Privacy Policy for CyrForge

Last Updated: August 24, 2026

Introduction

Elemental Genius LLC ("we," "our," or "us") operates CyrForge, a web-based customer relationship management platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access or use CyrForge at cyrforge.com or through any linked application.

By using CyrForge, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use the Service.

Information We Collect

Information You Provide Directly

Account Information:

• Name and contact information
• Email address
• Phone number
• Business information (company name, role, etc.)
• Password (stored in encrypted/hashed form)

Customer and Contact Data:

• Customer names, contact details, and business information
• Communication history and notes
• Sales pipeline and opportunity data
• Task and appointment information

User-Generated Content:

• Notes, comments, and messages within the Service
• Custom fields and tags
• Documents and files uploaded to the Service

Billing Information:

• Billing name and address
• Subscription plan and billing history
• Payment details are collected and processed directly by our payment processor, Stripe, Inc. We do not collect or store full payment card numbers on our own servers.

Information Collected Automatically

Usage Data:

• Feature interactions and actions taken within the Service
• Session duration and frequency
• Error logs and crash reports

Device and Browser Information:

• Browser type and version
• Operating system
• IP address
• Device type (desktop, tablet, mobile browser)

Cookies and Similar Technologies:

• Session cookies to keep you logged in and maintain application state
• Preference cookies to remember your settings
• Local storage on your device for in-app conveniences — your theme, dismissed suggestions, and a cached copy of your own AI weekly summary. This data stays in your browser
• Storage set by Google reCAPTCHA when you sign in or create an account — see below
• CyrForge does not use advertising cookies, analytics cookies, or cross-site trackers. The cyrforge.com website loads no third-party scripts at all. The CyrForge application loads exactly one: Google reCAPTCHA, used solely to tell real people apart from automated attacks on the sign-in and signup forms.
• You can control cookies through your browser settings; disabling essential cookies may limit Service functionality

Google reCAPTCHA:

When you sign in or create an account, Google's reCAPTCHA Enterprise service runs in your browser to detect automated abuse. It examines device and browser characteristics and how you interact with the page, and it sets its own cookies and browser storage to do so.

reCAPTCHA never receives your password, and it never receives the contact records or any other CRM data you keep in CyrForge. We use it only to protect accounts — and the personal data they hold about other people — from automated attack. We do not use it for advertising or analytics, and we do not use it to track you across other websites. Google's handling of this data is governed by the Google Privacy Policy and Terms of Service.

Google Account Access and Gmail Data

The Gmail integration is not currently available. It is a planned feature that is disabled in the product today: there is no way to connect a Gmail mailbox, and CyrForge requests no Gmail permissions from anyone. Signing in with Google (basic profile) is separate and unaffected. The rest of this section describes the integration as designed, so you can evaluate it before we enable it; we will update this policy when it launches.

Connecting your Google account to CyrForge will be optional. CyrForge is fully usable without it. This section describes exactly which Google permissions the integration requests, why each one is necessary, and what we do and do not do with the data.

Scopes the Integration Requests

We request the narrowest scopes that support these features. Narrower alternatives do not work: gmail.metadata exposes only headers, which cannot produce a summary of a conversation's contents, and Google provides no drafts-only scope, so gmail.compose is the minimum permission that allows CyrForge to prepare a draft.

We do not request Google Drive, Google Calendar, Google Contacts, or any other Google service. (CyrForge's "Add to Google Calendar" button is an ordinary link that opens Google Calendar's own event page in your browser — it involves no permission and no API access to your calendar.)

CyrForge Does Not Send Email On Your Behalf

CyrForge writes drafts into your mailbox. It does not send them — a draft becomes an email only when you open it, review it, and send it yourself.

This is a deliberate safety boundary, not an oversight. The CyrForge assistant reads mail that may arrive from people you do not know. If it could both read untrusted mail and send mail, anyone who emailed you could attempt to steer the assistant into sending messages, including forwarding your correspondence to themselves. Keeping a human in the loop on every outbound message closes that path.

How Gmail Data Is Used

Gmail data is used solely to answer requests you make of the CyrForge assistant inside your own account: searching your mailbox, reading a message you have asked about, summarizing correspondence, and preparing draft replies.

CyrForge touches your mailbox only during a request you initiate. There is no background sync, no scheduled crawl, and no bulk import of your mail.

Artificial intelligence processing. Where a feature uses AI, Gmail content is processed only by Google Gemini — either through Google Cloud Vertex AI under Google Cloud's enterprise terms, which prohibit using customer content to train foundation models, or through a Gemini API key you supply yourself. If you connect an Anthropic or OpenAI key for other CyrForge features, those providers receive no mailbox access whatsoever; the restriction is enforced in CyrForge's code, not by policy alone.

We do not:

• Use Google user data for advertising, ad targeting, or ad personalization
• Sell, rent, or trade Google user data
• Use Google user data to train, develop, or improve generalized AI or machine learning models
• Transfer Google user data to others except as necessary to provide or improve these user-facing features, to comply with applicable law, or as part of a merger or acquisition of which you are notified in advance
• Allow humans to read your Gmail data, except with your explicit consent for a specific support request, where necessary for security purposes such as investigating abuse, where required by law, or where the data has been aggregated and anonymized

Limited Use Disclosure

CyrForge's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and Revocation

CyrForge does not store your Gmail messages. Message content is fetched from Google when you make a request, used to answer that request, and discarded. It is not written to our database, and there is no copy of your mailbox on our systems to retain or to delete.

You may revoke CyrForge's access at any time, either from within CyrForge or at myaccount.google.com/permissions. Disconnecting removes CyrForge's access immediately. Revoking access stops all further Gmail access but does not by itself delete your CyrForge account — you can delete your account, and everything in it, yourself from Settings inside CyrForge.

AI Features and What They Process

CyrForge includes AI features that work on the data in your own account. By default they run on Google Gemini via Google Cloud Vertex AI, under Google Cloud's enterprise terms, which prohibit using customer content to train foundation models. If you connect your own Anthropic, OpenAI, or Gemini API key in Settings, these features use the provider you chose instead, under your agreement with that provider. In every case, processing happens only when you use the feature, and the inputs are used to answer your request — not retained by us.

Business-card scanning. When you photograph or upload a business card, the image is sent to our server, the text on it is extracted by Google Cloud Vision, and that text is turned into contact fields by the AI provider. The photo is processed in memory and never stored — only the member record you then choose to save is kept.

Voice referral capture. When you dictate a referral, CyrForge never receives or stores audio. Speech recognition runs in your browser using the browser's built-in service (in Chrome, for example, that service is operated by Google and governed by your browser's terms). CyrForge receives only the resulting text, which — together with the names of members in your account, so the right recipient can be matched — is processed by the AI provider to prefill the referral form for your review. Transcripts are not stored.

Follow-up drafting and the weekly digest. Drafting a post-event follow-up sends the event's title and attendees' first names to the AI provider; the weekly digest sends only aggregate numbers computed from your account (counts, rates, and totals — not your records). The digest result is cached in your own browser, not on our servers.

The AI assistant, chat, and insights read and act on your CRM records at your direction, as described elsewhere in this policy.

How We Use Your Information

• Service Delivery: To provide, maintain, and improve CyrForge functionality
• Customer Relationship Management: To help you organize and manage your customer relationships
• Billing: To process subscription payments through Stripe and manage your account plan
• Communication: To send you notifications, updates, and support messages
• Analytics: To understand usage patterns and improve user experience
• Security: To detect, prevent, and address technical issues and security threats
• Legal Compliance: To comply with applicable laws and regulations

Data About Other People That You Add to CyrForge

CyrForge is a CRM, so most of what you store in it is personal data about other people — your contacts, customers, and members. Those individuals did not sign up for CyrForge and may not know it exists. This section explains how we treat their data.

Our Respective Roles

For the contact, customer, and member records you enter:

• You are the data controller. You decide whose data to collect, what to record, and why.
• Elemental Genius LLC is the data processor. We store and process that data on your behalf, on your instructions, in order to provide the Service.

For your own account and billing data, Elemental Genius LLC is the controller.

Your Responsibilities as Controller

If you are subject to GDPR, UK GDPR, or a similar regime, you are responsible for having a lawful basis for the data you enter, for giving those individuals whatever notice the law requires, and for honoring their rights when they contact you.

Our Commitments as Processor

We will:

• Process the data only on your documented instructions, and not for our own purposes
• Keep it confidential and apply the security measures described on our Security page
• Use only the subprocessors listed in this policy, and update that list before adding another
• Assist you, so far as reasonably possible, in responding to requests from the individuals concerned
• Delete or return the data on termination, subject to the retention rules below

Requests From People You Have Added

If someone contacts us directly about data you hold in CyrForge, we will not amend or delete it on our own initiative. We will refer them to you as the controller, and notify you, unless the law requires otherwise.

Data Processing Agreement

If you require a Data Processing Agreement — which is generally the case for customers in the EU, EEA, UK, or Switzerland — our Data Processing Addendum applies to that processing and is available to accept. If you need a countersigned copy or have questions about it, contact [email protected].

Shared Chapters

CyrForge lets you create or join a shared chapter — a workspace for a real-world networking group, with a shared member roster and referrals passed between chapter members. Shared chapters are multi-user by design, so data you place in one is visible to other people:

• Roster cards (name, company, profession, email, phone) are visible to every member of that chapter. Roster cards can describe people who do not have CyrForge accounts; if you add someone to a roster, you are the controller of that data in the sense described above, and it is your responsibility to have a lawful basis for sharing their details with your chapter.
• Referrals you pass — the description you write, their status, and any monetary value — are visible to the member you pass them to and to the chapter's administrators. Other members see only aggregate statistics: counts and closed-business values on the chapter leaderboard, never the referral's contents.
• Your personal CRM stays private. Joining a chapter never shares your personal contacts, referrals, notes, or any other data with the chapter. Passing a referral into a chapter is always an explicit action.

When you leave a chapter, your account is disconnected from it, but chapter data others rely on — roster cards and referrals already passed — remains with the chapter.

When you delete your account, we remove your membership from every chapter, disconnect your account from any roster cards, and replace your account identity on referrals and invites you created with an anonymous marker. Roster cards and referral records themselves remain with the chapter, in the same way a contact entry you gave another member would: they are the chapter's records about its business relationships, and its administrators can remove them. If you were a chapter's only member, the chapter and everything in it is deleted with your account; if a chapter you owned has other members, ownership passes to one of them.

Your data export includes your shared-chapter footprint — your memberships and roles, roster cards linked to your account, and referrals you authored — but not the rest of the chapter, which is other members' data.

Data Storage and Security

Data Storage

• Your data is stored on secure cloud servers
• We implement industry-standard encryption for data in transit and at rest
• Backup systems ensure data availability and recovery

Data Security Measures

• Encryption of sensitive data
• Secure authentication protocols
• Regular security audits and updates
• Access controls and monitoring
• Employee training on data protection

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

Subprocessors

We share data with a limited set of third-party service providers ("subprocessors") who assist us in operating the Service. Our current subprocessors are:

These providers are contractually obligated to protect your data and use it only for the purposes we specify. We do not permit them to use your data for their own purposes.

Anthropic and OpenAI appear on this list only because CyrForge lets you connect your own API key to those services. If you never enter one, no data reaches either company, and the AI features run on Google Vertex AI instead.

We will update this list at least 30 days before engaging a new subprocessor that processes personal data. Customers under our Data Processing Addendum may object within that period on reasonable data-protection grounds. To be notified of changes, contact [email protected].

Legal Requirements

We may disclose your information if required by law or in response to valid legal requests, court orders or subpoenas, or to protect our rights, privacy, safety, or property, or to investigate potential violations of our Terms of Service.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your information becomes subject to a different privacy policy.

Your Data Rights

Depending on your location, you may have the right to:

• Access copies of your personal data
• Correction of inaccurate or incomplete data
• Deletion of your personal data
• Export a copy of your data in a portable format
• Restriction of processing of your data
• Objection to our processing of your data
• Withdrawal of consent where processing is based on consent

To exercise these rights, contact us at [email protected]. We will respond to requests within 30 days.

Data Retention

We retain your information for as long as your account is open, and for as long as necessary after that to comply with legal obligations and to resolve disputes and enforce agreements.

You can delete your account yourself, at any time, from Settings inside CyrForge. Deletion is immediate and permanent rather than queued for later processing: we cancel your subscription, revoke CyrForge's access to your Google account at Google, remove you from any shared chapters (as described in the Shared Chapters section above), delete your CyrForge records — members, groups, regions, referrals, events and attendance — and then delete your sign-in credentials. You do not need to email us or wait for us to act, and account deletion is available even if your subscription has lapsed.

Three things survive deliberately. Stripe retains billing records it is required to keep for financial-compliance purposes. If you fill in the optional exit survey, your answers are kept to help us improve the product, stored under a randomly generated identifier and never linked to your account or email address — the account is being erased, so keeping feedback tied to it would undo the erasure. And if you participated in shared chapters, the chapter's own records remain with the chapter as described in the Shared Chapters section, with your account identity replaced by an anonymous marker.

Third-Party Links and Services

CyrForge may contain links to third-party websites or integrate with third-party services, including Stripe for payment processing. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

Children's Privacy

CyrForge is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will delete it promptly.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. We ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on our website, updating the "Last Updated" date, and, for material changes, sending an email notification. Your continued use of CyrForge after changes become effective constitutes acceptance of the updated policy.

California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, whether it is sold or disclosed (we do not sell personal information), the right to opt out of sale, the right to deletion, and the right to non-discrimination for exercising your rights.

European Union Privacy Rights

If you are in the European Union, you have rights under the General Data Protection Regulation (GDPR), including the right to access, rectify, erase ("right to be forgotten"), restrict processing, port your data, object to processing, withdraw consent, and lodge a complaint with a supervisory authority.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Elemental Genius LLC General enquiries: [email protected] Privacy and data requests: [email protected] Address: Brockport, NY 14420 Phone: 585-204-0942

For data protection inquiries — including access, correction, deletion, and portability requests — contact [email protected]. This inbox is monitored specifically for privacy requests and we respond within 30 days.

Consent

By using CyrForge, you acknowledge that you have read and understood this Privacy Policy and agree to its terms.

© 2026 Elemental Genius LLC. All rights reserved.