Sub-processors
LegalForge is operated by Heron Networks LLC. These are the companies it uses to run the service, read from what the product actually calls. Each description of the vendor is its own, quoted from its own page.
Cloudflare (Cloudflare, Inc.)
What we use it for. Hosts the website and its Pages Functions, runs the Workers, stores the database in one SQLite Durable Object, and counts visits with Cloudflare Web Analytics.
What we send it. Everything LegalForge stores: the email on your account, the answers and text of any hosted document, the support messages you send, a one-way hash of your API key, and the mail log. Every request to the site reaches it.
Cloudflare says: “The information processed may include but is not limited to IP addresses, traffic routing data, system configuration information, and other information about traffic to and from Customers’ websites, devices, applications, and/or networks.” its page
Stripe (Stripe, Inc.)
What we use it for. Takes the payment for a paid plan through Stripe Checkout and tells LegalForge when a subscription starts, renews, fails or ends.
What we send it. The plan you chose and your email address. You enter your card on Stripe's page; LegalForge never sees the card number.
Stripe says: “Some Transaction Data is Personal Data and may include: your name, email address, contact number, billing and shipping address, payment method information (like credit or debit card number” its page
Brevo (Sendinblue SAS (Brevo))
What we use it for. Sends the transactional email LegalForge sends: your key after you subscribe, a sign-in link, the links to a hosted copy, a copy of a free policy you asked for, a payment-failed note and a law-change notice.
What we send it. The recipient address, the subject and the body of each of those emails, sent from send.heronnetworks.net.
Brevo says: “Send real-time email, SMS, & WhatsApp messages triggered via SMTP relay and API.” its page
Change log
- 2026-11-01: listed Cloudflare
- 2026-11-01: listed Stripe
- 2026-11-01: listed Brevo
No other company receives your data to run the service. We hold no security certification and claim none. The agreement that refers to this list is the Data Processing Agreement; the privacy page is here.
This page describes how LegalForge works and offers the agreement below as a starting point. It is not legal advice. Have a lawyer read any agreement before you sign it.