Privacy policy
Information on the processing of your personal data pursuant to Art. 13, 14 GDPR.
Last updated: July 2026
1. Controller
Controller within the meaning of the GDPR:
Managing Director: Bernhard Scholz
Sachsenweg 5, 87561 Oberstdorf, Deutschland
Email: bernhard@s2i.io
Phone: +49 157 51707977
Forge is a brand of Scholz Ventures & Consulting UG (haftungsbeschränkt), a company incorporated in Germany.
2. What data we process
2.1 Visiting the website
When you access our website, the browser on your device automatically sends information to our server, which is stored temporarily in a server log file. This includes: your IP address, the date and time of access, the name and URL of the file retrieved, the referrer URL, the browser and operating system used, and the name of your access provider.
2.2 Getting in touch
If you contact us by email, we process the data you provide (name, email address, message content) in order to handle your request and any follow-up questions.
2.3 Account and application
Using the Forge platform requires an account. We process your access and master data (including name, email address, role) as well as the content you create in the application. Your session is managed via an encrypted cookie that is technically required to operate the application.
2.4 Usage measurement
To improve the product, we collect pseudonymised usage data (including pages viewed and interactions). When shared deal rooms are viewed, we measure access; IP addresses are stored exclusively in hashed, pseudonymised form for this purpose.
For logged-in customer team members, we additionally use Mixpanel to measure product usage within the application (e.g. features used, content created) so we can improve the product. This does not cover prospects viewing shared deal rooms or cockpits, which are measured only via the pipeline described above. Mixpanel events are processed and stored in the EU. Data is retained for as long as your account is active plus the retention period in section 6. To object, contact us using the details in section 7.
2.5 Prospect research and contact enrichment
To support B2B sales, our customers may research potential partner companies within the application. For this we process business contact data of professional decision-makers (name, job title, employer, and business email address or phone number). This data does not originate from you directly but is obtained from our enrichment provider ContactOut, which indexes publicly available business sources such as company websites and professional networks (source within the meaning of Art. 14 (2)(f) GDPR). The legal basis is our and our customers’ legitimate interest in business-to-business outreach (Art. 6 (1)(f) GDPR). Affected persons may object to this processing and request erasure at any time using the contact details in section 7.
3. Hosting and processors
To provide our website and application we use carefully selected service providers as processors (Art. 28 GDPR):
- Vercel Inc.Hosting and delivery of the website and app · Location: USA
- SupabaseDatabase and backend infrastructure (accounts, content) · Location: EU / USA
- Mixpanel, Inc.Product and usage analytics within the application · Location: EU (EU data residency; provider seated in the USA)
- ResendSending system and invitation emails · Location: USA
- Anthropic, FAL.ai, MuxAI-assisted generation of text, images and video · Location: USA
- ContactOutBusiness contact-data enrichment for B2B prospect research · Location: USA
Where personal data is transferred to third countries (in particular the USA), this is done on the basis of appropriate safeguards within the meaning of Art. 44 ff. GDPR, in particular the European Commission’s Standard Contractual Clauses.
4. Legal bases
Art. 6 (1)(b) GDPR – performance of the contract or pre-contractual measures (account, application, enquiries).
Art. 6 (1)(f) GDPR – legitimate interest in the secure, functional operation of the service and in usage and product analytics.
Art. 6 (1)(a) GDPR – consent, where separately given.
Art. 6 (1)(c) GDPR – compliance with legal obligations.
5. Recipients of the data
Your data is only shared with the processors named above, or where you have expressly consented (Art. 6 (1)(a)), where disclosure is necessary to assert, exercise or defend legal claims (Art. 6 (1)(f)), or where there is a legal obligation to do so (Art. 6 (1)(c)).
6. Retention periods
Server log files: deleted after 7 days at the latest.
Enquiries: deleted once handled, after 3 years at the latest.
Account and contract data: for the duration of the contractual relationship plus statutory retention periods.
Enriched contact data: cached only for as long as needed for the related research and outreach, and deleted on request or when no longer required.
7. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR). You may withdraw any consent given at any time with effect for the future. To exercise your rights, a message to bernhard@s2i.io is sufficient.
8. SSL/TLS encryption
For security reasons this site uses SSL/TLS encryption. You can recognise an encrypted connection by the “https://” in the address bar and the lock icon in your browser.
9. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Promenade 18, 91522 Ansbach, Deutschland
Phone: +49 (0) 981 180093-0
Email: poststelle@lda.bayern.de
Web: www.lda.bayern.de
10. Changes to this policy
We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to reflect changes to our services. The updated policy will then apply to your next visit.
See also our legal notice.