Privacy Policy

01 Overview

FORGE is operated by Kapu Solutions Inc. ("we," "us," or "our") in partnership with Holomua Tech. This Privacy Policy describes how we collect, use, store, and protect personal information when you use the FORGE platform at forge.kapusolutions.com.

We take data protection seriously. FORGE is built with reference to NIST SP 800-171 and CMMC Level 2 practices, but no third-party assessment has been completed and FORGE is not certified under either. The Platform is not yet certified for ITAR, CUI, or classified handling, and government work on the Platform is limited to unclassified material.

02 Information We Collect

Account Information: When you register, we collect your full legal name, email address, phone number, business name, and physical address. For operators, we also collect equipment details, self-reported security clearance status, and production capacity estimates.

Agency Information: For agency accounts, we collect organization name, agency code, contracting office, DUNS/UEI number, CAGE code, and billing address.

Usage Data: We log security-relevant platform events including login attempts, file access, job actions, payment events, and administrative actions. We retain these records for at least 365 days, except that file-access entries are removed if the job or account they relate to is deleted.

Device Information: We collect IP addresses, browser type, and user agent strings for security monitoring and audit purposes.

Payment Information: We do not collect, store, or process credit card numbers or bank account details. All payment processing is handled by Stripe, Inc., a PCI Level 1 certified payment processor. Please refer to Stripe's Privacy Policy for details on how they handle payment data.

03 How We Use Your Information

We use collected information to:

• Manually review the identity, business details, and stated capabilities you provide during vetting
• Provide access to the FORGE platform and match operators with appropriate jobs
• Apply the handling-level access controls set by the party who posted a job to that job's files
• Process payments through our third-party payment processor (Stripe)
• Maintain audit logs of security-relevant activity for accountability and incident investigation
• Detect and prevent unauthorized access, fraud, and security incidents
• Communicate with you about your account, jobs, and platform updates

04 Data Storage & Security

Platform data and uploaded files are stored on on-premises infrastructure located in Honolulu, Hawaii, United States. No third party stores your uploaded files. Traffic to and from the Platform is proxied by Cloudflare, which therefore processes requests in transit, and payment processing is handled by Stripe, Inc.; both are described in Section 5.

Security measures include:

• Uploaded files stored outside the public web root with restrictive file permissions, released only through access-checked and logged downloads — uploaded files are not encrypted at rest
• Multi-factor authentication secrets encrypted at rest
• TLS 1.2 or higher for all data in transit, with HSTS enabled
• Bcrypt password hashing with a cost factor of 12
• Server-side session management with idle timeout (30 minutes) and absolute timeout (8 hours)
• CSRF protection on all form submissions
• Audit logging of security-relevant platform events, retained for administrative review

05 Data Sharing

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

• With Stripe for payment processing (email, name, billing address)
• Between buyers, agencies, and operators as necessary to fulfill job orders (limited to job-relevant information)
• With law enforcement when required by law, subpoena, or valid legal process
• With Cloudflare which proxies all traffic to the Platform and therefore processes your IP address and request metadata

06 Data Retention

Audit log entries are retained for a minimum of 365 days. File-access records are retained with the job they belong to; if that job record is deleted, or if an account is fully deleted rather than deactivated, the associated file-access entries are removed with it. Account data is retained for the duration of your active account plus 3 years after account closure or deactivation.

You may request deletion of your account by contacting [email protected]. Note that certain records may be retained as required by law or compliance obligations.

07 Your Rights

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account (subject to legal retention requirements)
• Withdraw consent for identity and business verification (which may result in account deactivation)

To exercise any of these rights, contact [email protected].