Privacy Policy

01

About this policy

ForgeCall is a business phone service made by ForgeOS: calls, texts and WhatsApp, voicemail that's transcribed and summarised, follow-ups, team chat and an AI receptionist, on one business number. In this policy, "ForgeOS", "we", "us" and "our" mean ForgeOS Pty Ltd (ABN 33 697 659 902), the Australian company that provides ForgeCall. "You" means the person reading it, whether you run a business on ForgeCall, work in one, or are one of its customers.

This policy covers ForgeCall on the web, the ForgeCall apps for iPhone and Android, our websites, and any time you contact us. It explains how we handle personal information under the Australian Privacy Principles in the Privacy Act 1988 (Cth), and, where they apply to you, the UK and EU General Data Protection Regulation, US state privacy laws including California's, and Canada's Personal Information Protection and Electronic Documents Act.

Words we use

• Account: a business's ForgeCall subscription, including everyone on its team.
• Account owner: the person who created the account, and anyone they give the owner or manager role.
• Team member: anyone who signs in to a business's account.
• Customer content: what a business puts through ForgeCall about its own customers and work: calls and recordings, transcripts and summaries, voicemails, texts and WhatsApp messages, team chat (including the photos, videos and voice clips sent in it), meetings in Meeting rooms (their recordings, transcripts and Minutes, and guests' phone numbers and email addresses), contacts, follow-ups, notes and job numbers.
• Personal information: information about an identified person, or a person who can reasonably be identified. Some laws call it personal data.

02

Who is responsible for what

ForgeCall handles two kinds of information, and responsibility for each is different.

Your account, and how you use ForgeCall

For information about account owners and team members (names, sign-in details, business details, billing and how you use ForgeCall), ForgeOS decides how it's used. We're responsible for it as the controller, or "APP entity" under Australian law, and this policy applies in full.

Customer content

Customer content belongs to the business that collected it. The business decides whose calls to take, what to record, which contacts to import and what to keep. For customer content, the business is the controller and ForgeOS processes it on the business's behalf and on its instructions, under our Terms of Service and, where it's needed, a data processing agreement. We don't use customer content for our own purposes except as this policy describes: to provide, secure and support ForgeCall.

If you're a customer of a business that uses ForgeCall, that business's own privacy policy applies to how it handles your information. Section 15 explains what that means for you and how we help.

03

Information we collect

We collect only what's needed to provide ForgeCall and meet our legal obligations. Here's all of it, by where it comes from.

Information you give us

Customer content you create using ForgeCall

When the features that create them are switched on for your account, ForgeCall stores:

• Call records: the numbers involved, time, duration, direction, which number and team member handled the call, the outcome, and any transfer.
• Call recordings, when recording is turned on for your account.
• Transcripts, summaries and live notes made from calls and voicemails, with detected intent, urgency and a mood score (positive, neutral or negative).
• Voicemails: the audio, its transcript and summary, and the call-back time the caller asked for.
• Texts and WhatsApp messages, including photos and videos sent by text (MMS), and their delivery status. A video your team sends a customer goes as a private link that plays without signing in, for 90 days; anyone the customer passes the link to can watch it.
• Team chat messages between your team members, and the photos, videos and voice clips sent in them, with their captions. When one team member calls another in ForgeCall, the chat records when, who and how long, not the conversation. If the call isn't answered, the caller can leave a voicemail, which is kept in their chat as a voice clip with its transcript.
• Meetings, if your business turns on Meeting rooms: who joined and when, the meeting's recording, its transcript, the Minutes drafted from it, and the chair's changes to them. Guests are people from outside the business who join a meeting; for them we hold their phone number, what they said, and, only if the chair adds it so they can be sent the Minutes, their email address. A guest's details are kept with that meeting and are never added to the business's contacts.
• Notes your team writes on a conversation with a customer, which the customer never sees, and who in your team each note mentions.
• An audit trail: a record of each call, text, voicemail, team chat message and note, saying when, who, which number and what was said, kept even when a message or note is later deleted.
• Contacts you add by hand, import from a spreadsheet, or pick from your phone's contacts (only the ones you choose; ForgeCall never reads your whole address book).
• Follow-ups, notes, job numbers and call-quality ratings.
• AI receptionist conversations: what callers said, what it answered, and what it did (for example, booking an appointment or taking a message).

Information collected automatically

• Sign-in and session: a session identifier stored in a secure cookie (see section 13), the time you signed in, and the sign-in method.
• Device and log information: IP address, browser and operating system, app version, the pages and actions requested, error reports and timestamps. We use your IP address to work out an approximate location (country or city) for security, and never your precise location.
• Usage information: which features are used and how often, such as the number of calls, texts and AI minutes, so we can bill correctly and see what to improve.

Information from other companies, at your direction

• Google: if you choose Continue with Google, Google tells us your name, email address, whether that email is verified, and your profile photo. We don't receive your Google password or anything from your Google account beyond that.
• Calendars and contacts: if you connect Google Calendar, Google Contacts or Microsoft 365, we receive the calendar or contact details needed for the feature you turned on, and only while it's connected.
• How we treat information from Google: we use it only to sign you in and, if you connect them, for the calendar and contacts features you turned on. We never use it to train AI models, never sell it, and never use it for advertising. ForgeCall's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• CRM and job tools: if you connect a tool such as HubSpot, ServiceM8 or Jobber, we exchange the contact and job details needed to match calls to customers.
• App stores: if you subscribe in the iPhone or Android app, Apple or Google tells us whether your subscription is active. They handle your payment, not us.
• Carriers: when a call or text passes through the phone network, the carrier gives us technical details such as caller ID and delivery status.

Sensitive information

We don't ask for sensitive information, such as health information, racial or ethnic origin, religious or political views, or biometric information. We don't create voiceprints or use voices to identify people. Callers can still mention sensitive things in a call, a voicemail or a message. When they do, it's handled like the rest of the customer content: kept secure, used only to provide the service, and controlled by the business.

If you choose not to give us information we ask for, we may not be able to provide some or all of ForgeCall. For example, we can't issue a phone number without the business details regulators require.

04

How we use information

We use personal information only for these purposes:

• To provide ForgeCall: connecting and recording calls, delivering texts, transcribing and summarising voicemail, recording and transcribing meetings and drafting their Minutes, running the AI receptionist, scheduling follow-ups, showing your analytics, and everything else the app does for you.
• To run your account: signing you in, managing your team and permissions, and applying your settings.
• To bill you: working out usage, enforcing your spend cap, sending low-credit alerts and invoices.
• To support you: answering questions and fixing problems you report.
• To keep ForgeCall safe: detecting and stopping fraud, spam, robocalls, account takeover and abuse of the phone network, and protecting our systems and other customers.
• To improve ForgeCall, internally, as explained in section 5.
• To train ForgeCall's AI, only if you've said yes, as explained in section 7.
• To tell you about ForgeCall: service messages you need to receive, and marketing you can turn off (section 16).
• To meet our legal obligations: regulatory requirements for phone numbers, tax and accounting records, and valid requests from law enforcement or courts (section 9).

If we want to use personal information for a purpose that isn't related to these, we'll ask you first, unless the law allows or requires it.

05

Improving ForgeCall

We collect and analyse information internally to make ForgeCall better, and this work stays inside ForgeOS. We don't share it with other companies, and we don't sell what we learn.

What we use

• Usage and diagnostic information: which screens and features are used, where people get stuck, error reports and performance measurements.
• Aggregated and de-identified information: totals and patterns that don't identify you, your team or your customers, such as "average time to answer across all accounts" or "how often callers ask for weekend appointments".
• Feedback you send us, including call-quality ratings and the issues you tick.

What we don't do

• We don't listen to your calls or voicemails, or read your texts or team chat, to improve the product. People at ForgeOS see customer content only when you ask us to (for example, to look into a support problem), to investigate security incidents, fraud or abuse, when the law requires it, or, if you've said yes to AI training, to check the quality of examples that have had personal details removed. That access is limited, recorded, and reviewed.
• We don't use your customer content to train AI unless you've said yes (see section 7), and we never let other companies, including our providers, train their AI on it.
• We don't use your information to build advertising profiles, and we don't combine it with information bought from data brokers.

Some features improve for your own account by using your own content. For example, after each call the AI receptionist checks what it couldn't answer and suggests a change for you to approve. Those suggestions stay in your account.

When we de-identify information, we remove or change details so it can't reasonably be linked back to a person, and we don't try to re-identify it.

06

Legal bases for using information (UK and EU)

If the UK or EU GDPR applies to you, we rely on these legal bases:

For customer content, we process information on the business's instructions, and the business is responsible for having a legal basis.

07

AI features and training

Some ForgeCall features use artificial intelligence: turning speech into text, summarising calls and voicemails, drafting the Minutes of meetings, estimating a caller's mood, suggesting follow-ups, and the AI receptionist, which answers calls in a natural voice when you can't.

• They're optional. Businesses choose which AI features to turn on, and can turn them off at any time.
• Providers only do the job. We send our AI, transcription and voice providers the minimum needed to produce a result, and they process it only to give that result back to us.
• Providers never train on your content. We choose providers and settings that exclude our customers' data from training, and our contracts limit them to providing the service.
• We train ForgeCall's own AI only if you say yes. See below.
• AI can be wrong. Transcripts, summaries and mood scores are machine-generated and can contain mistakes. Check anything important against the recording or message.
• A person approves every set of Minutes. AI drafts them from the meeting's transcript; only the meeting's chair sees the draft, and nothing is posted or emailed until the chair has checked and approved it. If the AI can't draft them, the chair writes them.
• No decisions about people are automated. ForgeCall doesn't use AI to make decisions that have legal or similarly significant effects on anyone. A mood score is a prompt for your team to follow up, never a judgement about a person.
• Callers can be told. The AI receptionist introduces itself by the name you choose, and businesses should make sure callers know when they're speaking with an automated assistant.

Training ForgeCall's AI, only if you say yes

Real calls and messages are the best way to make ForgeCall's AI better: transcripts that get Australian accents and trade terms right, summaries that pick out what matters, and an AI receptionist that answers more questions correctly. We use them for this only with your permission.

• Off unless you say yes. We ask with a tick box when you sign in. It starts empty, and ForgeCall works exactly the same whether you tick it or not.
• What your answer covers. The calls, recordings, voicemails, transcripts, texts and AI receptionist conversations that you make, take or handle in ForgeCall, and the corrections you make to transcripts and summaries. It never covers team chat, meetings, your contacts, billing details, or anything we receive from Google.
• Personal details removed first. Before anything is used for training, we remove or replace names, phone numbers, email and street addresses, card and bank details, and other details that identify people. Training copies are kept apart from your account, and only the ForgeOS staff who work on our AI can access them.
• Voices are never copied. Audio is used only to make speech recognition more accurate. We never use it to clone or imitate anyone's voice, or to recognise who is speaking.
• It stays with ForgeOS. The training data, and the AI models trained with it, are used only for ForgeCall. We don't sell them or share them with other companies. If we use another company's computers to run training, it acts only on our instructions, under contract, and can't keep or use the data for itself.
• Change your mind any time. Turn it off in Settings → Privacy. From then on nothing new of yours is used, and the training copies made from your calls and messages are deleted within 30 days. A model that has already been trained can't unlearn individual examples, but because personal details were removed first, it doesn't hold information that identifies you.
• A record of your choice. We keep a record of each time you say yes or no: when, where, and which version of this policy was in force.

08

Recording calls and meetings, and your customers

Laws about recording and transcribing calls differ between countries and, in Australia and the US, between states. Some require the other person to be told, and some require their consent. A business that turns on recording, transcription, live notes or the AI receptionist is responsible for following the laws that apply to its calls.

ForgeCall helps by:

• reminding whoever takes a recorded call, on their screen, to tell the other person it's being recorded. ForgeCall doesn't play an automatic announcement;
• letting owners turn recording on or off for each number and each team;
• keeping recordings for 12 months, then deleting them automatically (section 11), and letting owners delete one sooner;
• keeping recordings inside your account: owners and managers can play and download them, and other team members can only play recordings of their own calls.

Meetings in Meeting rooms are always recorded and transcribed: that's what they're for. So ForgeCall:

• plays a spoken notice to everyone, staff and guests, as they join and before they're connected: "This meeting is recorded and transcribed, and its Minutes are written from it." Someone who doesn't agree can hang up before being connected;
• lets only an account owner turn Meeting rooms on, and keeps them off until they do;
• keeps a meeting's recording only until its Minutes are approved, and never more than 30 days;
• lets the room's members play the recording, and owners and managers download it;
• sends the Minutes only to the staff who attended, the guests the chair chooses, and, if the chair says the meeting was about a customer, that customer's conversation in ForgeCall.

A business that invites guests to a meeting is responsible for having a reason to record them and for answering their questions about it. Guests can also contact us (section 20).

09

When information leaves ForgeCall

We keep your information inside ForgeCall. It goes to another company only in the situations listed below, and never for that company's own purposes.

What we never do

• Sell or rent personal information, or trade it for anything of value.
• Share it with other companies for their own marketing or advertising, or for targeted or cross-context behavioural advertising.
• Give it to data brokers, or buy information about you from them.
• Let our service providers use it for anything other than providing ForgeCall.

Service providers that run parts of ForgeCall

Like every phone service, ForgeCall relies on specialist providers for things like phone networks, hosting and payments. They act on our instructions, under contracts that require them to protect the information, use it only to provide their service to us, and delete or return it when they no longer need it. A provider receives information only when the feature it supports is switched on.

Amazon Web Services also sends ForgeCall's emails, including meeting Minutes to the people the chair chooses.

We'll update this list before we start using a new provider that handles personal information. Businesses that need advance notice of changes can ask us for it.

Inside your business's account

Information in an account is visible to that account's team according to the roles and permissions the account owner sets.

• Conversations with customers are shared with the whole team. Every member can see the account's texts with customers (with any photos and videos), its calls and voicemails, and the team's notes on them. Each person sees the conversations they're working on first, but nothing is hidden from the rest of the team.
• Team chats can be read by everyone in the account, including a chat between two colleagues. Only the people in a chat can post in it, and only they are told about new messages. ForgeCall tells each person this when they start using chats.
• Meetings are part of their room's chat. Everyone in the account can read a meeting's transcript and its approved Minutes. The room's members can play its recording, and owners and managers can download it. Only the chair sees draft Minutes.
• Owners and managers can export a customer's whole conversation as a spreadsheet, or as a page to print or save as PDF, and the team's notes for a period as a spreadsheet.

If you turn on email copies, summaries of calls, texts or voicemails are emailed to the addresses you choose.

Carriers and regulators

To issue and keep phone numbers, we give carriers and telecommunications regulators the business details they require, such as the ACMA in Australia, the FCC in the US, the CRTC in Canada and Ofcom in the UK. We also register the business's texting sender details where the rules require it (for example, US 10DLC registration). Calls and texts travel through the phone networks of other carriers, like any call.

Tools you connect

If you connect ForgeCall to another service, such as a calendar or a CRM, we send it the information that connection needs. That service's own privacy policy then applies to what it receives. You can disconnect at any time.

An account owner can set up a CRM webhook: each note the team writes on a customer conversation is then sent to the web address the owner gives, with who wrote it, who it mentions, and the customer's name and phone numbers, so their own system can file it. Each one is signed so their system knows it came from ForgeCall. The owner can change or remove it at any time.

Cleaning up your data when you join

When a business starts using ForgeCall, it can ask us to bring across the contacts and notes from the system it used before. This is optional, and we do it only with the business's written agreement. We review each contact and note using Anthropic's AI, through its business service, where what we send isn't used to train its models. We send only the contacts and notes the business gives us for this, show the business a sample before anything is added to its account, and keep nothing afterwards except the cleaned result in its account.

When the law requires it

We disclose information to police, courts, regulators or other authorities only when we're legally required to, or when it's needed to prevent a serious threat to someone's life, health or safety. We check that every request is valid, disclose only what's required, and tell the affected business or person unless the law or the circumstances don't allow it.

If ForgeOS changes hands

If ForgeOS is involved in a merger, acquisition or sale of assets, information may pass to the new owner as part of that deal. The new owner will have to keep protecting it as this policy describes, and we'll tell you before your information becomes subject to a different privacy policy.

With your permission

We share information in other ways only if you ask us to or agree to it.

10

Where information is stored

ForgeCall's servers, databases and files run on Amazon Web Services in Sydney, Australia. Account, business and team information is stored there, and so is customer content as it moves to our servers.

Photos, videos and voice clips sent in team chat are kept in their own private storage in Sydney, separate from voicemails and call recordings. Only people in the business's account can open them, through links that stop working after 15 minutes. Someone who leaves the account can no longer open them.

Photos and videos sent by text pass through Twilio in the United States on the way. When a customer texts one to a business, ForgeCall copies it to the same private storage in Sydney and then deletes it from Twilio. When a business texts a photo, Twilio fetches it from Sydney to deliver it, and ForgeCall deletes Twilio's copy once it has been delivered. A video sent to a customer goes as a link to the copy in Sydney: anyone with the link can play it until it expires after 90 days.

Some of the information you enter in the ForgeCall web app, such as contacts and follow-ups, is currently also saved in your browser's storage on your own device. It stays there until you sign out and another account signs in on that device, or you clear it (see section 13).

Some of the providers in section 9 process information outside Australia, mostly in the United States. When information goes overseas, we take reasonable steps to make sure it's protected to the standard of the Australian Privacy Principles. That means contracts with privacy and security obligations and, for information from the UK or EU, the standard contractual clauses (with the UK Addendum) or another transfer mechanism the law recognises. You can ask us for a copy of the relevant safeguards.

11

How long we keep it

We keep information only as long as we need it for the purposes in this policy, or as long as the law requires. Then we delete it, or de-identify it so it no longer identifies anyone.

We may keep information longer if we have to for a legal claim or a regulator's or court's requirement, and only for that purpose.

12

How we protect it

We protect information with technical, physical and organisational measures that suit how sensitive it is:

• Encryption in transit: every connection to ForgeCall uses HTTPS, and browsers are told to always use it.
• Encryption at rest: databases and file storage are encrypted, and the keys ForgeCall uses for outside services are kept encrypted with AWS Key Management Service. Once a key is saved, the admin console never shows it again, only its last four characters.
• Secure sign-in: sign-in goes through Amazon Cognito, or Google if you choose it, using modern standards (OAuth 2.0 with PKCE). ForgeCall never sees or stores your password.
• Protected sessions: your session is a long random token in a cookie that page scripts can't read and that's only sent over HTTPS to ForgeCall. We store only a one-way fingerprint (a hash) of it, so even our database can't be used to sign in as you.
• Least access: our systems and staff get only the access they need. Changes to ForgeCall's own settings are limited to named administrators and recorded.
• Browser protections: strict security headers stop other websites from framing ForgeCall or loading scripts into it.
• Payments: card details are handled by Stripe, which is certified to PCI DSS Level 1. ForgeCall never stores full card numbers.
• People: everyone at ForgeOS who can access personal information is bound by confidentiality, and access to customer content is limited and recorded.

No system is perfectly secure. You can help by using a strong, unique password (or Continue with Google with two-step verification turned on), signing out on shared devices, and giving team members only the permissions they need.

13

Cookies and device storage

ForgeCall uses only what it needs to work. We don't use advertising cookies, cross-site tracking, social media pixels or third-party analytics.

Our sign-in pages, run by Amazon Cognito and Google, set their own essential cookies while you sign in. Because ForgeCall uses only essential cookies, there's nothing to opt out of. Blocking them will stop you signing in. We treat Global Privacy Control and similar browser signals as a request to opt out of sale and sharing, which we don't do anyway.

If we ever add optional cookies or analytics, we'll update this policy first and, where the law requires, ask for your consent.

14

Your choices and rights

For everyone

Wherever you live, you can ask us to:

• show you the personal information we hold about you, and how we've used it;
• correct information that's wrong, out of date or incomplete (much of it you can change yourself in Settings);
• give you a copy of your information in a common, machine-readable format;
• delete your information, or close your account;
• change your answer about AI training, any time, in Settings → Privacy;
• stop marketing emails, using the link in any of them;
• explain anything in this policy.

We may need to keep some information where the law requires it, for example billing records, and we'll tell you if that's the case. Team members' information in a business account is managed by the account owner, so we may pass your request to them.

Australia

Under the Australian Privacy Principles you can access and correct your personal information (APPs 12 and 13), and you can deal with us anonymously or under a pseudonym where that's practical, although running a phone service needs to know who the business is. If you're not satisfied with how we handle a complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

United Kingdom and European Union

You also have the right to object to processing based on legitimate interests, to restrict processing, to data portability, to withdraw consent at any time, and not to be subject to decisions based solely on automated processing that significantly affect you (ForgeCall makes none, see section 7). You can complain to your local data protection authority, such as the Information Commissioner's Office in the UK (ico.org.uk). If the law requires us to appoint a representative in the UK or EU, we'll name them here.

United States, including California

Residents of California and other states with privacy laws can ask to know, access, correct and delete their personal information, and to receive a portable copy.

• Categories we collect: identifiers (name, email, phone number, IP address); commercial information (plan and billing history); internet activity (how ForgeCall is used); approximate location (from IP address); audio and electronic information (call recordings, voicemails and messages, when those features are on); professional information (business details and your role); and inferences (mood scores from calls). Section 3 describes where each comes from, section 4 why we use it, and section 11 how long we keep it.
• Sensitive personal information: your sign-in credentials and the contents of calls and messages. We use these to provide ForgeCall and, only if you've said yes, with personal details removed, to train ForgeCall's AI. We never use them to infer characteristics about you.
• No sale or sharing: we don't sell personal information or share it for cross-context behavioural advertising, and we haven't done so in the past 12 months. We don't knowingly sell or share the information of anyone under 16.
• Disclosures for business purposes: in the past 12 months we've disclosed the categories above only to the service providers in section 9, for the purposes described there.
• No discrimination: exercising your rights won't change the price or quality of the service you receive.
• Authorised agents: someone you authorise can make a request for you. We'll ask for proof that they're allowed to, and may ask you to confirm your identity with us directly.
• Appeals: if we decline your request, you can appeal by replying to our decision. If you're still not satisfied, you can contact your state attorney general.

Canada

You can access and correct your personal information and withdraw consent, subject to legal and contractual limits. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

How to make a request

Email us at ops@forgeos.tech, or write to us at the address in section 20. You can also delete much of your information yourself inside ForgeCall. We'll confirm who you are before acting, usually by asking you to reply from the email address on your account, and we'll respond within 30 days. If a request is complex, we'll tell you why we need longer, and it will be no longer than the law allows. Requests are free. If a request is clearly unfounded or excessive, we may refuse it or charge a reasonable fee, and we'll explain why.

15

If you called a business that uses ForgeCall, or joined one of its meetings

If you phoned, texted or left a voicemail for a business that uses ForgeCall, or joined a meeting it held in ForgeCall as a guest, the business decides how your information is used, and its own privacy policy applies. ForgeOS stores and processes that information for the business, on its instructions.

• To see, correct or delete information about you, contact the business first. It can do most of this itself in ForgeCall.
• If you contact us instead, we'll pass your request to the business and help it respond. We can't usually act on a caller's request ourselves, because the information belongs to the business.
• If you don't want your call recorded, tell the business when you call, or ask whether it offers another way to reach it.
• A photo or video you text to the business is kept for 90 days, as section 11 describes. A video the business texts you is a link that works for 90 days.
• If the business has said yes to AI training, recordings and messages from your calls may be used, with your personal details removed, to improve ForgeCall's AI. Ask the business, or email us, and we'll leave your calls out.
• If you joined a meeting, you heard that it was recorded before you were connected. Its recording is deleted when the business approves the meeting's Minutes, and within 30 days at most. The business keeps the transcript and Minutes, and your email address if it sent you the Minutes. To see, correct or delete them, contact the business first; we'll help it respond.

16

Messages we send you

• Service messages: sign-up codes, security alerts, low-credit and spend-cap warnings, invoices, and important changes to ForgeCall or this policy. You can't opt out of these while your account is open, because you need them to use ForgeCall safely.
• Marketing emails: occasional news about ForgeCall features and offers. Every one has an unsubscribe link, and unsubscribing takes effect within 5 business days.
• Texts: we don't send you marketing texts unless you've agreed to receive them, as the Spam Act 2003 requires, and you can reply STOP at any time.

17

Children

ForgeCall is a service for businesses, and you must be at least 18 to create an account or join one as a team member. We don't knowingly collect personal information from children for our own purposes. If you believe a child has given us their information, contact us and we'll delete it. A child's details can still appear in a business's customer content, for example if a parent mentions them on a call. The business is responsible for handling that information properly.

18

If something goes wrong

If a data breach happens that's likely to cause serious harm, we'll contain it and assess it quickly, and we'll notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires. Where other laws apply, we'll notify the relevant authorities within the time they set, such as 72 hours under the GDPR. Where a breach affects customer content, we'll tell the affected businesses without undue delay and give them what they need to meet their own obligations. We'll explain what happened, what information was involved, what we're doing about it and what you can do.

19

Changes to this policy

We'll update this policy when ForgeCall or the law changes. The version number and effective date at the top will always show when it last changed. If we make a change that materially affects how we use your information, we'll tell account owners by email and in the app at least 30 days before it takes effect, and ask for your consent where the law requires it. We keep earlier versions and will send you one if you ask.

This version. Version 1.5 takes effect on 30 November 2026 and adds Meeting rooms (sections 3, 4, 7, 8, 9, 11 and 15). The changes made by version 1.4 apply from 27 November 2026; until then, the earlier version applies.

20

Contact us and complaints

Questions, requests and complaints about privacy go to our Privacy Officer:

Company

ForgeOS Pty Ltd, ABN 33 697 659 902

Email

ops@forgeos.tech

Post

Privacy Officer, ForgeOS Pty Ltd
162 Nicholson Street, Abbotsford VIC 3067, Australia

Tell us what your concern is and how to reach you. We'll acknowledge a complaint within 5 business days and aim to resolve it within 30 days. If you're not satisfied with our answer, you can take it to the privacy regulator where you live, listed in section 14. In Australia that's the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).