Privacy policy
Last updated 12 September 2026
This policy explains what personal information UseForge collects, why we collect it, who we share it with, and what rights you have. It is written to meet the Protection of Personal Information Act, 2013 (POPIA).
Who we are
UseForge is a quoting, invoicing and payments service operated from South Africa. For the account data you give us, we are the responsible party. For the customer records, quotes and invoices you create inside your account, you are the responsible party and we act as your operator.
What we collect
- Account details: your name, email address and a hashed password.
- Business details: company name, registration number, VAT number, address, logo and banking details you enter for your invoices.
- Your customers' details: business and contact names, email addresses, addresses and tax numbers that you add.
- Document and payment data: quotes, invoices, line items, totals and payment status.
- Technical data: log data, IP address and session cookies needed to keep you signed in.
We do not store card numbers. Card details are entered directly with the payment provider and never reach our servers.
Why we use it
- To run your account and produce the documents you ask for.
- To send transactional email, such as a quote, an invoice or a payment reminder to the recipient you choose.
- To take payment on the invoices you issue.
- To keep the service secure, prevent abuse and meet our record-keeping obligations.
We do not sell personal information, and we do not use your customer data to train AI models.
Who we share it with
We use the following operators, each of which processes data only on our instruction:
- Vercel for hosting.
- Yoco, PayFast, Stitch and PayGate for card payments on your invoices.
- UploadThing for logo and file storage.
- Upstash for caching and rate limiting.
- Resend for transactional email.
- Google (Gemini) for the optional AI drafting feature, which receives only the text you type into that feature.
Some of these providers process data outside South Africa. Where that happens, the transfer is covered by the provider's standard contractual protections.
How long we keep it
We keep your account data while your account is open. Financial records such as invoices and payments are retained for at least five years to meet South African tax and company law requirements, even after you close your account. Everything else is deleted or anonymised within 90 days of closure.
Security
Data is encrypted in transit. Passwords are hashed and never stored in readable form. Each account is isolated from every other account, and client portal links use unguessable tokens that are excluded from search engines.
Your rights
Under POPIA you may ask us to confirm what personal information we hold about you, correct it, delete it, or object to how we use it. You may also complain to the Information Regulator of South Africa. To exercise any of these rights, email privacy@useforge.co.za.
Cookies
We use cookies that are strictly necessary to sign you in and keep your session secure. We do not use advertising or cross-site tracking cookies on the application itself.
Changes
If we change this policy in a way that materially affects you, we will tell you by email before the change takes effect.
Contact
Questions about this policy: privacy@useforge.co.za.