Skip to main content

AlmaForge Privacy Policy

Effective: January 2026

In this Privacy Policy, "we", "us", and "our" refer to the Data Controller identified below. The software and services are intended for business and professional users and are not directed to children. The Terms of Use govern use of the website, software distribution services, and hosted demo environments.

AlmaForge Product​

AlmaForge is self-hosted software that runs in the customer's own environment. AlmaForge does not send telemetry, analytics, or usage data to us by default. Operational data generated within a customer deployment, such as audit records, session recordings, configuration data, and access logs, remains within infrastructure controlled by the customer unless the customer chooses to share diagnostic information for support purposes.

Customer-operated AlmaForge deployments are outside the scope of this policy. The customer is the data controller for all data generated and processed within its own infrastructure. We do not receive runtime data from customer deployments. Where a customer voluntarily provides diagnostic materials such as log files or configuration excerpts, that information is handled under Support and Communication.

Website​

The almaforge.com website is a static site. It does not use cookies, analytics, tracking scripts, or third-party embeds.

The website is hosted on Cloudflare's content delivery network. As part of hosting, delivering, and securing the site, Cloudflare may automatically collect limited technical data including your IP address, browser type, operating system, pages requested, and the date and time of each request.

Software Distribution​

AlmaForge software packages, binaries, and related artifacts are distributed through a content delivery network hosted on Cloudflare. As part of hosting and delivering downloads, Cloudflare may log your IP address, the file requested, and standard HTTP metadata.

Demo Environments​

We provide hosted demo environments to allow prospective users to evaluate AlmaForge without installing it locally. These environments may be hosted on infrastructure provided by Amazon Web Services (AWS), Google Cloud Platform (GCP), Microsoft Azure, DigitalOcean, Hetzner, and similar infrastructure providers. To access a demo environment, you may be required to authenticate through an external identity provider such as Google, Microsoft, or GitHub. When you do so, we receive the identity information your provider shares during authentication, which typically includes your name and email address. Your interaction with a third-party identity provider's authentication service is governed by their respective privacy policy.

Demo environments are temporary and are ordinarily reset or deleted within 90 days. Any data created within a demo environment, including session recordings, access logs, configuration, and test resources, is deleted as part of this cycle. The cloud provider hosting a given demo environment acts as our service provider and processes technical data necessary to deliver the hosting service. We act as the data controller for personal data processed as part of operating and administering demo environments.

Support and Communication​

We provide a support portal hosted by Atlassian on Atlassian's infrastructure (e.g., almaforge.atlassian.net), separate from the almaforge.com website. The support portal may use cookies or similar technologies necessary for authentication, session management, security, and functionality. We are the data controller for support data provided through this portal. Atlassian acts as our processor for support portal data. To use the portal, you authenticate with your email address and create a support account. When you submit a support request, we receive your name, email address, and the contents of your ticket, which may include technical details, configuration excerpts, or diagnostic information you choose to share. Atlassian may also collect platform-level data related to your use of their service. Providing an email address is necessary to receive support. Without it, a support account cannot be created and inquiries cannot be answered.

If you contact us by email or through a scheduling link, we receive and store the information you provide, such as your name, email address, company name, and the contents of your message.

We use information collected through support and direct communication solely to respond to inquiries, deliver support services, and manage the business relationship. We also process contact and license information for customer account and license administration, including delivery of software updates and management of active licenses.

How We Use Your Data and Lawful Basis​

We process personal data only when there is a valid legal basis under UK data protection law. Each processing activity and its lawful basis is set out below.

Securing the website and downloads — Cloudflare processes IP addresses and HTTP metadata to deliver, protect, and monitor the website and download infrastructure against abuse and attacks. Lawful basis: Legitimate Interests.

Operating demo environments — Cloud infrastructure providers process technical data to host temporary evaluation environments on our behalf. Identity providers share your name and email address when you authenticate. Lawful basis: Legitimate Interests.

Delivering support — Atlassian processes your name, email address, and ticket contents to operate the support portal. We use this data to troubleshoot issues and deliver agreed-upon support services. Lawful basis: Performance of a Contract and Legitimate Interests.

License administration — We process contact and license information to deliver software updates and manage active licenses. Lawful basis: Performance of a Contract.

Business communication — We process your contact information and message contents when you reach out by email or scheduling link. For pre-contract inquiries, we process your data on the basis of taking steps at your request prior to entering a contract. For ongoing relationships, the basis is legitimate interests. Lawful basis: Legitimate Interests and Taking Steps Prior to Entering a Contract.

Legal compliance — We process personal data where necessary to comply with applicable legal and regulatory requirements. Lawful basis: Legal Obligation.

Service Providers and Data Sharing​

We do not sell personal data.

We may share personal data with the following service providers, solely to the extent necessary to operate the website, downloads, and support services: Cloudflare (website and download hosting), Atlassian (support portal), email service providers, and professional advisors (legal, accounting).

We may also disclose personal data where required by law, regulation, or valid legal process.

Data Retention​

We retain personal data only as long as necessary for the purposes described in this policy. Server and CDN access logs are retained for no longer than 90 days unless a longer period is required for an active security investigation. Support portal data is retained for the duration of the support relationship and up to 12 months after the last interaction, subject to Atlassian's own retention practices. Email correspondence is retained for the duration of the business relationship. Demo environment data is deleted when the environment is reset, which ordinarily occurs within 90 days.

You may request deletion of your personal data at any time by contacting us at the address below.

International Transfers​

The website and download infrastructure are delivered through Cloudflare, which operates a global network. Cloudflare may process technical data in jurisdictions outside the United Kingdom as part of delivering and protecting the services, in accordance with Cloudflare's privacy policy and data processing terms.

The support portal is hosted by Atlassian, which may process data in jurisdictions outside the UK in accordance with Atlassian's privacy policy and data processing terms. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK data protection law, including reliance on the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs) as applicable.

Your Rights​

Under applicable data protection law, including UK data protection law and, where relevant, EU data protection law, you may have rights to access, correct, delete, restrict, object to, or port your personal data, and to withdraw consent where processing is based on consent. You may also complain to the UK Information Commissioner's Office or, where applicable, your local supervisory authority.

To exercise any of these rights, contact us at the address below. We will respond within one calendar month.

Security​

We use reasonable technical and organizational measures to protect personal data, including encrypted connections for website and portal traffic and access controls for support systems.

Cookies and Tracking​

The public AlmaForge website does not use cookies, analytics, or advertising trackers.

Separate services such as the support portal may use cookies or similar technologies necessary for authentication, security, session management, and service functionality. These may be set by the portal platform provider.

Changes to This Policy​

This policy may be updated from time to time. Changes will be posted on this page with a revised effective date.

Data Controller​

The data controller for personal data processed as described in this policy is:

Mezeware Limited, a company registered in England and Wales (No. 16069294, UK VAT No. GB507668762), whose registered office is at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom, and contact email is legal@almaforge.com.

For questions about this policy or to exercise your data protection rights, contact us at the email address above.