Agency |
| Customer Data (clients, sites, contacts, conversations, recordings, form responses) | While your account is open, as the Agency directs. Deleted sites stay in Recently deleted for 30 days, then are removed. Deleted automatically within 30 days of account closure or a deletion request; published sites go offline and custom domains are removed |
| Google tokens | Until you disconnect; revoked at Google and deleted immediately on disconnect, account closure or login deletion |
| Stored Google-derived data | See section 6.8 |
| Facebook and Instagram tokens | Until you disconnect; deleted immediately when you disconnect (in ContentForge or in your Facebook settings), close your account or delete your login |
| Stored Facebook and Instagram data | The connection (Page and Instagram ids, names and pictures) is deleted immediately when you disconnect or ask us to delete it; see section 7.7 |
| Site backups and exports | While the site exists; exports expire on their own; removed with the site or the account |
| Billing records and invoices | 7 years, for tax and accounting law. After an account is deleted we keep only the minimum (amounts, dates, invoice and payment ids — no names or email addresses); our payment processor keeps its own invoices |
| Security and access logs (staff access, sign-in and two-step events, app-connection audit, activity logs) | 12 months, then deleted automatically |
| Email logs | Report emails: the recipient's address is removed after 12 months. Digest emails: 12 months. Inbound support email records: 90 days |
| Webhook logs | 30 days after delivery; anything left undelivered, 90 days |
| Internal cost records | The person's id is removed after 13 months (totals are kept) |
| Site visit statistics | Individual visits 35 days (a daily-changing visitor hash, never an IP address); daily totals while the site exists |
| Support tickets | 3 years after the ticket closes, then deleted automatically with their attachments |
| Free-trial card check | A one-way fingerprint of the card (never the card number), 3 years, so each card gets one free trial |
| Record that a deletion was done | Kept as proof: the date, what was deleted and a one-way hash of the email address — never the address itself |
| Database backups | Rolling, up to 35 days |
Canceling a subscription does not delete your account. To delete your agency and its data, use Settings → Profile → Close agency (owners), or email support@the-contentforge.com from the owner's email address. You get a confirmation email with the date you can cancel until, and another when the deletion is complete. We delete it automatically within 30 days of the request (backups roll off within 35 days after that).
12. Security
We protect information with technical and organizational measures, including:
- encryption in transit (TLS) everywhere, and encryption at rest for the database and storage;
- AES-256-GCM encryption for connected-account tokens and integration secrets;
- passwords stored only as salted hashes; two-step verification with an authenticator app for team members and client portal users, which an Agency can require;
- database-level access rules that keep each Agency's data separate;
- emails to you for sensitive account events (new device remembered, two-step verification turned on or off, recovery code used);
- logging of staff access to customer accounts;
- automatic backups and restore.
No system is perfectly secure. If we learn of a breach that affects your personal information, we will notify you and the authorities as the law requires.
To report a vulnerability, email support@the-contentforge.com.
13. Cookies
On the-contentforge.com and contentforge-agency.com we use:
- Strictly necessary cookies: keeping you signed in, security checks during Google sign-in (to stop forged requests), remembering a device for two-step verification for 30 days, and load balancing. These can't be switched off.
- Payment and fraud-prevention cookies: set by our payment processor on checkout pages.
- Spam protection: reCAPTCHA on sign-up and some forms, which collects device and usage information under Google's Privacy Policy and Terms.
- Analytics: [none today / name the analytics tool if added to the marketing site]. If we add analytics or advertising cookies, we will ask for your consent where the law requires it, through our cookie banner.
Websites our customers host on Mount Olympus set their own cookies, controlled by each site's cookie banner and privacy policy.
14. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict processing, to withdraw consent, and to not be discriminated against for using these rights. California residents can also ask what categories of personal information we collected, used and disclosed in the last 12 months.
- Account owners: most information can be seen and changed in the app. For anything else, email support@the-contentforge.com from your account's email address.
- Client Users and End Customers: contact the Agency or business you deal with. If you contact us, we will pass your request to them and help them respond.
- Authorized agents may make requests on your behalf with proof of authority.
- We will verify your identity before acting and respond within the time the law requires (normally 30 days under GDPR, 45 days under CCPA).
- If you are in the EEA or UK, you may complain to your local data protection authority.
Marketing emails: use the unsubscribe link. Texts sent through The Pantheon: reply STOP to the business's number to stop messages from that business.
15. Children
The Services are for businesses and are not directed at children under 16. We do not knowingly collect personal information from children. If you think a child has given us information, contact support@the-contentforge.com and we will delete it.
16. Changes to this policy
We will post any changes on this page and update the date at the top. If a change is material, we will tell account owners by email or in the app before it takes effect. If we ever want to use Google user data or Facebook and Instagram data in a new way, we will ask for your consent first.
17. Contact us
The ContentForge Inc.
1351 Brentwood Ave.
Thermal, CA 92274, United States
Privacy, support, legal and security: support@the-contentforge.com
Help center: https://contentforge-agency.com/help