Forge Privacy Notice

# Forge Privacy Notice

## About this notice

Anvil Systems LLC, a Wyoming limited liability company, operates Forge. This notice explains how we handle personal information in connection with Forge, sales and onboarding, support, billing and administration. Contact our administrators at support@anviltradingsystems.com or write to Anvil Systems LLC, 30 N Gould St, Ste R, Sheridan, WY 82801. Administrators are responsible for privacy requests and retention reviews.

This notice describes privacy practices; it is not blanket consent to optional processing. The Forge User Agreement and your Order Terms separately govern the service and your purchase.

## Information we handle

We receive information you give us, information created through your use of Forge, and relevant information from service providers and people who refer you to us:

- Identity and contact information, including your name, email, account identifier and optional display alias.
- Trading journals and calculations, account identifiers and settings, balances, fees, trade results, payouts, live-account records, saved inputs and revisions, and onboarding progress. These may reveal financial circumstances. Forge records are supplied or generated for journaling and calculations; they are not proof that a broker executed an order.
- Purchase and subscription information, billing status, payment-provider identifiers, plan and enrollment price, invoices and refund records. Payment details entered into Stripe's checkout are handled by Stripe; Forge's application does not store full payment-card numbers or security codes.
- Signed agreements and purchase terms, signature name and email, acknowledgments, time, IP address and browser information, and relevant consent, cancellation and dispute evidence.
- Sales inquiries, application answers, referrals and attribution, appointments, messages, support requests and the documents you choose to submit. Do not send trading passwords, authentication codes, or unrelated financial records.
- Technical and security information such as IP addresses, request and error information, session identifiers, device/browser details and administrator activity. Forge uses session cookies and browser storage to support authentication and preferences. Third-party booking, payment and video pages may use their own technologies under their notices.

If you choose to participate in a leaderboard, your selected alias and the results displayed by that feature are visible to its audience. Avoid including your legal name or account numbers in an alias. Do not put private financial information in public support channels.

## Why we use information

We use information to provide access, save journals, calculate and display results, administer subscriptions and signed terms, communicate about onboarding and support, investigate problems, secure the service, prevent misuse, maintain accurate business records, review refund claims and enforce valid restrictions. We also use relevant contact and interaction records to respond to inquiries and manage sales and permitted marketing. You may ask to stop marketing; necessary service, payment, security and legal messages are separate.

Where a law requires a legal basis, we rely as appropriate on performing or taking requested steps toward a contract; compliance with applicable legal obligations; legitimate interests in operating, supporting and securing our business and resolving claims, balanced against individuals' rights; or consent where required. We do not make unnecessary optional processing a condition of consent to the entire service. When processing relies on consent, you can withdraw it without affecting earlier lawful processing.

## Service providers, AI-assisted support and disclosures

Authorized staff and service providers may process information needed for their work. Relevant categories include hosting and databases, identity/authentication, payment processing, customer-relationship and booking tools, email and communications, support, security, and AI-assisted diagnostic tools. Our current core infrastructure includes Render, Supabase, Stripe and GoHighLevel; communications may involve Google email services and Discord. Providers and tools may change, subject to applicable law and this notice.

We may use AI products to help investigate customer-reported problems, interpret relevant records, prepare support responses and diagnose software behavior. We do not limit this work to a named AI vendor. Depending on the task, the information provided may include relevant customer identifiers, support communications, screenshots, journal or calculation records and technical diagnostics. We minimize the information disclosed and use redacted or deidentified material where practicable. Our policy requires checking the provider's terms, account settings, training controls, security and retention before identifiable information is submitted. Identifiable customer records must not be submitted for provider model training under our authorized diagnostic workflow. Removing a conversation from a user interface does not necessarily remove a provider's security logs or backups. You may contact the administrators about the providers used for your records and available privacy rights.

AI assistance does not authorize a tool to trade, access your brokerage credentials, or independently decide a refund or privacy request. Administrators remain responsible for reviewing those decisions.

We may disclose relevant records to professional advisers, authorities or other parties where necessary for legal obligations, valid claims, security investigations, or a business transaction with appropriate safeguards. Providers such as payment processors may also act under their own legal responsibilities. This notice does not control their independent services or records. We do not authorize staff to sell customer trading records or supply them to data brokers. Any new use requiring additional notice or consent must be addressed before that use begins.

## International processing

Anvil is based in the United States. Providers may process information in the United States and other countries, whose laws may differ from those where you live. Where required, we must put applicable international-transfer safeguards in place before the transfer, such as approved contractual protections or another legally available mechanism. Contact the administrators for information about applicable destinations and safeguards. Accepting the Forge agreement does not waive mandatory privacy rights or substitute for required transfer safeguards.

## Retention and deletion

We retain information for the purposes described above, then delete it or irreversibly anonymize it. Matching hashes and other reversible or linkable identifiers remain personal information. Our retention schedule is:

- Ordinary account profile and saved trading history: while service is active and for 12 months after effective cancellation or expiry. Genuine service resumption before deletion restores active-service retention; an incidental login or a marketing message does not restart the period.
- Account closure or a granted Schedule A refund with permanent termination: ordinary profile and history are removed within 30 days after closure or the written grant, after separating necessary evidence. An applicable earlier erasure deadline takes precedence.
- Signed agreements, their Order Terms, acknowledgments and signature audit evidence: retained indefinitely to establish the terms accepted and support legal rights and obligations, subject to applicable law and at least annual review of continued necessity. They are excluded from routine automatic deletion. An administrator reviews any applicable request or legal requirement affecting these records; this policy does not override mandatory limits or rights. This includes signatures for purchases that were not completed.
- Separate cancellation and claim evidence: ordinarily 10 years after the later of effective service termination or final resolution of the relevant claim. Retain only the relevant records; a specific legal hold may extend this period. This is a records policy, not a statement that every law requires ten years.
- Billing and tax-support records: ordinarily seven years after the later of the relevant tax-return due date or actual filing date. The necessary subset used as contract or claim evidence follows its applicable evidence period.
- Ordinary support records: 24 months after resolution. Threads inactive for 90 days are reviewed for closure unless an open issue is documented. Unnecessary sensitive attachments are removed within 30 days after their immediate purpose ends.
- AI diagnostic working copies: removed within 30 days after the diagnostic task closes. Necessary findings may be preserved in the relevant support or claim record. Provider-managed security and backup copies require separate review under the provider's terms and controls.
- Routine application/debug logs: up to 90 days; hosting providers may retain routine service logs for shorter periods. Forge's native routine security and administrator audit logs: up to 12 months. Signature, financial and other necessary evidence follows its applicable evidence schedule above; incident-specific evidence may be retained in a restricted case file for its justified period. Providers' own security and audit records follow their terms and applicable law.
- Prospect/marketing records without an active customer relationship: 12 months after the last affirmative interaction, such as an inquiry or reply. Marketing sends and passive tracking do not extend this period.
- Minimal exclusion and marketing-suppression records: as long as necessary to enforce the restriction or opt-out, reviewed at least annually. We do not retain full trade histories merely to enforce a restriction.
- Rolling backups of deleted ordinary data: expire within 90 days of deletion from active systems. Backup copies are not used for routine access; deletion and suppression instructions must be reapplied before a restored system resumes normal use.

A specific legal obligation, pending or reasonably anticipated dispute, or documented investigation may justify retaining the necessary subset longer. We restrict those records to that purpose, review holds at least every six months, and remove expired records within 30 days after a hold is released. We do not restart the entire retention period because an unrelated claim arises.

Closing an account, canceling a subscription and requesting deletion are different actions. A deletion request does not automatically cancel payment obligations or erase records lawfully needed for a claim. We explain applicable exceptions when responding. We may preserve necessary evidence even when access to the product has ended.

## Your choices and requests

Email support@anviltradingsystems.com with your request for access, a copy, correction, deletion, restriction, an objection, withdrawal of consent or marketing opt-out. Please describe the request and provide the account email; do not send passwords or identity documents unless we explain why additional verification is necessary. We verify identity proportionately and accept authorized representatives where applicable law permits or requires it.

Your rights and available exceptions depend on applicable law. We respond within the deadlines that apply, explain any lawful extension or refusal, and provide an applicable appeal route. You may contact the relevant privacy regulator, including your local data-protection authority where applicable. We will not unlawfully discriminate against you for exercising privacy rights. Mandatory rights continue after cancellation or a refund-related exclusion.

Administrators handle requests and use a combination of automated expiry checks and documented reviews. Necessary provider-side actions may require separate verification. We do not treat a queued task as proof that all copies have been deleted.

## Security, age and updates

We use access controls and operational safeguards intended to protect information. No system can promise absolute security. Keep independent copies of important broker and prop-firm records and protect your login credentials.

Forge is intended for adults meeting the agreement's age requirements. Contact us if you believe a child has supplied personal information so we can assess and address it.

We may update this notice as practices or requirements change. We will provide additional notice or obtain consent when required. A change to the notice does not retroactively authorize incompatible use of information.