ReqForge
Privacy policy
What we collect, and why
When you use the application
| Data | Why | Lawful basis |
|---|---|---|
| Your work email address | To identify which seat you hold and to send activation codes | Performance of a contract |
| A one-way hash of a machine identifier | So a seat runs on one machine at a time. We receive the hash, never the identifier itself, and cannot reverse it | Legitimate interests: enforcing the licence you bought |
| A machine label, and the application version | So your administrator can tell which machine is which, and so we can tell which version a bug report is about | Performance of a contract |
| IP address and timestamps of licence checks | Rate limiting, and spotting licence abuse | Legitimate interests: security and preventing fraud |
The application contacts the licence service about once a day. It sends the licence token it already holds and the data in the table above. Nothing else.
When your organisation buys seats
Organisation name, the names and email addresses of administrators and users, seat assignments, and an audit trail of administrative actions — who invited whom, who released which seat, and when. Basis: performance of a contract.
Payments are taken by Stripe. Card numbers never reach us: Stripe processes them and we hold a customer reference, the invoices, and what was bought. We keep invoices for six years because UK tax law requires it. Basis: contract, and legal obligation.
When you email us
Your address and whatever you write, kept while we deal with it and for two years afterwards so we have the history of a problem when it comes back. Basis: legitimate interests: answering you.
When you visit this website
There is no analytics, no tracking, no advertising, and no third-party script of any kind — the pages load only from this domain. Our host, Cloudflare, keeps short-lived request logs including IP addresses to run and protect the site. Basis: legitimate interests: keeping it up.
The site sets no cookies. Your light or dark preference is kept in your own browser's local storage, on your device, and never sent anywhere.
How long we keep it
| What | How long |
|---|---|
| Activation records and licence-check timestamps | 24 months from the last check |
| Sign-in and activation codes | 10 minutes, then deleted |
| Issued licence tokens | Until they expire, then deleted nightly |
| Accounts, seats and the administrative audit trail | While you are a customer, then 24 months |
| Invoices and payment records | 6 years, as UK tax law requires |
| Support email | 2 years after the matter is closed |
Who else processes it
| Who | What for | Where |
|---|---|---|
| Cloudflare | Hosting this site and the licence service, and its database | Global network; data at rest in the region Cloudflare assigns |
| Stripe | Taking payments and holding card details | EU and United States |
| Resend | Sending activation codes, invites and billing email | EU and United States |
Each is a processor acting on our instructions, under a data-processing agreement. Where data goes outside the UK, transfers rely on the UK addendum to the EU Standard Contractual Clauses or an adequacy decision. We do not sell personal data, and we never will.
Your rights
Under UK GDPR you may ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or stop processing it, object to processing we do on the basis of legitimate interests, and ask for it in a portable format. Email privacy@reqforge.net and you will get an answer within one month.
Note that deleting the data behind an active seat means the seat stops working — it is the seat. We will explain that before doing it rather than quietly breaking your install.
If you think we have got this wrong, you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you told us first.
Security
Licence tokens are signed with Ed25519 and the signing key exists in one place, a secret held by our host. Sign-in codes are stored as keyed hashes, never as codes. There are no passwords to steal because there are no passwords. Access to the production database is limited to the owner of this business.
Found a hole? security@reqforge.net, and thank you.
Changes
If this policy changes in a way that affects you, we will email administrators before it takes effect. The date at the top always says which version you are reading.