Privacy Policy

Last updated: June 2026

This policy explains how we collect, use and protect personal data when you use the EQAssure™ tool at chiselforge.com and when you contact us. The tool is provided by ChiselForge, based in the United Kingdom.

For the account, billing and enquiry data described below, ChiselForge is the data controller. For the assessment content and evidence files your organisation enters and uploads, we act as a data processor on your organisation’s behalf (your organisation is the controller of that content).

1. Who we are & how to contact us

Controller: ChiselForge, a UK-based business currently completing incorporation as a UK limited company. Our full registered details (company name, number and registered office) will be published here on incorporation, and are available on request in the meantime. For any privacy question or to exercise your rights, contact privacy@chiselforge.com. [ICO registration number — to add once registered.]

2. The personal data we collect, and why

• Account & profile — your name, email and organisation name, and your role. To create and run your account. Lawful basis: performance of a contract.
• Assessment content & uploaded evidence — the conformance ratings, commentary, action owners and files you add. To provide the service; processed on your organisation’s behalf.
• Billing — handled by Stripe; we store only a customer/subscription reference, never your card details. To take payment. Contract / legal obligation.
• Terms-acceptance records — your email, the terms version, the time, and your IP address and browser, kept as evidence you accepted our terms. Legitimate interests (protecting our rights) / legal obligation.
• Enquiry & trial-request data — the details you give on our “tailor your plan”, trial and “get in touch” forms (organisation, team size, email, focus). We use this to respond to your enquiry and follow up about the product, and you can opt out at any time.
• Communications — emails we exchange, and messages in the external-assessor review thread. To provide and support the service.
• Technical data — our hosting and security providers automatically process limited technical data such as IP addresses for security, abuse-prevention and reliability. Legitimate interests.

3. Cookies & local storage

We use only essential cookies needed to keep you securely signed in. We do not use advertising or analytics/tracking cookies. The app stores a few functional preferences in your browser’s local storage (for example, whether you’ve dismissed a guide). Because we use only essential cookies, no cookie-consent banner is required.

4. Who we share data with

We use trusted providers to run the service; they process personal data only on our instructions and under their own data-processing terms:

• Supabase — database, authentication and file storage.
• Vercel — application hosting.
• Stripe — payment processing.
• Resend — sending transactional emails (which can include message content).
• Cloudflare — bot/abuse protection on our public forms.

We do not sell your personal data, and we don’t share it for anyone else’s marketing.

5. International transfers

Some of these providers process data outside the UK (for example, in the United States). Where they do, the transfer is protected by appropriate safeguards — such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses — under each provider’s terms. Our database is hosted in the European Union (Ireland).

6. How long we keep it

We keep account and assessment data while your organisation has an account, and for 12 months afterwards unless you ask us to delete it sooner. The IP address and browser details recorded with your terms-acceptance records are automatically removed after 24 months (the acceptance record itself is retained as evidence). Enquiry/lead data, and trial requests that don’t lead to an account, are deleted after 12 months. These retention purges run automatically.

7. Your rights

Under UK GDPR you can ask to access, correct, delete, restrict or object to our use of your personal data, and to receive a copy in a portable format. To exercise any of these, emailprivacy@chiselforge.com. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

8. Business customers — data processing

For the content your organisation enters and uploads, we act as your processor and handle it only to provide the service. Business customers can request a Data Processing Addendum (DPA) setting out these terms.

9. Security

We protect personal data with measures including encryption in transit, per-organisation data isolation, restricted access, and review of our application’s security. Card payments are handled entirely by Stripe and never stored on our systems.

10. Children

The service is intended for internal audit professionals and is not directed at children.

11. Changes to this policy

We may update this policy from time to time; we’ll update the date above and, for significant changes, notify account holders.

12. Contact

privacy@chiselforge.com · ChiselForge, United Kingdom.