Privacy Policy
This policy explains how ForgeMCP handles personal data and engineering data: what we collect, why, who receives it, where it is processed, how long we keep it, and the rights you have. It applies to forgemcp.ai, the ForgeMCP dashboard, our hosted connectors and the ForgeMCP Desktop application.
1. Who we are
ForgeMCP is operated by All Aligned Consulting LLC, a United States company doing business as ForgeMCP ("ForgeMCP", "we", "us"). For the personal data described in section 2 we are the controller, except where section 4 says we act as a processor for your organization.
Privacy questions, requests and complaints: support@forgemcp.ai (please put "Privacy" in the subject line).
2. Data we collect
- Account data — your name, email address, and either a password hash or the identifier returned by the sign-in provider you chose (Google, Microsoft or GitHub). Optional two-factor data (an encrypted authenticator secret, hashed backup codes, passkey public keys).
- Workspace data — your organization, its members and roles, invitations (the invitee's email address), groups, document access rules, and the connector settings you create.
- Billing data — your billing email, plan, seat count and subscription status. Card details go directly to Stripe; we never see or store your card number.
- Usage and security data — one record per tool call (the tool, the connector, the time, who made it and how it was metered — not the tool's inputs or results), and a security audit log of sign-ins, sign-outs and configuration changes, which includes the IP address for sign-in events. Sessions keep a one-way hash of the IP address and the browser's user-agent string.
- Connected-account data — credentials you give us for third-party engineering platforms (for example Autodesk, Onshape, 3DEXPERIENCE or FlowGuideAI), encrypted at rest.
- Engineering data from hosted connectors — when you or your AI assistant use a hosted connector, the request passes through ForgeMCP to the platform you connected, and the answer comes back the same way. If your organization enables ForgeMCP's knowledge feature for a platform, we keep a copy of what that platform returned (for example document lists, properties, model structure) so your assistant can use it later; this only happens after an administrator consents for that platform. The same feature can also keep answers from desktop applications (section 11).
- Desktop device data — see section 11.
- Support data — messages you send to our support assistant or by email, and the account summary the assistant uses to answer (section 6).
- Signup analytics — which pages of our own site you
viewed before creating an account, campaign parameters (such as
utm_source) or the referring site's domain, the plan you chose to evaluate, and later plan changes. Collected first-party only. - Interest and waitlist data — if you ask to be told about a platform or a launch: your email address and anything you choose to add (company, role, a note).
- Diagnostics — error reports from the desktop application, with file paths and identifiers removed before they are sent.
We do not ask for special categories of personal data, and the service is not designed to process them. Desktop files and models stay on your machine: the desktop application returns only the specific answer your assistant asked for (section 11).
3. Why we use it, and our legal bases
Where the EU or UK GDPR or the Swiss Federal Act on Data Protection applies, we rely on the following legal bases:
| Purpose | Data | Legal basis |
|---|---|---|
| Provide the service: accounts, sign-in, workspaces, connectors, desktop activation | Account, workspace, connected-account, engineering, device | Performance of our contract with you or your organization |
| Billing, metering and plan limits | Billing, usage | Contract; legal obligation (tax and accounting records) |
| Security, fraud and abuse prevention, the audit log | Usage and security data, IP addresses (raw in the sign-in audit log, hashed elsewhere), device data | Legitimate interests in keeping the service and your account secure |
| Support | Support data, account summary | Contract; legitimate interests in answering accurately |
| Service emails (verification, password reset, invitations, device and billing notices) | Email address, message content | Contract |
| Understanding how people find and evaluate ForgeMCP | Signup analytics | Legitimate interests in improving our site and product |
| Launch and platform updates you asked for | Interest and waitlist data | Consent, which you can withdraw at any time |
| The knowledge feature for a connected platform | Engineering data from hosted connectors | Your organization's instructions (section 4) and administrator consent |
We do not sell personal data, we do not use it for advertising, and we do not use your engineering data or your conversations to train any model. We make no decisions about you based solely on automated processing that have legal or similarly significant effects.
4. When we act for your organization
For the content your organization processes through ForgeMCP — engineering data passing through hosted connectors, the knowledge feature, document access rules and organization audit records — we act as a processor (service provider) on behalf of your organization, which is the controller. We process that content only to provide the service and on your organization's documented instructions. A data processing agreement is available to business customers on request at support@forgemcp.ai.
5. Cookies and similar technologies
After you sign in we set a first-party, HttpOnly, Secure session cookie. It is strictly necessary to keep you signed in. Our marketing pages also set two first-party analytics cookies: one records how you arrived (campaign parameters or the referring domain) and one counts the pages you view here before signing up. Both are read once at signup and never leave our infrastructure. We use no third-party advertising or tracking cookies and do not track you across other sites.
Our pages load their fonts from the jsDelivr content delivery network, so your browser's IP address and user-agent reach jsDelivr when a page loads (see subprocessors). No cookie is set by it.
6. Who receives personal data
We use a small number of service providers (subprocessors) to run ForgeMCP. Each receives only what it needs for the purpose listed. The full, current list — with what each receives, why, and where — is at forgemcp.ai/subprocessors.
Beyond our subprocessors, personal data is disclosed only:
- To platforms you connect — when you connect Autodesk, Onshape, 3DEXPERIENCE, FlowGuideAI or another platform, your requests go to that platform under your own account with it, and its own privacy terms apply.
- To the AI assistant you use — answers from ForgeMCP tools are returned to the assistant you connected (for example Claude, ChatGPT or Grok), under your agreement with that provider.
- Within your organization — administrators can see members, devices, usage and audit records for their organization.
- To public authorities, when the law requires it — we may disclose personal data in response to a lawful request by a public authority, including to meet national security or law enforcement requirements. Where the law allows, we will tell the affected customer first and challenge requests that are overbroad.
- In a business transfer — if ForgeMCP is reorganised, merged or sold, personal data may transfer to the successor, which must continue to protect it as this policy describes. We expect to move ForgeMCP to a separate company owned by the same people; we will update this page and notify customers when that happens.
7. International transfers
ForgeMCP is based in the United States, and personal data is processed in the United States and, through our infrastructure provider's global network, in other countries. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and the Standard Contractual Clauses as adapted for Swiss law, together with our subprocessors' own transfer safeguards. You can ask us for a copy of the relevant safeguards at support@forgemcp.ai.
Customers can ask for Autodesk files to be processed in Autodesk's EU region; that processing then happens in Autodesk's own EU data centres.
8. How long we keep data
| Data | Kept for |
|---|---|
| Account, workspace, connected-account and device records | While your account is active; deleted when you or your organization delete it |
| Used or expired sign-in, verification, reset and invitation tokens | 30 days, then deleted automatically |
| Desktop diagnostics | 90 days, then deleted automatically |
| Waitlist and platform-interest sign-ups | Up to 24 months, then deleted automatically; earlier on request |
| Engineering data kept by the knowledge feature | Until your organization turns the feature off for that platform, or the organization is deleted; deleted immediately in either case |
| Security audit log | For the life of the account; on deletion, names, email addresses and account identifiers are removed and the record is kept de-identified |
| Billing and usage history | As long as tax, accounting and dispute rules require, de-identified after account deletion |
| Backups | Deleted records fall out of recoverable backups within 30 days |
To delete your account or your organization, email support@forgemcp.ai from the address on the account. Deleting your ForgeMCP account does not by itself erase data held by the platforms you connected or by our payment processor, which keeps its own billing records under its own rules; tell us if you would like us to ask them on your behalf.
9. Security and breach notification
Traffic is encrypted in transit. Credentials you give us and other sensitive fields are encrypted at rest with AES-256-GCM; passwords are hashed with Argon2id; device identifiers and session IP addresses are stored only as one-way hashes. Access to production systems is restricted and logged. See forgemcp.ai/security.
If a personal data breach affects you or your organization, we will notify the affected customer without undue delay and, where we are the controller and the law requires it, the competent supervisory authority within 72 hours of becoming aware of it, and the people affected where the risk to them is high.
10. Your rights
Depending on where you live, you may have the right to: access the personal data we hold about you; have it corrected; have it deleted; restrict or object to our processing of it (including processing based on legitimate interests); receive it in a portable format; and withdraw consent at any time, without affecting processing before the withdrawal. These rights apply in full where the EU or UK GDPR or the Swiss Federal Act on Data Protection applies.
To exercise a right, email support@forgemcp.ai from the address on your account, or tell us how else to verify that the request is yours. We answer within one month, and tell you if we need longer and why. There is no charge. If your request concerns content your organization controls (section 4), we will pass it to your organization and help it respond.
You also have the right to complain to a data protection authority — in the EU, the authority where you live or work; in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner. We would appreciate the chance to resolve your concern first.
11. Desktop application data
When you activate ForgeMCP Desktop we link it to your account so we can enforce your plan's device limit and let you revoke access. To recognise a device across re-installs we derive a one-way fingerprint from hardware identifiers the app reports (such as a machine GUID or BIOS serial): these are combined with a secret key using HMAC-SHA256, and only the resulting hash is stored. We also keep a masked fragment of the hardware serial — its last few characters, for example “…7K2M” — to help you tell your devices apart. The raw identifiers are never written to our database, logs or audit trail.
Alongside the fingerprint we keep the device name, the operating system, the ForgeMCP Desktop version, the host name, a hash of the IP address used at activation, the activation and last-seen times, and the device's access token (stored only as a hash). While ForgeMCP Desktop runs it keeps a lightweight heartbeat connection to forgemcp.ai so your workspace can tell that it is running and entitled; the heartbeat carries the device name, platform, ForgeMCP Desktop version and which supported applications are installed or running — never file contents. Your models, drawings and design files stay on your machine; only the specific answer your assistant asked for is returned. You can view and revoke devices at any time from the dashboard.
The desktop applications themselves (for example SOLIDWORKS, AutoCAD, Inventor, Solid Edge, KiCad or Blender) run on your machine under your own licence. ForgeMCP does not send your data to their makers; anything those applications send to their own vendors is governed by your agreement with that vendor and its privacy policy.
How answers travel. With the ForgeMCP extension in Claude Desktop, answers go straight from ForgeMCP Desktop to the assistant on the same machine. When you use the desktop tools from another assistant (for example ChatGPT, Grok or Claude on the web), each answer passes through ForgeMCP's servers on its way to that assistant. We do not store those answers; we keep only the usage record described in section 2 (which tool, which connector, when, and by whom).
The knowledge feature and desktop applications. If your organization's administrator turns on ForgeMCP's knowledge feature for a desktop application, ForgeMCP Desktop also sends a copy of each successful answer it reads from that application — for example the open document's name, its feature list, dimensions, properties, mass properties or GD&T callouts — to your organization's private knowledge store, so your assistant can use it later. The model and drawing files themselves are never sent. Nothing is kept unless an administrator has consented for that application; it is deleted when the feature is turned off or the organization is deleted (section 8).
12. Children
ForgeMCP is a professional engineering service and is not directed to children. We do not knowingly collect personal data from anyone under 16.
13. Changes
We will post changes to this page and update the "Last updated" date above. If a change materially affects how we use personal data you have already given us, we will tell account holders by email before it takes effect.