Data Processing Agreement

LegalForge is operated by Heron Networks LLC. If your company needs a Data Processing Agreement before it uses LegalForge, this page is it: what we process, the eight points GDPR Article 28(3) says such an agreement must cover, and the companies we use. For a countersigned copy, ask through Contact.

What we process, and what we do not

LegalForge does not receive the visitors of your website. The personal data it processes is what you give it: the email on your account, the business name, website, contact email, country and practices in your answers (a contact email can identify a person), the text of your hosted documents, the messages you send through Contact, and the Stripe identifiers of your subscription. You are the controller of that data; LegalForge acts as your processor for it.

What the product does with it

  • Your API key is stored only as a one-way hash, so LegalForge cannot read it back.
  • LegalForge never sees your card number; Stripe collects and holds it.
  • The mail log records a keyed, daily-rotating code derived from the requesting IP address, never the address itself.
  • A hosted copy can be removed by whoever holds its private edit link; the answers and text are deleted with it.
  • Requests to the paid API and the public entry points are rate-limited per network.

Our obligations (GDPR Article 28(3))

  1. Written instructions. LegalForge processes the personal data you give it only to provide the service you use: to generate, store and host your documents, to run your account and to send the emails listed above. Your use of the website, API, MCP server or command line, and what you enter, are your instructions.
  2. Confidentiality. Access to the stored data is limited to the people who run LegalForge, who treat it as confidential. The database is not exposed publicly: it is reachable only through the product's own routes and one key-protected export.
  3. Security of processing. The measures that exist are the ones in the list above (hashed API key, no card data, keyed daily IP code, rate limits), plus encryption in transit provided by Cloudflare. LegalForge holds no security certification and does not claim one.
  4. Sub-processors. You give general authorisation for the sub-processors listed on the sub-processor page. Any addition or replacement is added to its dated change log before it takes effect; if you object, tell us through Contact and stop using the service.
  5. Help with data-subject rights. If someone asks you for access to, correction or deletion of data held in LegalForge, send us the request through Contact and we will act on it.
  6. Help with Articles 32 to 36. On request we give you the information we have to support your own security, breach-notification and impact-assessment duties, and we tell you without undue delay if we learn that personal data we process for you was breached.
  7. Deletion or return. When you stop using the service, ask through Contact and we delete the account data and hosted documents we hold for you. The privacy page says what else is kept.
  8. Information and audits. We answer written questions about how your data is handled. LegalForge has no third-party audit report to hand over and does not claim one; a customer that needs more should say so through Contact before buying.

Sub-processors

Cloudflare, Stripe, Brevo. What each receives and why, with a dated change log, is on the sub-processor page.

Certifications

None. LegalForge holds no SOC 2, ISO 27001 or similar certification and does not claim one.

When you need a lawyer, not this page

  • personal data goes outside the EU, EEA or UK (you need a transfer mechanism, not a sentence)
  • you handle health, financial, biometric or children's data, or any other special category of data
  • the customer sends you its own DPA, or asks for custom liability caps, audit rights or breach deadlines
  • you act as a controller for some of the data and as a processor for the rest
  • a regulator, a large customer or an insurer has asked for specific wording

This page describes how LegalForge works and offers the agreement below as a starting point. It is not legal advice. Have a lawyer read any agreement before you sign it.