Privacy Policy

Effective date: 11 October 2026

1. Who we are
2. What we collect
3. How and why we use it
4. Data you store in your workspace
5. Who we share it with
6. Overseas transfers
7. How long we keep it
8. Security
9. Your rights
10. Cookies
11. Age limit
12. Complaints
13. Changes to this policy

1. Who we are

This policy applies to the NiftyForger website and web application (the "Service"), provided by NiftyForger, operated by a sole trader based in Victoria, Australia ("NiftyForger", "we", "us"). We are responsible for the personal information described here. Under the EU and UK General Data Protection Regulation (GDPR), this makes us the "controller".

Contact us about privacy at contact@niftyforger.com or through our contact form. If you need our full legal identity, for example for a formal complaint or legal process, ask at that address and we will provide it.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). Where the GDPR or UK GDPR applies to you, we also meet their requirements.

2. What we collect

Information you give us

• Account details: your email address and password. We store your password only as a secure one-way hash, never in readable form.
• Team members: the email addresses of any users you invite to your workspace.
• Contact messages: your email address, subject and message when you use the contact form. We need the email address to reply.
• Workspace content: the parts, categories, assemblies, suppliers, purchase orders, sales orders and other records you create (see section 4).

Information created when you use the Service

• Account records: when you signed up, when you last logged in, whether your email is verified, failed login attempts and temporary account lockouts, and which version of our Terms you accepted and when.
• Subscription records: your plan, subscription status, billing period dates, scheduled plan changes and cancellation dates.
• Emails we send you: a record of account emails (verification, password reset, activation) and whether they were delivered.
• Technical data: your IP address and basic request details, such as the page requested and your browser type. These are handled by our servers and security tools to deliver pages, limit abuse (rate limiting) and keep server logs. We do not store IP addresses in your account record.
• Website analytics: Cloudflare Web Analytics records anonymous statistics about page visits, such as the page viewed, the referring website, your browser and device type, your country and how quickly the page loaded. It sets no cookies, and we can't use it to identify you.
• AI assistant conversations: if you use the AI assistant, the messages you send it and its replies, a note of how many photos and documents you sent with a message (not the photos or documents themselves, which we don't keep), including the workspace records it looks up to answer you, the changes it proposes and whether you applied or cancelled them, and a monthly count of your workspace's assistant requests and the amount of text processed for them, for your plan's limit and our costs.
• Error diagnostics: when something breaks, technical details of the error, such as the page, browser and error message, are sent to our error-monitoring provider. We don't send your name or email address with them.

Information from third parties

• Payments: our payment processor, Stripe, tells us whether a payment or subscription change succeeded and gives us customer and subscription identifiers. We never receive or store your full card details. Stripe collects those directly under its own privacy policy.
• Bot protection: Cloudflare Turnstile tells us whether a sign-up, login or password-reset attempt appears to come from a human.

3. How and why we use it

We don't send marketing emails. If we ever do, we will ask for your consent first where the law requires it, including under the Spam Act 2003 (Cth), and every message will include a way to unsubscribe. We don't use your information for automated decisions that have legal or similarly significant effects on you.

4. Data you store in your workspace

Your workspace may contain personal information about other people, such as supplier contacts or customer details on sales orders. For that information, you (or your organisation) decide what is collected and why, and we process it only to provide the Service to you. You are responsible for having the right to store that information and for giving those people any notices the law requires. We do not use workspace content for any other purpose.

When someone in your workspace uses the AI assistant, the assistant looks up the workspace records it needs to answer them, and those records are sent to Anthropic (see section 5) along with the question and which page and record they have open.

You can send the assistant photos with a message, for example of parts, their labels or a supplier's packing slip, so it can propose adding them to your workspace. A photo is sent to Anthropic with that message and used to answer it. While you keep the chat open, your browser sends your most recent photos to Anthropic again with your later messages, so the assistant can still see them when you follow up. Reloading the page or starting a new chat stops that. We don't store your photos: not with your conversation, not as a picture of a part, and not anywhere else. Like any photo, it can show more than you meant to, so check what's in the frame before sending. You can also send PDF documents, such as a supplier's invoice, packing slip or datasheet, and they are handled exactly as photos are: sent to Anthropic with that message, sent again with your later messages while the chat stays open, and never stored by us. It can read only your own workspace, and only what the person using it is allowed to see.

The assistant can also propose changes to your workspace: creating, changing or deleting records such as parts, stock, suppliers and orders. It changes nothing by itself. The proposed changes are shown to the person who asked for them, who can review and edit them, and nothing is saved until they click Apply. It can propose only changes that person is allowed to make, and once applied, the changes are saved just as if that person had made them in the app.

5. Who we share it with

We do not sell or rent personal information, and we don't share it for advertising. We share it only with the service providers below, and only as needed to run the Service. They may use it only to provide their services to us.

We may also disclose information if the law requires it, to protect our rights or the safety of others, or to a buyer or successor if the Service is transferred. If the Service is transferred, this policy continues to apply to your information.

6. Overseas transfers

We are based in Australia, but most of our service providers store or process information outside Australia, mainly in the United States. Before disclosing information overseas, we take reasonable steps to make sure the recipient handles it consistently with the Australian Privacy Principles, as Australian Privacy Principle 8 requires.

If you are in the European Economic Area, the United Kingdom or Switzerland, your information is transferred to Australia and the United States. These transfers rely on an adequacy decision where one exists, or on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK equivalent) included in our providers' data processing terms. You can ask us for more information about these safeguards.

7. How long we keep it

• Account and workspace data: while your account is open. A workspace owner can delete their account from their profile at any time, which removes the account, its team members and all of the workspace's data straight away. If you ask us to close your account instead, we delete it within 30 days. In both cases we keep only what we must for legal reasons (below), and copies in backups are overwritten on our providers' normal backup cycles.
• Billing and transaction records: for at least 5 years after the transaction, as Australian tax law requires. Stripe also keeps payment records under its own legal obligations.
• Contact messages and email delivery records: for as long as we need them to respond to you and keep a record of our correspondence. We review them periodically and delete those we no longer need.
• AI assistant conversations: we don't keep the photos or documents you send the assistant once it has answered the message they came with. We delete a conversation 30 days after its last message, and deleting your account deletes them straight away. Anthropic deletes what it receives within 30 days, unless it flags a request for breaching its usage policy (it may then keep it for up to 2 years) or the law requires it to keep it longer.
• Server logs and error diagnostics: for the limited periods our hosting and monitoring providers keep them.

8. Security

We protect personal information with measures that include:

• encryption in transit (HTTPS)
• hashed passwords and secure, HTTP-only session cookies
• protection against cross-site request forgery
• rate limiting, temporary lockout after repeated failed logins, and bot protection
• separation of each customer's workspace data

No system is perfectly secure. If a data breach is likely to cause you serious harm, we will notify you and the relevant regulators as the law requires.

9. Your rights

Subject to the law that applies to you, you can ask us to:

• access the personal information we hold about you
• correct information that is inaccurate, out of date or incomplete
• delete your information or close your account — a workspace owner can do this immediately in their profile
• export your information in a portable format — a workspace owner can download their workspace's data as CSV files in their profile
• object to or restrict our use of your information, including uses based on legitimate interests

You can change your password in your profile, and if you own a workspace you can download a copy of its data, or delete your account and everything in it, there too. For anything else, including changing your account email, email contact@niftyforger.com from the email address on your account. We may need to verify your identity. We aim to respond within 30 days and don't charge for reasonable requests.

If you are a team member in someone else's workspace, requests about that workspace's content may need to go to the workspace owner, and we may pass your request on to them.

Anonymity: you can browse our public pages without giving your name or email. To use the contact form or create an account, we need an email address.

10. Cookies

We use only cookies and browser storage that are strictly necessary to operate the Service or that remember choices you make in the app. We don't use analytics or advertising cookies: our website analytics, Cloudflare Web Analytics, sets none. Details are in our Cookie Policy.

11. Age limit

The Service is for people aged 18 and over. We don't knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us information, contact us and we will delete it.

12. Complaints

If you have a concern about how we handle your information, please contact us first at contact@niftyforger.com. We will try to resolve it within 30 days.

If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC). If you are in the EEA or UK, you can also complain to your local data protection authority, for example the UK Information Commissioner's Office.

13. Changes to this policy

We may update this policy from time to time. The effective date at the top shows when it last changed. If we make significant changes, we will tell account holders by email or in the app before the changes take effect.