Privacy Policy
Effective June 1, 2026
Effective Date: June 1, 2026
Last Updated: July 5, 2026
Product: Forge — Field Service Platform
Operator: Kin Labs ("we," "us," "our")
Contact: [email protected]
1. Introduction
Forge is a field service management platform built for general contractors. It helps contractors manage jobs, clients, crew, time tracking, receipts, and invoicing — all in one place.
This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have over your data.
By using Forge, you agree to this policy. If you do not agree, please do not use the service.
2. Who This Policy Applies To
This policy applies to:
- Account owners and admins — the contractors or businesses that sign up for Forge
- Crew members — employees added to a Forge account by an owner or admin
- Visitors — people who visit forge.kin.team without signing in
Forge is a business-to-business (B2B) tool. We do not knowingly collect data from anyone under 18.
3. Information We Collect
3.1 Information You Provide Directly
- Account information: Name, email address, phone number, company name, business address
- Authentication data: OAuth tokens (Google Sign-In), hashed passwords if using email/password
- Tenant/company settings: Logo, invoice prefix, payroll jurisdiction, GST/business number, default terms
- Team data: Employee names, emails, roles, hourly rates, phone numbers
- Client data: Client names, billing addresses, contact information, QuickBooks customer IDs
- Job and project data: Job descriptions, scope of work, dates, locations, photos, notes
- Time entries: Clock-in/clock-out times, GPS coordinates at clock events (not continuous tracking), break minutes
- Receipts: Photos of receipts, extracted vendor/amount/date data (via OCR), expense categories
- Quotes and invoices: Line items, pricing, sent/approved status, linked QuickBooks invoice IDs
- Time-off requests: Dates, type, reason
3.2 Information Collected Automatically
- Usage data: Pages visited, features used, session duration, button clicks
- Device data: Browser type, operating system, screen size, IP address
- Performance data: API response times, error events (sent to Sentry — see Section 5)
- Server logs: Request timestamps, HTTP status codes
3.3 Information from Third-Party Integrations
When you connect third-party services, we receive data from them:
- QuickBooks Online: OAuth tokens (access and refresh), company Realm ID, QB customer IDs, QB item IDs, QB invoice IDs and document numbers. We pull item data for catalog mapping and push invoices and customer records.
- Microsoft Outlook (if connected): OAuth tokens (read-only
Mail.Readscope). We read email thread text to extract quote data. We do not store full email bodies beyond what is needed for a single extraction session. We do not send email on your behalf through Outlook. - Google (Sign-In): Name, email address, and profile picture from your Google account.
- Stripe: Subscription status, last 4 digits of card on file, billing history. We do not store full card numbers — Stripe handles payment processing.
4. How We Use Your Information
We use your information to:
- Provide the service: Run Forge, process your data, and deliver features you use
- QuickBooks sync: Push invoices, customer records, and expenses to QuickBooks on your behalf
- Email extraction: Extract quote data from Outlook email threads you select
- AI features: Pass job/client/invoice data to AI models to answer your queries and automate actions. Data sent to AI is limited to what is needed for the query. Crew member data is not sent to AI.
- Payroll calculations: Calculate overtime and gross pay using time entry data and jurisdiction rules
- Notifications: Send transactional emails (via Resend) and SMS (via Twilio) — invoice sent, time-off decision, forgot-to-clock-out alerts
- Error monitoring: Log errors and performance events to Sentry to maintain service reliability
- Billing: Manage your Forge subscription through Stripe
- Security: Detect abuse, fraud, and unauthorized access
- Support: Respond to questions and resolve issues
- Service improvements: Understand how Forge is used to prioritize new features (using anonymized, aggregated data only)
We do not use your data for advertising. We do not sell your data to third parties.
5. Third-Party Service Providers
We share data with the following processors to operate Forge:
| Provider | Purpose | Data Shared |
|---|---|---|
| Intuit (QuickBooks) | Accounting integration | Invoice data, customer records, expense records |
| Microsoft (Graph API) | Email extraction (if connected) | Email thread text (temporary, per-extraction) |
| Stripe | SaaS subscription billing | Name, email, payment method token |
| Resend | Transactional email | Recipient email, email body |
| Twilio | SMS notifications | Phone number, message body |
| Cloudflare R2 | File storage (photos, receipts) | Files you upload |
| Sentry | Error monitoring | Error events, stack traces, request metadata |
| Inngest | Background job processing | Job payloads (time entry data, sync events) |
| Hetzner | Cloud hosting (servers + database) | All application data (stored in Ashburn, Virginia, USA) |
All providers are bound by data processing agreements. We do not use providers that sell data.
6. Data Storage and Security
- Storage location: Data is stored on servers operated by Hetzner in Ashburn, Virginia, USA. Backups are retained for 30 days.
- Encryption in transit: All data is transmitted over HTTPS/TLS.
- Encryption at rest: OAuth tokens (QuickBooks, Microsoft) are encrypted using AES-256-GCM before storage.
- Access control: Row-level security (RLS) is enforced at the database layer. Each company's data is strictly isolated — no tenant can access another tenant's data.
- Authentication: Google OAuth or email/password with bcrypt hashing. Sessions expire after inactivity.
- Employee access: Kin Labs personnel access customer data only as needed for support or debugging, and only with logging.
No system is 100% secure. In the event of a data breach that affects your rights, we will notify you as required by applicable law.
7. Data Retention
| Data type | Retention period |
|---|---|
| Active account data | Retained while account is active |
| Deleted account data | Permanently deleted within 90 days of account closure |
| Time entries | Retained for 7 years (payroll compliance) |
| Invoices | Retained for 7 years (accounting compliance) |
| Audit logs | Retained for 3 years |
| Receipts (images) | Retained while account is active; deleted on account closure |
| Email thread extractions | Deleted immediately after quote is created or session ends |
| Server logs | 90 days |
| Error logs (Sentry) | 90 days |
8. GPS and Location Data
Forge captures GPS coordinates at clock-in and clock-out events only. We do not track continuous location while crew members are clocked in.
Location data is used to:
- Help owners verify crew arrived at the job site
- Auto-detect potential GPS spoofing (soft warning only — no automatic action)
Location data is visible to account owners and admins. Crew members can see their own clock-in/out locations. Location data is deleted when the associated time entries are deleted.
9. AI Features
Forge uses AI (Anthropic Claude) to power its assistant features. When you use the AI assistant:
- The contents of your query and relevant Forge data (job details, invoice summaries, etc.) are sent to Anthropic's API to generate a response.
- We do not send bulk data to AI models — only what is needed for the specific query.
- AI features are available to account owners and admins only. Crew members do not have AI access.
- Every AI query is logged in Forge's audit log (what was asked, which tools were called, token count, cost). This log is visible to account owners.
- We use prompt caching to minimize data sent to AI on repeated queries.
- Anthropic's data handling is governed by Anthropic's Privacy Policy.
- Data transfer note: AI queries are processed by Anthropic's API, which operates in the United States. By using AI features, you consent to your query data being transferred to and processed in the US.
10. Your Rights
Depending on your jurisdiction, you may have the following rights:
- Access: Request a copy of your personal data
- Correction: Request that inaccurate data be corrected
- Deletion: Request deletion of your personal data (subject to legal retention requirements)
- Portability: Request your data in a machine-readable format
- Objection: Object to certain uses of your data
- Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time
Canadian users (PIPEDA / Alberta PIPA): You have the right to access your personal information and request correction of inaccurate information. Contact us at [email protected]. If you receive commercial electronic messages from Forge, you may unsubscribe at any time — we comply with Canada's Anti-Spam Legislation (CASL).
EU/EEA users (GDPR): Our legal basis for processing is (a) contract performance for service delivery, (b) legitimate interests for security and service improvement, and (c) consent for optional integrations (QuickBooks, Outlook). You have the right to lodge a complaint with your supervisory authority.
To exercise any of these rights, email [email protected]. We will respond within 30 days.
11. Cookies and Tracking
Forge uses:
- Session cookies: Required for authentication. Cannot be disabled.
- Preference cookies: Store your theme preference (light/dark). Can be cleared via browser settings.
We do not use advertising cookies, cross-site tracking pixels, or third-party analytics that sell data. If we add analytics (e.g., Plausible), it will be privacy-preserving and disclosed here.
12. Children's Privacy
Forge is designed for business use and is not intended for anyone under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with data, contact us at [email protected].
13. Changes to This Policy
We may update this policy from time to time. If we make material changes, we will notify account owners via email at least 14 days before the change takes effect. The updated policy will be posted at forge.kin.team/privacy with a new "Last Updated" date.
Continued use of Forge after the effective date constitutes acceptance of the updated policy.
14. Contact
Kin Labs
Email: [email protected]
Website: forge.kin.team
Mailing address: Edmonton, Alberta, Canada (full address available on request)
For privacy-specific requests: [email protected] (subject line: "Privacy Request")