Privacy policy.

Waelas Ltd processes personal data when you use Forge. This page explains what we collect, why we collect it, and how to control it. Plain English. No tricks.

1. Who we are

Forge is a calendar and scheduling product operated by Waelas Ltd, a company registered in England and Wales (Company No. 16397759) with registered office at 71–75 Shelton Street, London WC2H 9JQ. We are the data controller for personal data processed through The Forge.

2. What we collect

• Account data: your email address, name, password (stored as a bcrypt hash), and account creation date.
• Profile data: anything you choose to add to your public booking page — booking link slug, photo, biographical text, timezone.
• Calendar data: when you connect Google Calendar, we store an encrypted refresh token, read free/busy windows to prevent double-booking, and write new events you authorise via Forge. We do not read event titles or descriptions from calendars unless those events were created by Forge.
• Booking data: when someone books a meeting with you, we store their name, email, the event type they booked, the time, and any optional message they include.
• Technical data: server logs (IP address, user agent, request paths) for security and debugging, plus error reports sent to Sentry when something goes wrong, with personal data redacted where reasonable.

3. Why we collect it

• To provide the service: account, profile, calendar, and booking data are processed under contract (UK GDPR Article 6(1)(b)) — we cannot run The Forge without them.
• To secure and improve the service: technical data is processed under legitimate interest (UK GDPR Article 6(1)(f)) for security monitoring and bug fixing.
• To send transactional email: booking confirmations, password resets, and account notifications are processed under contract.

We do not run marketing email, retargeting, or profile advertising. We do not sell data. Ever.

4. Who else processes your data

Forge relies on a small set of subprocessors to run.

We have data processing agreements (or equivalent) with each subprocessor. We will give 14 days notice before adding a new subprocessor.

5. How long we keep it

• Account data: until you delete your account, plus 30 days for backup retention.
• Calendar OAuth tokens: until you disconnect your calendar or delete your account.
• Booking records: 24 months after the booking date, or until you delete your account, whichever comes first.
• Server logs: 30 days.
• Sentry error reports: 90 days.

6. Your rights

You can:

• Access the personal data we hold about you (export available from Settings > Profile)
• Correct anything inaccurate (most data is editable directly from your account)
• Delete your account and associated data (Settings > Profile > Danger zone — permanent erasure within 30 days)
• Object to processing where we rely on legitimate interest
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any right, email Nathan@waelas.com.

7. International transfers

Some subprocessors are based in the United States. Where this applies, transfers are governed by the EU-US Data Privacy Framework, the UK Extension to the EU-US Data Privacy Framework, or Standard Contractual Clauses. By using Forge you consent to these transfers.

8. Cookies

Forge uses essential authentication cookies only. We do not use tracking cookies, analytics cookies, or third-party advertising cookies. There is no cookie banner because there is nothing to consent to beyond strictly necessary cookies.

9. Changes to this policy

If we make material changes, we will email registered users at least 14 days before they take effect. Minor or clarifying changes will be reflected here with an updated date.

10. Contact