Forged Forms privacy notice — effective 14 October 2026
Forged Forms, 10329 Atlantic Blvd, Jacksonville, FL 32225, United States, provides the customer-facing parts service. Contact forgedformsfl@gmail.com about privacy, access, correction, deletion, complaints or a suspected safety/privacy incident; Darren is the designated contact. 3BA Printing Ltd., doing business as Alba Hubs, operates the tenant-separated website/portal and connected CRM under the accepted OEM data-processing addendum. Each business remains responsible for its actual activities.
Information and purposes. We use verified account identity, contact/delivery details, authentication and security records, uploaded CAD and specifications, quantities/material requirements, estimates, RFQs, quotes, approvals, order messages, transaction references, consent and support records to provide and secure the requested service, communicate, fulfil authorised work, handle rights/disputes and comply with applicable obligations. Please keep patient, children's and unrelated sensitive personal information out of CAD, filenames and notes. Identify regulated or safety-critical intended uses before quoting; an automated estimate is not engineering validation or regulatory approval.
Hosting and storage. The current application/database/private-file server is operated on Contabo infrastructure in Seattle, United States. 3BA's hosting DPA identifies Contabo GmbH and the relevant datacenter subprocessor Contabo Inc.; its executed source is retained. Application database and file stores reside on that server; SQL backup files on the same server are not an independent off-site backup. Contabo Auto Backup is enabled. We have not confirmed that every provider backup or downstream service is stored in Seattle or a single country. We make no Canada-only or US-only data-residency promise.
Sign-in and email. Google provides the selected Google sign-in, and Auth0 (an Okta service) brokers identity. We receive the identity claims needed for the account; these authentication requests do not send CAD. Alba supplies the additional authenticator/recovery controls; we do not receive the Google password. Google and Auth0 process identity and security metadata under their applicable policies and account arrangements; their wider operations may process information internationally. Necessary support/application email can use Neo, operated by Titan Solution Ltd SEZC, and the recipient's email provider. Approved email content, recipient details and expressly authorised attachments are processed to deliver that correspondence. Do not email payment-card details. No CAD-email attachment is implied merely by uploading a model. Separate CRM mail actions retain their own authorisation requirements.
Manufacturing access. Registered providers do not automatically receive customer files. Only eligible approved, authenticated providers with the required agreement and current job/network permission can see intentionally published RFQ information and a rotating raster preview. It contains image pixels rather than original downloadable CAD and can be captured in screenshots. Published title/notes, material/process, quantity, requested timing and delivery region should contain only the information needed to bid. Other supplier bids, the full customer account, card credentials and original CAD are excluded from the bidder view. Original CAD becomes available only to the awarded provider with the applicable order/file clearance; necessary fulfilment/contact details may then be shared for that order. Provider responsibilities, locations, permitted use and onward sharing must be recorded before the affected release; unapproved recipients and jobs remain held. Source files are not public portfolio material.
First-launch scope. Forged Forms customer card checkout is disabled pending its seller Stripe connection and payment review; 3BA's live platform billing key does not make Darren's customer checkout live. No Shippo/EasyPost seller shipping connection was observed for this site at this review. Shipping estimates and manually entered shipment information are distinguished from a live carrier booking or payment. New payment/carrier recipients must be identified and reviewed before activation. Optional tracking/session recording and external confidential-CAD AI processing remain disabled. Native upload/geometry measurement does not send CAD to an external AI service. Program or OEM agreement acceptance does not grant unrelated AI-training, advertising, public-portfolio or optional-marketing permission.
Retention and choices. We follow the operational retention schedule below: abandoned unsubmitted drafts have a 30-day review limit; accounts and saved parts remain for the requested active service, with inactivity review after twelve months; unaccepted RFQs and completed source CAD receive ninety-day post-purpose reviews subject to saved-part/active-order exceptions; minimum transaction/agreement records follow a seven-year operational record schedule subject to actual longer duties/holds; routine support and security evidence receive twelve-month review. Access-session expiry and size-rotated diagnostic logs are separate from audit record retention. Review and provider/backup rotation constraints mean deleting a live file does not instantly delete every lawful backup. No blanket immediate or fully automatic erasure is promised. The complete schedule is available through the privacy contact.
Rights, foreign processing and changes. Request access, correction, export, deletion or information about applicable rights through the privacy contact. Identity and authority are verified, with exceptions explained where another person's rights or lawful obligations apply. Withdrawal stops an optional purpose where available; necessary service/security processing and justified records may remain. Information processed abroad may be subject to lawful access by foreign authorities. This first-launch operational review covers the supported US/Canadian regions already configured and excludes Quebec and any new EU/UK market pending the affected safeguards and review. A registered address does not prove every provider processing country. Before material changes to purposes, recipients or agreements, update the notice and obtain the applicable renewed acceptance or separate permission. Existing accepted versions are retained; no independent legal or privacy certification is claimed.
Operational retention schedule — Forged Forms, 14 October 2026
Abandoned, unsubmitted CAD drafts: 30 days from creation, using the existing reviewed cleanup workflow. Submitted orders and lawful holds are excluded.
Customer accounts and expressly saved parts: while the customer uses the account/service. Review accounts and saved designs after 12 months without activity; give an opportunity to retrieve needed files before reviewed closure/deletion. Following an approved account closure or deletion request, complete the live-data review within 30 days, retaining only specifically justified order, security, legal or dispute records. A customer may request access, correction or deletion earlier.
Unaccepted submitted quotes/RFQs: review for deletion 90 days after expiry or abandonment unless the customer keeps the design in an active saved-parts account or a dispute/hold applies. Stop provider access when its purpose ends.
Completed orders: retain minimum invoice, transaction, specification approval and agreement evidence for seven years after the relevant transaction year ends, or longer only where an applicable obligation, product-safety need or documented dispute/hold requires it. This is an operational schedule, not a claim that every jurisdiction prescribes seven years. Review source CAD 90 days after fulfilment; keep it beyond that only for an active saved-parts/reorder service, an ongoing order, or a documented necessary hold. Financial record retention does not itself require keeping every CAD file.
Routine support correspondence: review 12 months after resolution, retaining necessary order/rights/dispute evidence under its applicable category. Optional marketing preferences: maintain the necessary consent/withdrawal or suppression record while communications or enforcement of the withdrawal require it; unsubscribing stops optional sending.
Authentication sessions: expire after 30 minutes without activity and no later than 24 hours; expiry prevents access and is separate from deletion of audit evidence. Review routine security/audit evidence after 12 months, retaining minimum accepted agreements and documented incident/dispute evidence for their applicable period. Do not retain raw OAuth codes, passwords, recovery codes or private link tokens in diagnostic access logs.
Diagnostic container logs: use bounded rotation at 10 MiB per file and three files per container. This is a size-based bound, not a fixed-day deletion promise. No request bodies or CAD are deliberately included in access logs.
Application SQL backups: newest ten plus one daily copy for fourteen days under the deployed backup policy. This is a count/date pruning rule triggered by backup runs, not a promise that every copy expires within fourteen days. Presentation/artifact copies follow their actual backup policy and must be included in a deletion/hold review; they are not covered by the SQL-only rule. Contabo Auto Backup normally retains ten daily restore points according to its published service documentation, but its actual processing locations, service delays and contractual/legal exceptions are not independently confirmed. The original hosting DPA and customer-provided provider observations are recorded separately.
Deletion is reviewed rather than blanket automatic erasure. The assigned weekly privacy/retention review identifies eligible items, active orders, shared files and lawful holds; the existing cleanup preview must run before any authorised deletion. No client data is deleted merely by publishing this schedule. Restricted backups may retain superseded data until actual rotation, contractual deletion or justified expiry; a restored copy must have recorded deletions and access restrictions reapplied before normal use. Provider deletion requests and confirmations are recorded; we do not promise immediate deletion from another business or from Google accounts. Darren handles Forged Forms requests at forgedformsfl@gmail.com; Alba platform operators perform the authorised technical actions.