Privacy Policy

FollowForge is provided by One Stop Marketing FZE, a company registered in Sharjah, United Arab Emirates. Its registered details are provided on request to anyone with a legitimate reason to ask — including any customer, regulator or data-protection authority.

For anything about your data, write to support@followforge.xyz.

If you are a FollowForge customer, you are the controller of the lead data you upload. We process it on your behalf and only to provide the service. If you are a lead whose details appear in a customer’s account, that customer decides why they hold your data — contact them first, and contact us if they cannot help.

Account data. Your email address, and the name and settings of your organization. Passwords are handled by our authentication provider and are never stored by FollowForge.

Lead data you upload. Whatever your CSV contains — typically names, companies, email addresses, phone numbers, deal values, dates and notes. We keep the raw row behind every lead, so that nothing is silently lost and an import can be explained after the fact — but not the original file itself, which is deleted from storage once it has been imported.

Usage records. Follow-ups you create, scores we calculate and the inputs behind them, and an audit log of meaningful actions (who changed what, and when).

Emails you send from FollowForge. If you connect Google, each email you send or schedule is kept with the lead it went to — the recipient, subject, message and whether it was sent — so the lead’s history shows what was actually said.

Your Google connection. Which Google account you connected, which permissions it allowed, and an encrypted token that lets FollowForge send the emails and add the reminders you ask for.

Technical logs. Request timings and errors. Email addresses, tokens and credentials are stripped from these before they are written — not on the way out, on the way in.

Connecting Google is optional, and FollowForge works without it. If you connect, we ask Google for two permissions, and Google’s own consent screen lets you allow either one without the other.

Send email on your behalf. Used only when you press Send, or when an email you scheduled comes due. This permission can send mail. It cannot read, search or list anything in your inbox, so FollowForge never sees your email.

Replies are not read from your inbox. FollowForge does not ask for permission to read Gmail, so it cannot see your messages, your inbox, or even the replies to the emails it sent. When a lead answers, you decide what FollowForge knows: paste their reply into the Replies box on that lead, and it is stored with the lead and used when drafting the next follow-up.

See and edit events on calendars you own. Used only to add a reminder when you book a follow-up and choose to put it on your Google Calendar. The reminder holds the lead’s name, the follow-up title and a link back to FollowForge. We do not read your other events.

You can disconnect Google from Settings at any time, which deletes the stored token and asks Google to revoke it. You can also remove FollowForge’s access from your Google Account directly; FollowForge notices the next time it tries to send, and stops.

FollowForge’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from Google is used only to provide the features described here. It is never sold, never used for advertising, never read by a person unless you ask us to investigate a problem, and never used to train any AI model.

Two optional things are collected only if you agree on the cookie banner, and neither sets a cookie or stores anything in your browser.

Crash reports. If a page fails to render, your browser can send the error, its technical stack, and the path of the page. Identifiers and personal data are removed from that text before it is stored, and individual reports are deleted after 30 days.

Page counts. A number, per page, per day. No visitor id, no session, no device fingerprint, no per-visit row — so these counts cannot be turned back into one person’s browsing later, by us or by anyone who obtained the database. Your IP address is used momentarily to rate-limit the request and is never stored.

Errors that happen on our SERVERS are recorded regardless of that choice. They are part of running the service securely and reliably, they are scrubbed the same way, and they are described in full on the cookies page.

Five cookies, all essential: two keep you signed in, one remembers the early-access password while FollowForge is closed to the public, one exists for a few minutes while you connect a Google account, and one remembers your choice about the two optional items above. There is no advertising, no tracking pixel and no third-party analytics service on this site. The complete list, with durations, is on the cookies page.

We do not sell your data. We do not share it with other FollowForge customers. We do not use one customer’s lead data to build features or models for anyone else, and no lead data is used to train any AI model.

These are the only third parties that see service data, and what each one is for:

• Supabase — Authentication — sign-up, sign-in and session tokens. Your email address and sign-in activity. Passwords are handled entirely by Supabase and never reach FollowForge. (European Union)
• DigitalOcean — Hosting for the application, the database and the job queue. Everything the service stores, because it runs there. (United States)
• OpenAI — Writing a follow-up draft, and only when you press the button. The context of the single lead you asked about — name, company, stage, approximate value and your notes. Nothing else, and nothing is sent unless you ask for a draft. (United States)
• Google — Sending follow-up emails from your own Gmail account and adding reminders to your Google Calendar — only if you connect Google, and only when you send, schedule or book something. The email you choose to send and the address it goes to, and the lead name, title and time of each reminder. The Gmail permission FollowForge asks for can send mail but cannot read, search or list your inbox — replies are only what you paste in yourself. (United States)
• Stripe — Taking payment for paid plans, renewing subscriptions, and the billing page where you update your card or cancel. Card details go directly to Stripe and never touch FollowForge servers. Stripe also receives the billing name, email address and billing address you give at checkout. (United States)

Some of these operate outside your country, including in the United States. Where data moves across a border, it moves under the provider’s own standard contractual protections. We will update this list before adding anyone to it.

Your account and lead data: for as long as your account is active. Deleting your organization deletes the leads, imports, follow-ups, emails, scores and audit records that belong to it. Nightly backups are kept for 30 days, so deleted data is gone from those within 30 days as well.

Your Google connection: until you disconnect it, leave the organization, or delete your account.

Individual crash reports: 30 days. The summary of a recurring fault — how often and since when, with no personal data in it — is kept up to 90 days after it stops occurring.

Page counts: up to 400 days, then deleted. They contain nothing about anybody, but “kept forever” is not a retention policy.

Take a copy. Owners and admins can download every lead in the workspace as a CSV file from the Leads page.

Delete a lead. Any lead can be deleted from its own page. That permanently removes the lead, its history, follow-ups and scheduled emails, and the imported row it came from.

Close the account. The owner can close the account from Settings. That cancels any subscription, disconnects Google, and permanently deletes the workspace and everything in it straight away. Your sign-in record is held by our authentication provider, and we delete it too when you ask.

For anything else — a copy in another form, or erasure you cannot do yourself — email us and we will action it. Depending on where you live you may also have rights to access, correct, object to, or restrict processing — we honour those requests regardless of location.

You can change your mind about crash reports and page counts whenever you like, from the cookie preferences link in the footer of any page.

Access is scoped per organization at the data layer, so one customer’s account cannot read another’s — and that rule is enforced by the database client itself, not left to each query to remember. Traffic is encrypted in transit. Uploaded files are stored privately and are not publicly reachable. Google tokens are encrypted at rest with a key held outside the database, and each one only opens for the person it belongs to. No system is perfect, and we will tell you promptly if something happens that affects your data.

FollowForge is a business tool. It is not directed at children, we do not knowingly collect data from anyone under 18, and accounts require you to be old enough to enter a contract where you live.

Tell us first — support@followforge.xyz — and we will answer. If you are in the UK or the EU and are not satisfied with how we have handled something, you also have the right to complain to your national data protection authority.

If this policy changes in a way that matters — a new sub-processor, a new category of data, a longer retention period — the date at the top changes and we will say so in the app before it takes effect.