Privacy Policy

1. Who we are and when this notice applies

Forge is operated by Paw Partners Co., Ltd. in Thailand. We are the controller of personal data used to operate this website, manage our relationship with you, and protect the service. This notice explains our handling of personal data at https://forge.omniva-connect.com and how to contact us about it.

Forge provides public information pages, email/password authentication, invitation-based registration, password recovery, organization/member administration, workspaces, projects, agents, API keys, task submission and status, notifications, usage, audit logs, and a minimal MCP server. Task execution requires a separately operated authorized worker; Forge does not include a connected Codex runtime. Visiting these public pages does not create an account or submit a task.

Forge is a Cloud-only service; there is no self-hosted product plan. The current processing described below is separate from the planned features section. A design, preview, or roadmap entry does not mean a feature is enabled or that we are already collecting its proposed data.

2. Information we handle

Website and service operations: our hosting and network systems necessarily handle connection data such as IP addresses, request timing, requested resources, and browser/network headers. Operational and security records may include service events, error categories, and request identifiers. The application does not enable routine per-request access logging, and these public pages use no analytics scripts, advertising trackers, or external assets. Information you send when contacting us may include your name, address, message, and correspondence history.

Account and authentication: display name, contact email, account status, provider identity identifiers and verification status, password hashes where password login is used, session token digests, and creation, expiry, revocation, and activity timestamps. Raw passwords are not intended to be retained as account records. Registration also records accepted terms and acknowledged privacy versions with a timestamp. One-time email-link digests and short-lived, hashed rate-limit records support verification, invitations, and abuse prevention.

Organization and work records: organization and workspace names and identifiers; membership roles and status; project names and repository references; agent names, availability and last-seen times; task instructions, results and error summaries; requester and project/agent relationships; notifications; audit events; API-key names, scopes, token digests and expiry/revocation metadata; and resource quotas and usage counters. API-key secrets are displayed once and only their cryptographic digests are retained. User-submitted task content can include code or personal data you choose to provide. Do not submit credentials, secrets, or sensitive personal data unless an expressly supported use and appropriate safeguards have been agreed.

Transactional email and optional third-party login: transactional mail may contain recipient/sender addresses, invitation or verification content, message identifiers, delivery status and error metadata. Forge uses Microsoft Graph to send requested verification, invitation, and password-reset links. Sending is accepted by the provider subject to its delivery controls; acceptance is not proof of receipt. Optional GitHub or LINE login may provide a verified provider identifier and profile/contact data permitted by the selected flow. Neither login integration is currently enabled, and we do not receive your provider password. We will explain additional data requests before enabling an integration.

3. Planned features: not yet active

The following are planned capabilities, not additional processing activated by this notice: canonical event ingestion and workflow runs/step outputs/human approvals; Copilot conversations, messages and voice transcripts; managed file/artifact storage; per-instance Agent/Worker enrollment and credentials; connector and model-provider configuration references; billing and support-ticket workflows; expanded telemetry/analytics; and self-service data export/import. The current task, API-key, in-app notification and audit functions remain distinct. The newer worker control plane is disabled by default and is not a bundled execution runtime. No voice recording or model-generation feature is currently provided by Forge.

If introduced, events, runs, steps and approval records would support authorized workflow execution and accountability; messages/transcripts would support explicitly enabled conversation or voice features; files/artifacts would hold selected inputs, outputs and evidence. Machine records would identify an individual Agent/Worker, its allowed scope, status, rotation and activity. Connector/provider records would use restricted credential references rather than expose keys to ordinary users. Billing records would support approved subscriptions and payments; support tickets would contain the customer's chosen issue details, authorized references and consented diagnostic evidence. We will explain required and optional fields and the relevant purpose before collection.

The planned Model Gateway uses an organization's own provider account and credentials by default. Only selected, authorized, minimized context would be sent to the approved provider/model, subject to its disclosed processing and retention terms. Using your own key does not keep submitted data inside Forge or remove the provider's involvement. Forge-managed AI would be a separately enabled future option. Forge has no cross-tenant model training feature; our default design does not use one customer's business data to train a model or advise another customer. Any proposed use beyond that boundary would require separate review, disclosure and an appropriate legal basis or consent where required.

Planned provider categories include cloud hosting, object storage, email/delivery, Omniva for an optional LINE channel, and approved AI model services. These plans do not identify a selected storage/AI provider or an active Omniva integration. Relevant providers, regions, purposes and safeguards will be disclosed before new processing is enabled. Your separately operated worker and any services you configure outside Forge may have their own data flows and terms.

Planned operational telemetry is limited to necessary reliability/security signals such as availability, latency, queue age, safe error categories, resource saturation and aggregate usage. It would minimize or pseudonymize identifiers where practical. Separate optional product analytics would contain no business content and offer organization controls to inspect, limit or opt out. Neither design captures messages, documents, payloads, prompts or responses by default. No new analytics collector or optional tracking is enabled by this notice.

Planned notification controls would let users choose supported channels, categories, locale, timezone, quiet hours and digests. Approved organization policies may require essential security, failure or approval/SLA notices, with the reason explained; mandatory notices would still respect lawful contact, verified channels and access restrictions. External notices would contain minimal generic text and a link requiring authorization, rather than business details. These expanded preferences and email/Omniva notification adapters are not currently available.

4. Sources and required information

We receive data directly from you, automatically through connections to our services, and, for enabled features, from your organization administrators, authorized users, connected agents, and selected identity or email providers. An administrator may supply membership or invitation details about you.

You can read these public pages without an account. Where an enabled feature needs an identifier, contact address, organization membership, or task instruction to work, we will identify the required fields. Without necessary information we may be unable to authenticate you, grant access, perform the requested task, deliver a service message, or answer a request. Optional information is not required merely to read our notices.

5. Purposes and legal bases

We use necessary information to provide requested services, administer relationships, answer support requests, secure systems, investigate misuse, and meet legal obligations. For active account/organization features and future work features, this includes checking access, processing authorized work, reporting results, and sending essential service messages.

Depending on the activity, our basis may be steps you request before a contract or performance of a contract with you; legitimate interests in reliable operations, security, and organization administration balanced against your rights; or compliance with law. Where consent is the appropriate basis, we ask separately and explain withdrawal. Reading this notice or accepting terms is not blanket consent to optional processing. We do not use these public pages for advertising profiling or sell their visitors' personal data.

6. Organization customers and our processor role

An organization may determine why personal data is included in its projects and tasks. For that customer content, Paw Partners may act as a processor on the organization's documented instructions, subject to an applicable processing agreement. The organization remains responsible for its lawful instructions and notices. Our controller responsibilities for operating Forge and managing our own relationship with users remain separate.

Authorized organization administrators and members may access content according to their roles. Contact your organization about its use of your data; you may also contact us and we will help route the request. Membership in one organization does not authorize access to another organization's resources.

7. Sharing and service providers

Information may be handled by personnel who need it for support or operations, authorized members of your organization, and providers supporting hosting, databases, security, communications, and professional advice. DigitalOcean supplies the current hosting/managed database infrastructure. Microsoft provides transactional email through Graph. An external worker receives task instructions only after it authenticates with a scoped API key and claims a task; an MCP client receives or submits only the data requested through its authorized tools. Identity and other agent providers receive relevant information only when their integrations are enabled and used. We do not send task content to an agent merely because you visit this website.

We limit disclosure to its purpose and use appropriate service arrangements. We may disclose information when required by law or to protect lawful rights and safety, and to advisers or successors in a business reorganization subject to applicable safeguards. Contact us for information about providers relevant to your use. Third-party sites you choose to visit apply their own notices.

8. International processing

Cloud infrastructure and support providers may process data outside Thailand. We do not promise Thailand-only storage. Before a transfer requiring protection under Thai law, we assess the destination and applicable transfer basis, such as adequate protection, appropriate contractual safeguards, or a permitted exception. You may contact us for information about the arrangements relevant to your data. Enabling a new integration may require an updated notice or additional safeguards.

The planned Home Region model would bind each organization to an approved region and cover databases, workflow state, files, indexes, backups and worker/model/connector execution. Cross-region transfer or failover would be off by default and require an explicit approved purpose, safeguards and legal basis or consent where applicable. This is a future control, not a present location guarantee or claim that multiple regions are available. We must verify actual provider locations and processing arrangements before making a residency commitment.

9. How long information is retained

Retention depends on the purpose and applicable obligations rather than a single period for all data. Contact correspondence is kept while needed to resolve the matter and associated obligations. Operational/security records, task records, results, notifications, audit events, usage counters, and account/organization records remain while needed for service operation, security, the relationship, dispute handling, deletion instructions, and legal duties; routine container logs are size-rotated. One-time links expire after 30 minutes; expired email-action records are removed during later authentication activity after a one-day cleanup delay. Rate-limit records are similarly removed after their window plus an hour. Cleanup depends on service activity, not a guaranteed exact deletion time.

Session validity and record retention are different: expiry ends access but does not itself promise immediate deletion of every related record. Backup copies, if maintained, may persist through their normal replacement cycle with access restricted. We aim to delete or anonymize information when its purpose and required retention end. Contact us for the applicable retention criteria or a deletion request; there is no published fixed deletion schedule for future customer workflows yet.

Planned retention profiles would distinguish events/work history, audit/security records, messages/transcripts, files/evidence, telemetry, temporary data and backups. Organization choices would stay within justified legal, security and approved plan limits. Retention, archive storage, permanent deletion, backup expiry and legal hold would be separate; a valid hold may restrict deletion but would not grant general access. Proposed changes would explain their effect on existing data and costs before applying. We do not plan to silently extend retention for commercial benefit. No new public retention durations or automated deletion certificates are promised here.

Self-service and assisted export are planned before and during a disclosed period after cancellation, with authorized open-format records, secure expiring downloads and a report of included and unavailable data. Exact windows and any applicable conditions will be presented before reliance on that feature; there is no current self-service export/import service. For now, contact us or your organization for access, retrieval or deletion requests. Secrets, another tenant's data, private content without authority and proprietary or unlicensed material are excluded. Legal obligations, holds and other people's rights may limit a request; incomplete deletion or backup/provider exceptions must be explained rather than presented as complete.

10. Security

Current safeguards include HTTPS, an encrypted database connection, restricted infrastructure access, checks on stored sessions and organization membership, and organization-scoped resource relationships. These are shared-infrastructure safeguards, not a promise of a dedicated database per customer. We limit exposure of credentials and raw errors. No service can guarantee absolute security. Contact us promptly if you suspect misuse or exposure, without sending passwords or secret tokens.

The target Security and Privacy Baseline applies to every plan; optional industry packages would add reviewed controls, not certify compliance. Planned audit protections include append-only integrity evidence, no user editing or deletion of individual audit records, and automated policy-based expiry subject to holds and verification. Cryptographic audit chains, signed deletion evidence and optional immutable archives are not yet implemented. No certification, completed legal approval or guaranteed recovery time is represented by these plans.

11. Support and diagnostic access

You may contact us using the details in this notice. The current product has no support-ticket or customer-approved live support-session feature. Necessary infrastructure administration remains restricted to its operational purpose; it is not described as an already implemented ticket approval system.

The planned support service is default-deny: Support staff would have no default access to tenant business data. A normal live session would require a customer ticket, a stated reason, exact resources/role/fields and duration, and approval by an authorized customer. Sessions would expire automatically, be revocable at any time and show the actual support actor's activity. Diagnostics would require preview, redaction and consent before sharing. There would be no silent impersonation, backdoor or secret display. Any emergency exception would be a separate limited incident process with dual control, immediate alert, audit and post-incident review, subject to applicable obligations.

12. Cookies and browser storage

The public home, Privacy Policy, and Terms of Use pages do not set cookies or use browser storage. Their theme follows your device preference without recording it. Authentication pages use a necessary HttpOnly, Secure, SameSite=Lax session cookie and an HttpOnly CSRF cookie. Sessions currently expire after seven days; the CSRF cookie lasts one hour and can be refreshed. Sign-out revokes the current session; password reset revokes existing account sessions. Blocking these cookies prevents authenticated use. The workspace stores only language, light/dark theme, and collapsed-sidebar display preferences in local browser storage; form drafts remain in page memory. Credentials, API-key secrets, and task instructions are not stored there. Optional tracking would require a separate assessment and notice before introduction; no advertising or analytics cookies are used by these pages.

13. Your rights and complaints

Subject to Thai PDPA conditions and exceptions, you may request access and a copy, information about certain indirect collection, correction, deletion or anonymization, restriction, and portability where applicable; object to relevant processing; and withdraw consent for processing based on consent. Withdrawal does not invalidate earlier lawful processing. Some requests may be limited by legal obligations or other people's rights; we will explain a refusal where required.

Contact privacy@paw-partners.com or use the postal/telephone details below. We may request proportionate identity or authority verification before disclosing or changing data. Do not send a password or full identity document unless we explain a secure and necessary verification method. We will handle requests within applicable legal time limits. You may complain to Thailand's Personal Data Protection Committee/Office through its official complaint channel, whether or not you first contact us.

14. Children and people requiring legal representation

Forge is intended for professional use by people with legal capacity to use the service, not for children. We do not seek children's data. If a child or a person requiring legal representation has supplied information, contact us so we can assess removal or any legally required representative involvement. An organization must not assume that uploading a child's data is authorized by these terms.

15. Changes and contact

This revision, dated 5 September 2026, clarifies Cloud-only scope, current versus planned data use, provider flows, support access and data-lifecycle plans. It does not activate those planned services. Earlier versions are retained, and historical acknowledgments are not overwritten. We will publish revisions with an updated date and version, provide additional notice for material changes affecting enabled processing as appropriate, and obtain consent when required. A reviewed Thai translation is planned. Contact Paw Partners using the details below for privacy requests or questions.

Contact Paw Partners