Privacy Policy

This Privacy Policy explains how Common Forge Ventures, LLC, d/b/a “Common Forge” (“Common Forge,” “we,” “us,” or “our”) handles personal data in connection with our website and the SPARC labor-planning platform (together, the “Service”). We are a U.S.-based company and the Service is intended for U.S. customers.

1. Common Forge roles in privacy and data

Our privacy responsibilities depend on whose data is involved:

When we act as a controller. For visitors to our website and the individuals who create and administer SPARC accounts, we decide how and why personal data is used. This policy describes those practices directly.

When we act as a processor / service provider. When a customer connects its systems or enters data about its workers, we process that personnel and skills data on the customer's behalf and under its instructions. The customer is the controller of that data. Our handling of it is governed by our agreement with that customer, not by this policy. If you are a worker whose data appears in SPARC, please direct privacy requests to your employer, who can instruct us accordingly.

2. Information we collect

We collect information you provide directly to us when creating an account, using the SPARC platform, or contacting us for support. This includes your name, email address, company information, and any workforce planning data entered into the platform.

We also automatically collect certain technical data when you access the Service, including IP address, browser type, device identifiers, pages visited, and usage activity logs to help us understand how the Service is used.

3. Information we collect

Account and contact data (controller). Name, email, phone, company, role, and credentials when you create an account, request a demo, or contact us.

Usage and device data (controller). IP address, browser and device type, identifiers, pages viewed, and activity logs, collected automatically when you use the Service.

Customer platform data (processor). Data our customers submit or connect, including:

•     Personnel data. Worker identifiers, employment details, certifications, and work history.

•     Skills data. Competencies and proficiency information captured by data entry, integration, or recorded interviews.

•     Job and project data. Used to generate labor-planning recommendations.

Integration data (processor). Data drawn from systems a customer authorizes us to connect, such as its ERP, payroll, or HR system.

Skills interviews (audio). Where skills are captured through interviews, the interview audio is recorded solely to produce a written transcript. We use only the resulting text transcript to extract skills information; we do not use voice recordings to identify individuals and we do not create voiceprints or other biometric identifiers.

4. How we use data

We use the information we collect to provide, maintain, and improve the Service; to process transactions and send related information; to send technical notices, updates, and support messages; and to respond to your comments and questions.

We do not sell your personal data to third parties. Your workforce data remains yours and is never used for purposes beyond service delivery and product improvement.

As a controller, we use account and usage data to provide, secure, maintain, and improve the Service; to process transactions; to send service and support communications; to respond to inquiries; and to meet legal obligations. For marketing emails, you may opt out at any time.

As a processor, we use customer platform data only to provide the Service to that customer and as the customer instructs, including generating labor-planning recommendations

We may use aggregated and anonymized data for internal analytics, benchmarking, and product development purposes.

5. Data sharing

We may share your information with third-party vendors and service providers that perform services on our behalf, such as cloud hosting, analytics, payment processing, and customer support. All third parties are contractually required to keep your information confidential and may only use it to perform services on our behalf.

The Service uses artificial intelligence (AI) and statistical models to extract skills and generate recommendations about which workers may suit particular jobs.

• Human oversight. These outputs are advisory. A qualified human at the customer makes the final decision on any consequential matter affecting a worker; the Service is not the sole basis for such a decision.

• AI service providers. We use third-party AI providers to process data on our behalf under confidentiality and data-protection terms.

Model training. We do not use customer personnel or skills data to train or fine-tune machine-learning models that serve other customers. We use only aggregated and de-identified data to improve the Service.

We may also disclose your information if required by law, regulation, or legal process, or to protect the rights, property, or safety of Common Forge, our users, or the public.

6. How we disclose data

We disclose personal data only to: service providers and subprocessors (cloud hosting, AI providers, analytics, payment processing, support) bound to use it only on our behalf; as required by law or valid legal process, or to protect rights, safety, and security; and in a business transfer (merger, acquisition, or sale of assets), with notice as required. Customer platform data is disclosed only as the customer instructs or as our agreement with the customer permits.

7. Data retention

We retain personal information for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by applicable law.

Upon account termination or deletion request, we will delete or anonymize your personal data within 90 days, except where retention is required for legal obligations, dispute resolution, or enforcement of our agreements.

8. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a portable copy of your personal data, and to opt out of certain processing.

• Workers in customer systems. Because we process your data on your employer's behalf, please send requests to your employer, who can instruct us. We will assist our customers in responding.

• Everyone else. To exercise rights for data we control, contact privacy@commonforge.co. We will respond within the time the applicable law requires (generally 45 days) and may need to verify your identity. You may use an authorized agent where the law allows.

California (CCPA/CPRA). California residents have rights to know, access, correct, delete, and to opt out of sale or sharing; we do not sell or share personal data. California's protections now extend to employee and business-contact personal data. We do not use sensitive personal data for purposes that require an opt-out. See the categories table below.

Colorado, and other states with comprehensive privacy laws. Residents of Colorado (where we are based) and other states with comprehensive privacy laws have access, correction, deletion, portability, and opt-out rights, and a right to appeal a denied request. To appeal, reply to our response or contact privacy@commonforge.co.

Categories of personal information (CCPA)

The following summarizes the categories we collect as a controller. Customer platform data we process on a customer's behalf is excluded from this table.

We collect these categories from you directly, automatically through your use of the Service, and from our service providers.

9. Security

We implement appropriate technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit and at rest, access controls, and regular security assessments.

However, no method of transmission over the internet is 100% secure. We encourage you to use strong passwords and notify us immediately if you suspect any unauthorized access to your account.

10. Where we process data

We are based in the United States and process data here. The Service is intended for U.S. customers, and we do not currently target or knowingly serve customers in the European Economic Area or the United Kingdom. If you access the Service from outside the United States, you understand your data will be transferred to and processed in the United States.

11. Cookies, tracking, and choices

We use cookies and similar tracking technologies to collect and track information about your use of the Service, to maintain your session, and to remember your preferences. Essential cookies are required for the Service to function properly.

You can configure your browser to refuse all cookies or to notify you when a cookie is being sent. However, some features of the Service may not function properly if cookies are disabled.

Global Privacy Control (GPC). We honor recognized opt-out preference signals, such as GPC, sent by your browser.

12. Children's privacy

The Service is intended for businesses and is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe we have, contact us and we will delete it.

13. Changes to this policy

We may update this Policy from time to time. We will post the updated version here, change the “Last updated” date, and, for material changes, provide additional notice (e.g., email or an in-product notice).

14. Contact

Privacy questions or requests: privacy@commonforge.co, or write to Common Forge, 1073 South Pearl St., Suite #101, Denver, CO 80209.