Privacy policy
Last updated 18 October 2026
Who we are
ForgeLot Civil is owned and operated by ELMAT GROUP PTY LTD (ABN 19 701 565 540, ACN 701 565 540), located in New South Wales, Australia. For the personal data described in this policy, ELMAT GROUP PTY LTD is the data controller and decides how and why that data is processed.
ForgeLot Civil
Operated by ELMAT GROUP PTY LTD
ABN 19 701 565 540 · ACN 701 565 540
Information we collect
We collect the information needed to run ForgeLot for you and your organisation, including:
- Account details, name, work email, organisation, and role, provided when you sign up or are invited to a workspace.
- Uploaded project files, DXF alignments, generated chainage and lot geometry, and any other project data you upload or create inside ForgeLot.
- Usage logs, sign-in activity, device and browser information, and interactions with the product, used to keep the service reliable and secure.
- Order and billing details, the name, email, billing address and country you give at checkout, plus your subscription and payment status. Card numbers are entered directly with our payment provider and never reach our systems.
Why we collect it
We use this information to provide and operate the ForgeLot service, to authenticate you and your organisation, to generate lot registers and exports on your behalf, to provide support, to maintain security and prevent misuse, and to improve the reliability of the product.
Legal basis for processing
Where applicable data protection law requires a legal basis, we rely on: performance of a contract (delivering the service you or your organisation has signed up for and processing your order), legal obligation (tax, accounting and invoicing records), legitimate interests (keeping ForgeLot secure and improving it), and consent where we ask for it specifically, such as for optional marketing communications.
Storage and security
Your data is encrypted in transit and at rest. Access to project data is limited to authorised members of your own organisation and to ForgeLot personnel who need it to provide support or maintain the service. We apply role-based access controls and monitor for unauthorised access.
Sub-processors
We use a small number of trusted third parties to operate ForgeLot. They only process data as needed to deliver their service to us and are bound by contractual confidentiality and security obligations.
- Vercel hosts the application. Supabase provides authentication, the database and original-file storage in Sydney, Australia.
- Mapping and satellite tile providers, used to render the basemap behind your alignments and lots.
- Paddle.com Market Limited, our reseller and Merchant of Record. Paddle receives your order and billing details to process payments, manage your subscription, handle refunds and customer billing enquiries, and meet sales tax and invoicing obligations. Paddle acts as a data controller for that payment data under its own privacy notice.
- Resend delivers sign-in codes, workspace invitations and contact-form messages. Our sending configuration uses its Tokyo region, so email addresses and message content may be processed overseas.
- Professional advisers and authorities, such as our accountants or legal advisers, and regulators or law enforcement where we are legally required to disclose information.
Data retention
We retain account and project data for as long as your account is active, and for a reasonable period afterwards to allow reactivation, meet legal obligations, or resolve disputes. You can request deletion of your account and associated project data at any time, subject to any retention we are legally required to maintain.
Your rights
Depending on where you are located, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact us at hello@forgelotcivil.com.
Cookies
We use essential browser storage to keep you signed in and remember workspace preferences. Paddle may use cookies or storage needed for secure checkout. We do not currently install Facebook advertising pixels or other third-party advertising trackers.
International transfers
Your data may be processed and stored in countries other than your own by our hosting and infrastructure providers. Where this occurs, we require appropriate safeguards to keep your data protected in line with this policy.
Changes to this policy
We may update this policy from time to time as ForgeLot evolves. If we make material changes, we will let account holders know by email or through the product.
Contact us
If you have any questions about this policy or how we handle your data, contact us at hello@forgelotcivil.com.