Data Privacy
How we look after your data
This page explains what personal data Forge Ideas uses, why, where it goes, and how we protect the information our clients put into the app. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Last updated: 22 October 2026
- Each client’s ideas, documents and AI results belong to that client. We use them only to provide the service, on the client’s instructions.
- The app, its data and its backups are held on a server in an ISO 27001-certified UK data centre.
- To produce AI results, idea content is sent to AI providers in the United States and Ireland. Your name, email address and account details are never sent.
- Our AI and research providers don’t use the content we send them to train or improve their models.
- We don’t sell data, show advertising, or use tracking or analytics. The website and app load nothing from other companies’ servers.
- Who we are
- Who is responsible for your data
- What we collect and why
- How the AI uses information
- Who we share data with
- International data transfers
- How we protect client information
- How long we keep data
- Cookies and browser storage
- Your rights
- Questions and complaints
- Changes to this page
1. Who we are
Forge Ideas is an AI-assisted workspace that helps innovation teams develop and assess ideas. It was co-founded by Gareth Shaw and Red Line Foundry.
- Red Line Foundry Ltd, Queensgate House, 23 North Park Road, Harrogate HG1 5PD, provides Forge Ideas to its clients.
- Gareth Shaw Digital Ltd (company number 17097722) builds, runs and supports the Forge Ideas app on Red Line Foundry’s behalf.
In this page, “we” means Red Line Foundry Ltd and Gareth Shaw Digital Ltd. For help with the app, email support@forgeideas.co. For anything about this page or your personal data, email privacy@forgeideas.co. These are the only email addresses we use to support Forge Ideas.
2. Who is responsible for your data
- If you use Forge Ideas through your organisation: your organisation is the controller. That covers your user account and everything in its workspace: ideas, notes, documents, photos and AI results. We process that information only to provide the service, under a written agreement with your organisation and on its instructions.
- If you contact us through this website: Red Line Foundry Ltd is the controller of your enquiry.
- Security records, such as failed sign-in attempts and server logs, are kept to protect the service for everyone who uses it.
3. What we collect and why
| Information | Why we use it | Legal basis |
|---|---|---|
| Account details: name, work email, role, workspace, sign-in times, and your password, stored only in scrambled (hashed) form | To give you access to your organisation’s workspace, send sign-in and password-reset links, and keep accounts secure | Processed for your organisation, under its instructions and its own legal basis |
| Workspace content: idea text, answers, card fields, photos, uploaded documents, web links, AI results, scores and decisions, and a record of who created or changed them | To run the app’s features for your organisation, including AI questions, research, scoring, reports and images | Processed for your organisation, under its instructions and its own legal basis |
| Security records: IP addresses, failed sign-in attempts (stored in hashed form) and server logs | To protect accounts, for example by blocking repeated wrong passwords, and to investigate faults or misuse | Legitimate interests: keeping the service secure |
| Website enquiries: your name, email, optional phone number and message from the “Talk to us” form | To reply to you and follow up on your enquiry | Legitimate interests: responding to people who contact us |
Forge Ideas is a business service and isn’t intended for children. It doesn’t need, and isn’t designed for, special category data such as health information.
4. How the AI uses information
Forge Ideas uses AI models to ask follow-up questions, research ideas, score them on the 4Ps (Purpose, Prowess, Potential and Profit), and create concept images. To do this, the app sends the workspace content each task needs to an AI provider, and saves the answer in your workspace. That content can include idea text, card fields, the workspace’s own guidance, extracts from its uploaded documents, and the name of the client organisation.
- Your account details are never sent. We have checked this by recording the app’s actual requests: they contain no user name, email address or account identifier. The AI providers see Forge Ideas as their customer.
- No training on client content. OpenAI’s and Anthropic’s terms for business API customers say they do not use the content we send them to train their models (OpenAI, Anthropic). We have switched off Tavily’s option to use our research questions to improve its service (Tavily privacy policy).
- Short retention by providers. We switch off OpenAI’s optional storage of web-research responses. OpenAI and Anthropic delete our request data within 30 days, except where their terms allow longer, for example to investigate misuse or where the law requires it (Anthropic details).
- Web searches. For web research, the AI writes its own search queries from the idea and runs them through the AI provider’s web search service. It is instructed not to put people’s names, email addresses, the client’s name or other confidential details into search queries. This is an instruction to the AI rather than a technical filter, and a client can ask for web research to be switched off for its workspace.
- Ideas are scored, not people. The AI assesses ideas. It makes no decisions about individuals, and every result is reviewed by people in your organisation.
Please check what you add. The app does not automatically detect or remove personal data. Anything typed or uploaded into an idea, including the names of people, may be included in what is sent to the AI providers. Leave out personal details an idea doesn’t need, and review documents before uploading them.
5. Who we share data with
We use a small number of service providers. Each receives only what it needs to do its job.
| Provider | What it does | What it receives | Location |
|---|---|---|---|
| Our hosting provider | Runs the server that holds the app, its database, files and backups | Everything stored in the app | ISO 27001-certified data centre, UK |
| OpenAI | AI questions, research, scoring, concept images, reading photos of idea cards, and search across ideas and uploaded documents | The workspace content each request needs | United States |
| Anthropic | AI scoring and improvement suggestions | The workspace content each request needs | Ireland and United States |
| Tavily | In-depth web research, used only by Forge Ideas administrators | Research questions about an idea | United States |
Website enquiries are handled by Red Line Foundry and Gareth Shaw Digital Ltd. We may also disclose information if the law requires it. We never sell personal data or share it for advertising.
6. International data transfers
The app, its database, uploaded files and backups are all kept in the UK. Data leaves the UK only when the app sends a request to an AI or research provider, as described in sections 4 and 5. Each transfer is protected by the provider’s data processing terms:
- OpenAI (OpenAI OpCo, LLC, United States): the EU standard contractual clauses with the UK Addendum, in OpenAI’s data processing addendum.
- Anthropic (Anthropic Ireland, Limited, with Anthropic, PBC in the United States): UK adequacy regulations for the transfer to Ireland, and the EU standard contractual clauses with the UK Addendum for onward transfers, in Anthropic’s data processing addendum.
- Tavily (United States): the standard contractual clauses with the UK Addendum, as described in Tavily’s privacy policy.
You can ask us for more detail on any of these safeguards at privacy@forgeideas.co.
7. How we protect client information
Keeping each client separate
- Every client has its own workspace. Users can only see the workspace they belong to, and contributors only see their own ideas.
- Only two Forge Ideas administrators can access every workspace, to set it up and support it. Only Gareth Shaw Digital Ltd can access the server and database.
- Uploaded photos and images are shown only to signed-in users of their own workspace. Uploaded documents can’t be downloaded directly from the web at all.
Accounts and sign-in
- Passwords must be long, and common or previously leaked passwords are refused. Passwords are stored only in hashed form.
- Repeated wrong passwords are blocked for a period.
- New accounts and password resets use one-time links that expire, so we never email passwords.
- Changing or resetting a password signs that account out on every device.
Systems
- All connections to forgeideas.co are encrypted with modern TLS, and browsers are told to always use a secure connection.
- The website and app load no scripts, fonts or other content from third parties, and the app’s browser security policy blocks them.
- Keys for the AI services are stored securely on the server, never in the database or logs, and are changed regularly.
- The server installs security updates automatically.
- Backups are taken daily, stay in the UK, are stored where only the server administrator can open them, and are deleted after a short period.
If something goes wrong
If we become aware of a security incident that affects, or may affect, personal data, we will tell the affected clients without undue delay, keep them updated as we learn more, and report it to the Information Commissioner’s Office (ICO) where the law requires it. We review our security regularly against UK government and industry guidance.
8. How long we keep data
- Workspace content and user accounts are kept for as long as the client’s agreement runs. When a client asks, we can export its data, and we delete it from our live systems promptly.
- Backups containing deleted data expire automatically within a few weeks. Until then they are kept out of use.
- Security records are kept only briefly: failed sign-in records for a day, one-time email links for a week, and web server logs for a few weeks.
- Website enquiries are kept as long as needed to deal with your enquiry and any follow-up.
- AI providers delete request data under their own terms, normally within 30 days.
9. Cookies and browser storage
The website sets no cookies. When you sign in to the app, it stores two things on your device. Both are needed to keep you signed in:
- a sign-in token in your browser’s storage, which proves you are signed in. It expires after a week.
- a cookie called
forge_media, which lets your browser show your workspace’s images. It is only sent with image requests, and is secured so scripts can’t read it.
Because these are strictly necessary for the service you have asked for, they don’t need consent. We don’t use analytics, advertising or tracking cookies.
10. Your rights
Under UK data protection law you have the right to:
- get a copy of the personal data held about you
- have inaccurate data corrected
- have your data deleted
- restrict, or object to, how your data is used
- receive your data in a portable format
If you use Forge Ideas through your organisation, it is best to ask your organisation first, because it controls your account and its workspace. If you ask us, we will pass your request to your organisation promptly and help it respond. We act on its instructions, so we will not disclose or delete its data directly.
For website enquiries, email privacy@forgeideas.co and we will respond within one month.
11. Questions and complaints
If you are unhappy with how your personal data has been handled, please tell us at privacy@forgeideas.co. We will acknowledge your complaint within 30 days, look into it, and let you know the outcome. If it concerns your organisation’s workspace, we will also involve your organisation.
You can also complain to the Information Commissioner’s Office, the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
12. Changes to this page
We will update this page when our services, providers or practices change, and show the date of the latest version at the top.