Privacy Policy

Who we are

Forward CRM is operated by Wesley Swain, an individual sole trader, acting as the data controller for the personal data described below. Contact: hello@forwardcrm.live.

What we collect

• Account info: email, name, hashed password, optional PIN.
• Content you create: notes, contacts, deals, tasks, activity, files, tags.
• Billing info: handled by Paddle — we never see your card number; we receive a customer ID, country, plan, and invoice metadata.
• Device & usage data: browser and device type, browser language, approximate location (country and city, derived at our network edge — we do not store your IP address in our analytics), pages visited, feature usage, and minimal product analytics. IP addresses are processed transiently by our hosting and edge providers for security and rate limiting.
• Support messages you send us.
• Gmail sync waitlist: the email address you submit on our homepage. We use it only to notify you when Gmail sync is available. It is not shared, not used for marketing, and you can request removal at hello@forwardcrm.live.

How we use it & legal basis

• Deliver the service (contract): authenticate you, store and show Your Content, sync devices.
• Billing & tax (contract / legal obligation): manage your subscription via Paddle as Merchant of Record.
• Reminders & digests (consent / contract): only the emails you opt into.
• Security & fraud prevention (legitimate interests): rate limiting, abuse detection, audit logs.
• Product improvement & support (legitimate interests): aggregated usage analytics, debugging crashes, replying to you.

We don't sell your data. Ever.

AI processing

Notes, business-card images, voice notes, and — if you connect a mailbox — the content of synced email messages and selected metadata are sent to Google's Gemini API to extract structure. We use Google's paid API tier, under which Google does not use your data to train its models. In fallback situations a request may instead be routed through the Lovable AI Gateway to a comparable model under equivalent no-training terms. Inputs and outputs are retained only as long as needed to deliver the response. You stay in control: AI Note suggestions are reviewed before anything saves, and email automations are configurable and can be turned off in Settings.

Sub-processors we share data with

• Lovable Cloud (Supabase) — hosting, Postgres database, auth, storage.
• Cloudflare — CDN and edge serverless runtime.
• Paddle — Merchant of Record for payments, subscriptions, tax compliance, invoicing.
• Mailgun EU (via Lovable) — transactional and notification email delivery.
• Google (Gemini API) — AI processing of notes, images, voice, and synced email content, on the paid API tier with no training on your data.
• Lovable AI Gateway — fallback routing for AI features when the primary provider is unavailable.

We may also disclose data to professional advisers (legal, accounting) and to authorities where required by law. No marketing partners. No data brokers.

International transfers

Sub-processors may process data outside your country, including in the United States. Where required, transfers rely on Standard Contractual Clauses or adequacy decisions.

Storage & security

Data is stored in encrypted Postgres, walled off from every other account at the database level, so only you can read your data. Transport is TLS only. Passwords are hashed. Access to production systems is restricted and logged.

Retention

We keep Your Content for as long as your account is active. If you delete your account, Your Content is removed within 30 days, except backups (purged within 90 days) and records we must keep for tax/legal reasons (typically up to 7 years).

Your rights

You can access, export, rectify, restrict, or delete your data anytime from settings, or by emailing hello@forwardcrm.live. Under GDPR (EEA/UK) and similar laws (CCPA in California), you also have the right to data portability, to object to or restrict processing, to withdraw consent, and to lodge a complaint with your local supervisory authority. We respond within 30 days.

Cookies

We use first-party cookies for sign-in sessions and remembering preferences, and minimal first-party analytics. Our public pages can also use Google Analytics, an optional analytics cookie that only runs on our marketing pages after you accept it in the cookie banner — decline and it never loads. No third-party advertising cookies.

Children

Forward is not directed to children under 16 and we do not knowingly collect their personal data.

Changes

We may update this policy. Material changes will be announced via email or in-app at least 14 days before they take effect.

Contact

Privacy questions: hello@forwardcrm.live