Privacy Policy

Effective date: October 12, 2026

This Privacy Policy explains how [LEGAL ENTITY NAME] (“DGForceX“, “we”, “us”) collects, uses and protects personal information when you visit our website at dgforcex.com (the “Website“) and when you or your company use Force Insights, our lead-handling and marketing-performance platform at app.dgforcex.com (the “Platform“). Part A applies to everyone. Part B applies to the Platform.

Part A — General

1. Who is responsible

For the Website, and for the account information of Platform users, DGForceX is the controller of your personal information.

For the CRM and sales data that a customer company connects to the Platform, the customer company is the controller and DGForceX acts as its processor, handling that data only on the customer’s instructions. See Part B.

Contact: [LEGAL ENTITY NAME], [REGISTERED ADDRESS], [CONTACT EMAIL].

2. Information we collect on the Website

Information you send us — for example your name, email, company and message when you fill in a contact or demo form or subscribe to updates.
Usage information — pages visited, referring site, browser and device type, and approximate location derived from your IP address, collected through cookies and similar technologies (see section 6).

3. How we use information

To answer your enquiries and provide demos and the services you ask for.
To send product updates and marketing, where you agreed to receive them. You can unsubscribe at any time from the link in every email or in your account settings.
To operate, secure and improve the Website and the Platform.
To meet legal, tax and accounting obligations, and to enforce our terms.

Where the GDPR or similar laws apply, our legal bases are: performing a contract with you, our legitimate interests (running and securing our business), your consent (for marketing and non-essential cookies), and legal obligations.

4. Sharing

We do not sell personal information and we do not share it for third-party advertising. We share it only with:

service providers that run our services for us (listed in section 12), under contracts that require them to protect it;
professional advisers, and authorities where the law requires it;
a buyer or successor if our business is reorganised or sold, subject to this Policy.

5. International transfers

Some of our service providers are located outside your country, including in the United States. Where personal information from the EU/EEA, the UK or Switzerland is transferred, we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses (or equivalent safeguards). The Platform’s main database is hosted in the European Union (Frankfurt, Germany).

6. Cookies

Website. We may use analytics cookies (for example Google Analytics through Google Tag Manager) to understand how the Website is used. Where required, we ask for your consent first, and you can change your choice at any time.

Platform. The Platform uses only cookies that are needed for it to work:

a session cookie that keeps you signed in;
a security (CSRF) cookie that protects your actions;
short-lived cookies that secure a CRM connection or a signup payment while it is in progress.

The Platform also stores small display preferences in your browser, such as whether the sidebar is collapsed. It does not use advertising cookies.

7. Retention

We keep personal information only as long as needed for the purposes above:

Website enquiries: up to 24 months after our last contact.
Platform accounts: while the account is active.
Billing records: as long as tax and accounting law requires.

Customer CRM data is covered in section 15.

8. Your rights

Depending on where you live (for example under the GDPR, the UK GDPR, the California Consumer Privacy Act, or Israel’s Privacy Protection Law), you may have the right to:

access, correct or delete your personal information, and receive a copy of it;
object to or restrict certain uses of it;
withdraw consent;
complain to a data protection authority.

To exercise a right, email [CONTACT EMAIL]. If your information is in the Platform because your employer or a company you deal with uses Force Insights, we will refer your request to that company and help it respond.

9. Children

Our services are for businesses and are not directed at anyone under 18. We do not knowingly collect information from children.

10. Security

We protect information with technical and organisational measures appropriate to the risk. Part B, section 16 describes the Platform’s measures. No system is perfectly secure; if a breach affects your personal information, we will notify you and the authorities as the law requires.

11. Changes

We may update this Policy. We will post the new version here with a new effective date. If the changes are material, we will also notify Platform account holders by email or in the Platform.

12. Service providers (sub-processors)

Provider	Purpose	Location
Vercel Inc.	Hosting and delivery of the Platform	Global edge network; USA
Neon (Databricks)	Platform database	EU — Frankfurt, Germany
Resend	Transactional email (invitations, alerts, digests)	EU — Ireland
PayPal	Payment processing — we never see or store full card numbers	Global
Cloudflare	DNS for our domains	Global
Google (Analytics / Tag Manager)	Website analytics, where enabled and consented	Global
Anthropic (Claude)	AI insights — only when a customer connects its own Claude account (see section 14)	USA

Part B — The Force Insights Platform

13. What the Platform does with data

Force Insights connects to a customer company’s CRM, such as HubSpot or Salesforce. It shows how leads are handled and where revenue is won or lost, using dashboards, alerts and digests. It analyses data; it never contacts the customer’s leads.

The Platform processes:

Account information — name, email, role and team, profile picture (optional) and display preferences of each user. Passwords are stored only as strong one-way hashes (Argon2), never in readable form. For security we keep sign-in records, including IP address and browser type.
Company information — company name and logo, teams, users and their permissions, alert rules, field-mapping and dashboard settings, and support tickets.
CRM data (Customer Data) — read from the customer’s CRM with the customer’s authorisation:
- leads and contacts (name, email, company, country, owner, status and status history, source and campaign);
- accounts, opportunities (amount, stage, dates) and campaigns;
- CRM users (the customer’s sales reps);
- activities such as emails, including subject and body text, calls, including notes and duration, and meetings.
Manually logged activity — WhatsApp, SMS, calls or meetings that users record in the Platform. These stay in the Platform and are never written back to the CRM.
Billing information — plan, number of seats, payment status and invoices. Card details are handled by PayPal.

14. CRM access and AI

Read-only access. The Platform connects through the CRM’s official sign-in (OAuth) and asks only for the access it needs to read data. It cannot change, delete or send anything in the customer’s CRM. The customer can disconnect the Platform at any time, from the Platform or from the CRM.
Credentials. Access tokens and API keys are encrypted with AES-256-GCM before they are stored.
AI is optional and under the customer’s control. The core Platform runs without any AI service. AI scoring, recommendations and questions are switched on only if the customer connects its own Anthropic Claude account (API key and/or MCP). Relevant Customer Data is then sent to Anthropic under the customer’s own account and agreement with Anthropic.
No model training. DGForceX does not use Customer Data to train AI models.

15. Customer Data — our role, separation and deletion

Our role. The customer company owns and controls its Customer Data; DGForceX processes it only to provide the Platform to that customer. We do not sell Customer Data, use it for advertising, or combine it with other customers’ data. A Data Processing Agreement (DPA) is available on request.
Separation between companies. Every record belongs to exactly one company, and every request is checked against the signed-in user’s company. Data of one company is never shown to another company.
Separation within a company. The customer’s admin decides who sees what:
- admins see everything;
- team managers see their teams;
- employees see only their own data;
- full email content follows the same team permissions.
Support access. DGForceX staff may enter a customer’s workspace only to provide support or keep the service running. Every such access is logged, and the log is visible to the customer’s admins in the Platform.
Deletion. When a customer disconnects its CRM, closes its account or asks us to, we delete its Customer Data from the Platform within 30 days. Backups expire within a further 30 days, except where the law requires us to keep records, such as invoices.

16. Platform security

Encryption in transit: all traffic uses HTTPS, enforced with HSTS.
Encryption at rest: data is encrypted by our hosting and database providers; CRM tokens and API keys are additionally encrypted by the Platform.
Sign-in protection: hashed passwords, protection against cross-site request forgery and clickjacking, secure session cookies and limits on failed sign-in attempts.
Least privilege: read-only CRM access and role-based permissions inside each company.
Invitation-only accounts: people join a company workspace only when that company’s admin invites them. New company accounts are activated only after the company admin’s signup and payment.
No search-engine indexing: no Platform page except the public home page is indexed by search engines.

17. Contact

Questions about this Policy or about your data: [CONTACT EMAIL].