Privacy Policy

This Privacy Policy explains how Smart Unlimited Holding B.V. (trading as AnyForge) ("AnyForge", "we", "us", or "our") collects, uses, and protects personal data in connection with the AnyForge platform, including AnyForge Control, AnyForge Crew, the AnyForge Console, and our websites (together, the "Service"). AnyForge is a business-to-business service intended for use by organizations and their authorized users.

Please also read our Terms of Service. Capitalized terms not defined here have the meaning given in the Terms.

Smart Unlimited Holding B.V. (trading as AnyForge), registered in the Netherlands under company number 20110743 (Netherlands Chamber of Commerce, KvK), with its registered office in Den Hout, the Netherlands, is responsible for the personal data described in this Policy where we act as a controller.

For any privacy question or to exercise your rights, contact us at privacy@anyforge.ai.

Our role depends on the data in question.

Where we act as a controller. For the personal data we collect to run our business and provide the Service, such as account, billing, website, support, and marketing data, we determine why and how it is processed, and this Policy governs.

Where we act as a processor. When you, as a business customer, submit data through the Service ("Customer Data"), you are the controller of any personal data it contains and we process it on your behalf, under your instructions and our Terms and Data Processing Addendum. Our handling of that data is governed by that agreement, not this Policy. If you are an individual whose personal data has been included in Customer Data by one of our customers, please direct your privacy requests to that customer, who is the controller; we will support them as required.

• Account and profile data: name, business email address, company name, job title, and login credentials.
• Authentication data: sign-in records and, where you use single sign-on, the identifiers your identity provider shares with us.
• Billing and transaction data: company billing details and subscription records. Card payments are processed by our payment processor; we do not store full payment card numbers.
• Usage, log, and device data: IP address, browser and device information, log data, timestamps, feature usage, and product analytics generated when you use the Service.
• Support and communications data: the content of messages, support tickets, and correspondence with us.
• Marketing data: information you provide through forms or when you opt in to communications.
• Cookies and similar technologies: see Section 12.

Provider credentials (BYOK). The Service runs on a "bring your own key" basis. When you connect an AI or other provider, you supply API keys or credentials. We treat these as confidential secrets, store them with protection appropriate to their sensitivity, and use them only to operate the Service for you. We mention them here for transparency; they are generally credentials rather than personal data.

The prompts, content, configurations, and other data you route through the Service may contain personal data for which you are the controller. We process it only to provide, secure, and maintain the Service, in accordance with your instructions and the Data Processing Addendum.

We do not use Customer Data to train our own or any third party's AI models.

Under BYOK, content you send for processing is transmitted to the AI provider you choose, using your own credentials, under your own relationship with that provider. That provider's handling of the data is governed by your agreement with them, not by this Policy.

Meeting assistant. If your organization turns on the AnyForge Meeting Assistant browser extension, a user who starts capture in a Google Meet call sends that call's audio (and, if they choose, their own microphone) to AnyForge for live transcription. The audio may contain the voices and statements of everyone in the call, including people who do not use AnyForge. This audio and its transcript are Customer Data. Capture starts only when the user starts it, after confirming that participants have been told; your organization is responsible for informing participants and for any consent the meeting requires. AnyForge sends the audio to a speech-to-text provider that we engage as a sub-processor (Section 7) and returns the transcript to the user's browser. We do not store the audio. By default we do not store the full transcript either: it is held in the user's browser for the session and is cleared when the user clears the meeting, disconnects, or closes the browser. Passages the user sends to the Oracle with a question, and the Oracle's answers, are saved in that user's private Oracle conversation, like any other Oracle conversation. A user may instead choose to read the captions that Google Meet shows them; in that mode the extension reads the caption text and speaker names from the Meet page in the user's browser, no audio is captured or sent to AnyForge or to the speech-to-text provider, and the caption text is handled in the same way as the transcript described above. To show who said each passage, the extension reads participants' display names and profile photo addresses from the Google Meet page in the user's browser and keeps them with the transcript there. The display names of the people in the call are sent to the Oracle to prepare a private meeting brief, together with the calendar invite read through the workspace's connected calendar, and the names of the speakers in a passage the user asks about are sent with that passage. If the organization's owner turns on professional background for the meeting brief, the Oracle may also search the public web for external participants' professional information (role, company and public professional work), by name and company together; it does not look up personal details, contact information or social media, and it does not search for members of the organization. If the organization's owner turns on saved meetings, the extension saves each meeting the user captures, during the call and again when it ends, so that the user's Oracle can recall it later; while that setting is off, nothing is saved. AnyForge then stores the meeting's transcript, including each line's Google Meet display name, a summary the Oracle drafted from it, the title, date, length and the participants' display names. Display names are labels from the Meet page and may be inaccurate. A saved meeting is private to the user who saved it: other members, including owners, cannot read it, and only that user's own Oracle can recall it in that user's private conversations. A saved meeting is kept as long as that meeting's Oracle conversation: if the organization sets a retention period for Oracle conversations, it is deleted together with that conversation (or, for a meeting that is not linked to a conversation, after the same period from when it was last saved); otherwise it is kept until the user deletes it. The user can delete it at any time, and deleting it removes the transcript text. A user who is an owner or operator may separately choose to share a saved meeting with the workspace, which adds a copy of its summary (and, if the user chooses, its transcript) to the organization's Context Library, where the organization's members and their Oracle can read it until the user stops sharing or deletes the meeting. A user may also ask the Oracle to propose action items from the transcript. Nothing is created from a proposal until the user reviews it and confirms it; each item the user confirms is saved as a work item in the organization's workspace, containing the title the user confirmed, the transcript excerpt it came from and, where the Oracle identified them, the suggested owner's Google Meet display name and the due date as it was spoken. Such a work item can be read by the organization's members who can see that part of the workspace, like any other work item. Your organization remains responsible for informing participants that a meeting may be saved.

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• To provide and operate the Service, create and manage accounts, and authenticate users: performance of a contract (Article 6(1)(b)).
• To bill, administer accounts, and keep records: performance of a contract and compliance with a legal obligation (Articles 6(1)(b) and 6(1)(c)).
• To secure the Service, prevent fraud and abuse, troubleshoot, analyze usage, and improve and develop our products: our legitimate interests in running and improving a secure, reliable service (Article 6(1)(f)).
• To send marketing communications: your consent, or our legitimate interest where permitted by law. You can opt out at any time.
• To comply with law and respond to lawful requests: compliance with a legal obligation (Article 6(1)(c)).

The Service helps you govern and orchestrate AI agents and workflows. Outputs are generated by the providers you connect under BYOK, not by models we operate.

Two kinds of processing instead use AI services that AnyForge engages and pays for itself, as sub-processors, rather than providers you connect:

• Meeting transcription (Section 4): meeting audio is sent to Google Cloud Speech-to-Text, in the European Union.
• Search: to let the Service find relevant material, we send text to Google Cloud Vertex AI, in the Netherlands, which turns it into numeric representations ("embeddings"). This text is source code and analysis documentation from repositories you connect, documents added to your Context Library (including meeting summaries or transcripts a user chooses to share there), and the search queries users type.

We do not use this data to train AI models. The full list of providers is on our Sub-processors page.

We do not use the Service to make decisions that produce legal or similarly significant effects about individuals. We may create and use aggregated, anonymized, or de-identified data, which does not identify you or any individual, to operate, analyze, and improve the Service.

We share personal data only as described here. We do not sell personal data.

• Service providers and sub-processors who help us run the Service, such as cloud hosting and infrastructure, payment processing, analytics, communications and email, and customer support tools, and the AI services described in Section 6. The current list is published on our Sub-processors page. These providers act on our instructions under contract. Where your organization uses the Meeting Assistant, this includes the speech-to-text provider that transcribes meeting audio (currently Google Cloud Speech-to-Text).
• AI and other providers you connect (BYOK): you connect these directly with your own credentials, and data you route is sent to them under your own relationship with them.
• Legal, safety, and compliance: where we reasonably believe disclosure is required by law or legal process, or necessary to protect the rights, property, or safety of AnyForge, our users, or others.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality protections.

We and our service providers may process personal data in countries other than your own, including outside the European Economic Area and the United Kingdom. Where we transfer personal data internationally, we rely on appropriate safeguards, such as a European Commission adequacy decision or the Standard Contractual Clauses (with the UK Addendum where relevant). You may request information about these safeguards using the contact details in Section 1.

We keep personal data only as long as necessary for the purposes described in this Policy, including to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Account data is generally retained for the life of the account and a reasonable period afterward. Customer Data is retained and deleted in accordance with the Data Processing Addendum and your instructions. Meeting audio is not stored by AnyForge, and neither are full meeting transcripts unless a user chooses to save the meeting, in which case the retention described in Section 4 applies. We otherwise keep only short-lived connection records, which are deleted automatically, and per-day counts of transcribed minutes used to enforce limits and report usage. Records of consent and acceptance of our Terms and this Policy are retained as evidence for as long as needed to establish, exercise, or defend legal claims.

We maintain technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, and alteration, including encryption in transit and at rest where appropriate, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Depending on where you are and applicable law, you may have the right to access, correct, delete, restrict, or object to our processing of your personal data, to data portability, and to withdraw consent where processing is based on consent. Where the GDPR or UK GDPR applies, you also have the right to lodge a complaint with a supervisory authority, including the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

To exercise your rights regarding data for which we are the controller, contact us at privacy@anyforge.ai. Where we process personal data as a processor on behalf of a business customer, please contact that customer, who is the controller. We may need to verify your identity before acting on a request.

Our websites and the Service use cookies and similar technologies for essential functionality, to remember your preferences, and to understand and improve how the Service is used. For usage analytics we use Google Analytics, which sets its own cookies; it is not loaded on shared-link pages. We do not currently offer an on-site cookie consent control. You can block or delete cookies, including analytics cookies, through your browser settings. For more detail, contact us at privacy@anyforge.ai.

The Service is intended for business use and is not directed to children. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.

We may update this Policy from time to time. We will post the updated version with a new effective date and, for material changes, provide reasonable notice (for example, by email or in-product notice). Your continued use of the Service after the changes take effect indicates your awareness of the updated Policy.

Smart Unlimited Holding B.V. (trading as AnyForge)
Den Hout, the Netherlands
Privacy enquiries: privacy@anyforge.ai