Privacy Policy

Effective: October 2026

DMForge ("we", "us", "our") is operated by Tibor Rames, trading as DMForge, a sole trader based in the United Kingdom. We are registered with the UK Information Commissioner's Office (ICO) under Tier 1 (micro organisation) in accordance with the Data Protection (Charges and Information) Regulations 2018. We are committed to protecting personal data in full compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), and the Data (Use and Access) Act 2025.

1. Data Controller & Legal Entity

Data Controller: Tibor Rames (trading as DMForge)
Address for Service of Legal Documents: Kemp House, 160 City Road, London, EC1V 2NX, United Kingdom
Email: contact@dmforge.org
Supervisory Authority: Information Commissioner's Office (ICO), United Kingdom

2. What Data We Collect

• Account credentials: email address and authenticated user identifiers (via Firebase Authentication).
• Payment data: processed exclusively via Stripe. We never see, transmit, or store card numbers, CVVs, or bank details. Our payment flows qualify for PCI-DSS Self-Assessment Questionnaire A (SAQ A).
• Channel integration data: Page Access Tokens and webhook secrets for Meta (Instagram DM & Facebook Messenger), Twilio SMS credentials, and SMTP email credentials. All sensitive API credentials are encrypted at rest with AES-256-GCM before storage.
• Outreach and conversation data: prospect names, handles (Instagram Scoped User IDs / Page-Scoped IDs), message histories, and qualification states needed to automate responses within Meta's standard 24-hour customer service window.
• System & analytics logs: request IP addresses, browser user agent, and session timestamps for security audit trails and abuse mitigation. First-party analytics cookies are strictly gated behind your explicit consent.

3. Lawful Bases for Processing (UK GDPR Art. 6)

• Performance of a Contract (Art. 6(1)(b)): providing the DMForge AI appointment-setting service, routing inbound messages, executing webhooks, and managing billing.
• Legitimate Interests (Art. 6(1)(f)): securing our systems against fraud, DDoS, and prompt-injection attacks; maintaining audit logs; verifying API rate limits.
• Legal Obligation (Art. 6(1)(c)): retaining statutory transaction and tax records as required by HMRC and UK accounting regulations.
• Explicit Consent (Art. 6(1)(a)): non-essential analytics tracking via PostHog, which is only activated after affirmative cookie consent.

4. Meta Platform Data Handling (Instagram & Messenger)

In accordance with the Meta Platform Terms and Developer Policies:

• We access Meta Graph API (v21.0) messaging endpoints strictly to automate replies to users who have initiated direct contact with your connected Instagram Professional account or Facebook Page.
• Message contents are processed to determine qualification status and propose booking times, and are stored only for as long as your workspace is active.
• We do not sell, license, or share Meta user data with third-party data brokers or advertising networks.
• Meta User Data Deletion: End users can trigger an automated deletion callback through Meta App Settings or request erasure directly. DMForge supports the Meta Data Deletion Callback protocol. Visit our Data Deletion Instructions & Status Page for step-by-step guidance and status verification.

5. Data Retention & Storage Periods

• Account and prompt data: retained while your account remains open; wiped upon account deletion.
• Prospect transcripts: retained for active lead management; deleted automatically when you delete the lead or wipe your account.
• Statutory accounting records: retained for 5 years following the relevant 31 January Self Assessment deadline per HMRC requirements.
• Security audit logs: retained for 90 days in immutable storage for threat analysis.

6. Third-Party Sub-Processors

We work with vetted service providers who adhere to strict data security standards:

• Stripe, Inc. — PCI-DSS Level 1 certified billing and payment processing
• Google Cloud & Firebase — encrypted database storage (Firestore named database) and authentication
• Google Gemini API — LLM prompt inference (no customer prompts are used to train foundational models)
• Vercel, Inc. — serverless hosting, edge routing, and SSL termination
• Twilio, Inc. — SMS appointment reminders (opt-out STOP compliant)
• PostHog — product analytics (consent-gated only)

7. Your Data Subject Rights (UK GDPR)

You hold statutory rights regarding your personal data:

• Right of access (DSAR): request a copy of all personal data held about you.
• Right to rectification: correct inaccurate or incomplete records.
• Right to erasure ("Right to be forgotten"): delete your account and all associated lead records via our self-service endpoint or by emailing us.
• Right to restrict processing: pause processing while disputes are investigated.
• Right to data portability: obtain your prospect and campaign data in structured JSON format.
• Right to object: object to processing based on legitimate interest.

To exercise any right, submit a request to contact@dmforge.org with the subject "Data Subject Request". We will verify your identity and fulfil your request within 30 calendar days at no charge.

8. Data Protection Complaints Process (Data (Use and Access) Act 2025)

In compliance with the Data (Use and Access) Act 2025, DMForge maintains a formal, accessible procedure for handling data protection complaints:

• You may lodge a complaint by emailing complaints@dmforge.org or contact@dmforge.org with subject line "Data Protection Complaint".
• 30-Day Acknowledgement Guarantee: We acknowledge receipt of every data protection complaint within 30 calendar days of receipt.
• We will investigate the matter promptly, take appropriate remedial steps, and communicate our formal decision and findings in writing.
• You retain the right at any time to escalate unresolved complaints to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Read our full Data Protection Complaints Procedure for details on our investigation process and timelines.

9. Cookies & Local Storage

We use essential cookies and local storage tokens solely for user session authentication. Non-essential product analytics are only loaded after you click "Accept" on our cookie consent banner. You may revoke or update your consent at any time.

Last updated: October 2026 · Tibor Rames trading as DMForge · Contact: contact@dmforge.org