Privacy Policy

Last Updated: 15 September 2026

1. Information We Collect

We collect information to provide and improve our services, including ForgeScan, InboxGuard, ForgeFix, ForgeMigrate, DomainWatch, and ForgeAcademy. This includes:

• Contact information: your name, email address, and any other details you provide when you get in touch or sign up.
• Domain and service data: details such as DNS records, registrar information, scan results, and service usage related to our tools.
• Credentials: access details you share securely for support purposes, which we do not retain after work is completed unless you request otherwise.
• Usage data: anonymised statistics to help us improve our website and services, if analytics are enabled.
• Email preferences: when you request Domain Forge updates, we store your email address, consent time, confirmation status, and the scan or domain that led to the request.
• Enquiries: when you send us a fix request or contact form, we store your name, email address, the domain in question, your message, and any ForgeScan reference attached to it, so that we can answer you and keep a record of the work.

2. How We Use Your Information

Your data is used to:

• Respond to your questions and provide our services.
• Run scans, generate reports, and manage accounts for ForgeScan, InboxGuard, ForgeFix, ForgeMigrate, DomainWatch, and ForgeAcademy.
• Send invoices, updates, and important service information.
• Improve and maintain our website and services.
• Send optional domain and email guidance only after you confirm your address through our double opt-in process.

ForgeScan does not require an email address. The full scan context used for checkout expires after 24 hours. Separately, we retain the technical result of the scan itself — the domain, each check and the public DNS evidence behind it, the score, confidence, and scan time. We keep this so that a later fix request can be answered against what we actually measured rather than what a browser reported, and so that we can understand tool reliability.

If you request email updates, the request remains pending until you use the confirmation link. Unconfirmed requests are not part of the active mailing list. Every marketing email carries a one-click unsubscribe link and the standard List-Unsubscribe header, so your mail provider can also offer an unsubscribe button. Unsubscribing takes effect immediately. You can also withdraw consent at any time by contacting us.

When you unsubscribe we keep your email address on a suppression record rather than deleting it. That record is what allows us to make sure we do not contact you again, and we rely on it for that purpose alone.

3. Lawful Basis

We rely on your consent to send marketing email, which you give through the double opt-in described above and can withdraw at any time. We rely on contract and our legitimate interests in running and improving the service to answer enquiries, deliver the products you have asked for, and retain scan results.

4. How Long We Keep It

• Scan context for checkout: 24 hours.
• Scan technical results and generated reports: 90 days from creation. Customer download links have their own, shorter expiry. We can retrieve a free scan by domain and date to help with an enquiry, but an anonymous scan does not tell us who ran it.
• Real-email test findings: new tests under the admin support archive are retained until 90 days after the associated test allowance was created. Older allowances retain their original seven-day deletion deadline. Your private test page shows the applicable date. Amazon SES processes the test message. We store authentication and SES spam/malware screening outcomes, sending domains, observed DKIM signing domains and selectors, labels and times. We automatically look up relevant public DNS records and retain a dated summary, not raw TXT records. We do not retain the message body, subject, attachments, full headers, full sender address or sending IP. Deleting your tests also deletes their support copy and queued analysis.
• Service email activity: 90 days. This records sending and delivery status, not a guarantee of inbox placement.
• Enquiries and fix requests: 24 months from your last contact with us.
• Consent records for the mailing list: for as long as you are subscribed, and 24 months afterwards, so that we can evidence the consent you gave.
• Suppression records: kept indefinitely, because deleting them would mean we could no longer reliably avoid contacting you again.

5. Storage and Security

We use Cloudflare for the website and private storage, Resend for service emails and optional mailing-list delivery, Amazon SES for processing diagnostic test messages, and our business mailbox for replies. We do not sell your information. The support dashboard is restricted to the Domain Forge operator through Cloudflare Access.

Our enquiry, sign-up, checkout and portal forms use Cloudflare Turnstile to keep out automated spam. When one of those forms is on the page, Turnstile runs a short check in your browser and Cloudflare processes technical signals such as your IP address and browser characteristics to decide whether the request is automated. We receive only the result, and we use it for security, not for marketing or tracking. Our lawful basis is our legitimate interest in keeping these forms usable and free of abuse.

Unsubscribing, disabling a download link and deleting stored results are separate actions. Deletion removes eligible data from our active systems, with failed steps retried. Financial records and minimal suppression or audit records may need to remain for their separate purposes. Copies already delivered to recipients cannot be recalled; backup and provider copies follow their own retention schedules and are not used to restore deleted customer data into active service.

6. International Transfers

Your information may be transferred and stored in countries outside the UK. We ensure that any such transfers comply with UK data protection laws and appropriate safeguards are in place.

7. Your Rights

You have the right to:

• Request access to the personal data we hold about you.
• Request correction or deletion of your data.
• Withdraw consent where applicable.
• Lodge a complaint with the Information Commissioner's Office (ICO) if you believe your rights are not being respected.

8. Cookies

We currently do not use cookies or tracking technologies on our website. Should this change, we will update this policy accordingly and inform you before using such technologies.

9. Contact Us

If you have any questions or requests regarding your personal data, use our contact form or email us:

📧 [email protected]

Domain Forge
Control your domain.