End-User Privacy Policy

Introduction

This Privacy Policy describes how information is collected, used, and protected when you use an application ("App") built on the GenieForge platform operated by GenieForge Technologies Inc. ("GenieForge," "we," "us," or "our").

The individual or organization who built the App (the "App Owner") is the controller of your information (or equivalent under applicable law). GenieForge processes your information on behalf of the App Owner as a processor / service provider (and, where a Business Associate Agreement applies, as a Business Associate).

Your use of the Platform as an End-User is also subject to the End-User Platform Terms.

Information We Collect

What is collected depends on how the App Owner configures the App. Common categories include:

Information You Provide

Account information: Name, email address, and credentials (passwords are stored in irreversible hashed form)
Conversation content: Messages you send to and receive from the AI assistant
Activity responses: Inputs you provide during guided activities, forms, assessments, uploads, or other interactive features
Public or intake forms: Information you submit through forms or QR/intake flows that do not require an account, if the App Owner enables them

Information Collected Automatically

Usage data: Timestamps of sessions and features used within the App, including which pages you open and which forms or jobs you complete. This is first-party operational telemetry for the App Owner (and, for HIPAA-enabled Apps, is kept for a shorter window and is not sent to a third-party analytics product). It does not include the contents of your messages, form field values, or file names.
Device information: Browser and device type (used for display, security, and reliability)
IP address: Logged for security, abuse prevention, and operational purposes
Form captcha: If the App Owner turns on captcha for a form, our captcha provider (currently hCaptcha) may receive your IP address and device or browser signals to check that a human is submitting the form. Captcha is not available on HIPAA-enabled Apps.
Device sensors: If the App Owner enables features such as barcode scanning, the App may use your device camera with your permission in the browser. We do not use camera images for GenieForge advertising.
Required acknowledgements: The App Owner may require you to accept a privacy notice or complete other required steps (for example a waiver) before you can use the App. Those acknowledgements and any text you submit are stored as part of providing the App.

Payments

GenieForge's own Platform billing for App Owners is separate from your use of an App. An App Owner may configure payment or billing features inside an App (for example via a connected payment provider such as Stripe or Stripe Connect). Card numbers and other sensitive payment credentials are processed by the payment provider; GenieForge does not store raw card numbers. An App or the Platform may still process payment-related metadata (for example payment status, customer or subscription identifiers, or invoice references) under the App Owner's instructions. GenieForge does not use End-User payment card data to bill you for Platform subscriptions.

Information We Do Not Collect for Advertising

We do not use third-party advertising trackers on End-User portal or intake surfaces
We do not collect biometric data for GenieForge Platform advertising
We do not collect precise GPS geolocation by default

How Your Information Is Used

Your information is used to:

Provide the App's services as configured by the App Owner (conversations, tools, forms, notifications, and related features)
Maintain your account and authenticate sessions
Support the App Owner so they can deliver their services to you
Ensure security and maintain audit logs of security-sensitive events as described in our security practices
Send notifications configured by the App Owner
Operate and secure the Platform under the App Owner's instructions (hosting, authentication, AI runtime, abuse prevention)

GenieForge may review App Owner blueprints and Builder conversations to improve the Platform. End-User business data and End-User chat are not the focus of that product-improvement review. App Owners can also submit usage signals and enhancement proposals about how people use the App. Those items store title and description text in Platform staff-review tables, cluster similar items with embeddings, and are reviewed by authorized GenieForge staff. If your information appears incidentally in materials GenieForge reviews for support, security, or (for non-HIPAA Apps) Platform operations, including usage signals and enhancement proposals, it remains subject to our processor / Business Associate obligations. HIPAA-enabled Apps under a BAA are excluded from product-improvement inspection of App content and conversations except as permitted under the BAA (including processing of usage signals and enhancement proposals as named in the BAA).

We do NOT use your information to:

Train AI models on your conversations (Platform policy)
Serve third-party advertisements
Sell your data to data brokers
Profile you for GenieForge's independent marketing

AI Processing

Your conversations and related App context may be processed by AI services to generate responses in real time, under the App Owner's configuration.

Your conversations are not used by GenieForge to train or improve foundation AI models
AI providers act as subprocessors of the Platform; for Apps in HIPAA mode under a BAA, AI processing is limited to providers permitted for that mode (see /subprocessors)
The App Owner may enable optional tools or integrations that send data to additional third parties they choose

AI outputs can be inaccurate. They are not a substitute for professional advice unless the App Owner expressly provides such services under their own relationship with you.

Data Storage and Security

Your information is protected with technical safeguards we consider reasonable for a service of this type, including:

Encryption in transit and at rest for stored and transmitted data
Access controls limiting Platform access to authorized personnel and systems
Audit logging of security-sensitive access and administrative actions, as described in our security documentation
Automatic session expiration after periods of inactivity (with shorter timeouts for HIPAA-mode Apps)
Isolation of App workspace data from other customers' Apps

No security program is perfect. If you have concerns, contact the App Owner or privacy@genieforge.ai.

Data Sharing

We share your information with:

Recipient	Purpose	Basis
The App Owner	Delivering their services to you	Your relationship with the App Owner
Infrastructure and Platform subprocessors	Hosting, AI inference, email, and related Platform operations	Data processing / Business Associate arrangements
Third parties the App Owner connects	Integrations, webhooks, or tools the App Owner enables	App Owner's instructions and your relationship with them

We do NOT sell your data. We do NOT share data with advertisers or data brokers for their own marketing.

We may disclose information if required by law (for example, a valid court order or subpoena), to protect rights and safety, or in connection with a merger, acquisition, or asset sale (with appropriate safeguards).

See /subprocessors for Platform subprocessors. Customer-directed destinations chosen by the App Owner are controlled by the App Owner, not listed as GenieForge's independent marketing partners.

Data Retention

Data Type	Retention Period
Account information	Until account deletion or App Owner termination of the App/workspace
Conversations, entries, and uploads	Until deletion by you (where offered), the App Owner, or App/workspace termination
Security and audit logs	As required by applicable law and security obligations

After retention periods expire, data is deleted or anonymized from active systems, subject to limited backup windows.

Your Rights

Depending on your jurisdiction, you may have the right to:

Access a copy of the information held about you
Correction of inaccurate information
Deletion of your account and associated data (subject to legal retention requirements)
Breach notification where required by law
Restrict or object to certain processing

To exercise these rights, contact the App Owner first. The App Owner will coordinate with us as needed. You may also email privacy@genieforge.ai; we will route requests to the App Owner when appropriate. We aim to help fulfill requests within 30 days, or within the period required by applicable law.

Healthcare Applications (HIPAA)

If the App Owner is a healthcare provider (or Business Associate) and has enabled HIPAA mode for the App under a signed Business Associate Agreement with GenieForge, your information may be treated as Protected Health Information (PHI) under HIPAA. In that case:

GenieForge operates as a Business Associate under that agreement
Additional technical safeguards apply in accordance with the HIPAA Security Rule and the BAA
Portal sign-in may require an authenticator app (multi-factor authentication) after your password
HIPAA individual rights (access, amendment, accounting of disclosures) are exercised primarily through the App Owner (Covered Entity), with GenieForge providing assistance as required
You may file a complaint with the U.S. Department of Health and Human Services: https://www.hhs.gov/hipaa/filing-a-complaint/

Enabling HIPAA mode, or using HIPAA features, does not by itself establish that an App or App Owner is compliant with HIPAA, and is not a certification of the App Owner's overall practice.

International Users

GenieForge Technologies Inc. is based in Canada. Infrastructure is hosted in the United States. Personnel in Canada may access systems and data as reasonably necessary to operate, support, and secure the Platform. Your use of the App may involve transfer and processing of your information in the United States and Canada, unless a different arrangement is required by the App Owner's agreement with you. We may rely on legally recognized transfer mechanisms and safeguards permitted by applicable law.

Children's Privacy

Apps on GenieForge are not directed by GenieForge at children under 13. If an App Owner serves minors, the App Owner is responsible for obtaining appropriate parental or guardian consent and complying with applicable children's privacy laws.

Changes to This Policy

We may update this Privacy Policy to reflect changes in practices or legal requirements. Material changes will be communicated through the App Owner or within the App where practicable. The Version and Last Updated date identify the current Policy.

Contact

App Owner: Contact the individual or organization who provides the App to you
GenieForge (Platform): privacy@genieforge.ai
Entity: GenieForge Technologies Inc.