Privacy

Privacy Policy

Last updated 1 July 2026

Forj is operated by Forj AB (org.nr 559019-9161, currently registered as Zmart Com West AB), a company based in Gothenburg, Sweden. Forj AB is the data controller for personal data collected through forj.se. This notice describes what is collected, how it's used, and your rights under the General Data Protection Regulation (GDPR).

What data is collected

When you email us directly or book a call, you actively provide:

• Your name
• Your company name
• Your email address
• The message you choose to send

For visitor analytics the site uses Plausible, a cookieless tool that measures aggregate, anonymous traffic (page views, referrers) with no personal data and no cross-site tracking. Plausible does not profile individual visitors and needs no consent.

With your consent, the site also uses Google Tag Manager to load advertising and measurement tags (such as Google Ads and the LinkedIn Insight Tag), and Albacross, a B2B service that uses your IP address to identify the company you visit from. These set cookies and process online identifiers (for example your IP address and a randomised advertising ID) to measure campaigns, identify visiting companies, and show relevant ads. They are off by default and run only if you choose “Accept all” in the cookie banner; you can decline or change your choice at any time. See the Cookie Policy for detail.

How your data is used

Submitted data is used solely to respond to your inquiry and, where relevant, to discuss potential engagements. Your data is not shared with third parties, sold, or used for marketing communications.

The free read (company teaser on forj.se)

On the homepage you can type a company name and the cloud it runs on to get a free instant teaser, and optionally enter your email to receive a fuller read by email. This section explains exactly what that involves. For a plain-language walkthrough of how a read is built, see How we read companies.

What is collected

• Your email address (only if you choose to receive a read by email).
• The company name or number you type.
• A hashed IP address and your browser user agent, kept for abuse prevention only (to stop misuse of the free tool). These are not used to profile you.

Lawful basis: your consent

When you submit your email, the lawful basis is your consent under GDPR Article 6(1)(a), given by an explicit tick and confirmed from your inbox. That consent covers two things: delivering the read you asked for, and sending you occasional related updates (a waitlist or product news). Consent is voluntary and revocable at any time: every email has a one-click unsubscribe, and you can also write to us to withdraw it. Withdrawing consent does not affect anything we did before you withdrew it.

Purpose limitation

Your email is used to send the read and those related updates, and nothing else. It is not sold, not shared for others' marketing, and not repurposed.

How long it is kept

• The hashed IP and user agent are purged at 90 days.
• Leads (your email and what you typed) are reviewed and purged at 24 months of no interaction.
• Everything is deleted on unsubscribe or on an erasure request, whichever comes first.

Where it is stored

Your lead data is stored on Forj's own infrastructure in the EU: a self-hosted database in the AWS Stockholm region (eu-north-1). It is EU-resident and stays in the EU.

How the read is generated (AI)

The read is generated by an AI model run in the EU region (Amazon Bedrock, AWS EU). Your request does not leave the EU.

Where company and role signals come from

Under GDPR Article 14, where we use data we did not collect directly from you: the company and role signals in a read come from licensed business-data sources and public web sources. We do not scrape LinkedIn. In the public read we never show a named individual, only a role; a named contact is shown only inside an authenticated Alloy workspace.

Your rights, and how to use them

For the free read you have the right to access your data, have it corrected, have it erased, object to processing, and withdraw consent at any time. There is a one-click unsubscribe in every email, and for anything else you can contact partner@forj.se.

The Alloy platform & customer data

Separately from this website, Forj operates the Alloy platform for AWS partners; the library also reads Azure and Google Cloud where a customer runs them. In Alloy, Forj processes business-contact data of prospects (name, work title, business email and phone, public professional profile, employer) to identify and manage B2B opportunities. For business prospecting the lawful basis is legitimate interest (documented). Where Forj processes a customer's data on their behalf, Forj acts as a data processor under our Data Processing Agreement.

Platform data is hosted in the EU and encrypted in transit and at rest, with row-level isolation between customers. Sub-processors include AWS (hosting, and AI reasoning via Amazon Bedrock in the EU), Anthropic PBC (AI reasoning in the United States, for the tasks that need live web search, which Amazon Bedrock does not offer) and SAS Spoke (meeting capture and transcription, EU), plus the CRM a customer connects (for example HubSpot or Salesforce); where a sub-processor or a connected CRM processes data outside the EU/EEA, the transfer is covered by Standard Contractual Clauses. Full detail is in Trust & Security and the sub-processor list.

Where your data is stored

The forj.se website is served from Amazon Web Services (Amazon S3 with the CloudFront content-delivery network). When you submit the contact form, your details are handled by an edge function on Forj's own AWS infrastructure and stored in a database hosted in the EU (Stockholm) so Forj can respond to you. AWS acts as a data processor under GDPR Article 28.

If you book a call, scheduling is handled by Cal.com, which processes your name, email and meeting details under its own privacy policy. If you try the Smith demo on the homepage, the text you type is sent to Forj's EU infrastructure and processed by Amazon Bedrock in the EU to generate a reply, so please don't enter personal data there.

If you accept marketing cookies, campaign-measurement data is shared with Google and LinkedIn under their own privacy terms (transfers outside the EU/EEA are covered by Standard Contractual Clauses), and visitor-company data is processed by Albacross within the EU. You can decline or withdraw this at any time in the cookie banner.

Email correspondence is hosted by One.com, the email provider for forj.se. Their practices are described at one.com/privacy-policy.

How long data is kept

Inquiry data is retained for up to 24 months from the last interaction, after which it is deleted. If an engagement begins, relevant business correspondence is retained for the duration of the engagement and for the period required by Swedish accounting law (typically 7 years).

Your rights under GDPR

You have the right to:

• Request access to the personal data Forj holds about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to processing or request restriction of processing
• Request your data in a portable format
• Lodge a complaint with the Swedish Authority for Privacy Protection (IMY)

To exercise any of these rights, email partner@forj.se. Requests are handled within 30 days.

Changes to this notice

This notice may be updated as Forj's practices evolve. The "last updated" date at the top of this page reflects the most recent revision.

Contact

For any privacy-related questions or requests:
Forj AB (org.nr 559019-9161)
partner@forj.se