Privacy Policy

Last updated: November 10, 2026 · Effective November 5, 2026

This policy explains what personal information VektorForgeAI LLC (“VektorForgeAI”, “we”, “us”) collects, how we use it, who we share it with, and the choices you have. It covers our website (vektorforgeai.com) and our Services: your VektorForgeAI account (accounts.vektorforgeai.com) and each of our Platforms, currently Product Architect (app.vektorforgeai.com) and Program Forgemaster (forgemaster.vektorforgeai.com) and, when it launches, Systems Alloysmith, together with any Platform we add later. When a business uses the Services, that business decides what information its people put into them; that information is part of Your Content, and we process it on the business’s behalf and under its instructions. Our How VektorForgeAI uses AI page (our “AI page”), Security page and Subprocessors page form part of this policy. Some features are available only on some Platforms; where a feature isn’t available, we don’t collect the information it uses, and what this policy says about it doesn’t apply.

We do not sell your personal information, we do not use it for advertising, and we do not use Your Content to train AI models or allow our AI provider to train on it.

Key terms

Words such as Services, Platform, Your Content, personal information, account information, Feedback, customer feedback, AI features, AI provider, external AI assistant, plan limits, export, backups, Security Incident, service incident, vulnerability report, staff and subprocessor have the meanings in our Terms of Service. These terms are specific to privacy:

Authorized agent: someone you give written permission to make a privacy request for you.
Consent: under privacy law, your freely given permission for a specific use of your personal information, which you can withdraw at any time. Sharing something, connecting a third-party service or authorizing a Platform to use your account are choices you make under our Terms of Service, not consent in this sense.
Controller and processor: under European and UK data protection law, the controller decides why and how personal information is used; a processor handles it on the controller’s behalf and under its instructions.
Data protection authority: the government regulator responsible for privacy in a European country or the United Kingdom.
EEA: the European Economic Area, which is the European Union plus Iceland, Liechtenstein and Norway.
Global Privacy Control (GPC): a browser setting that asks websites not to sell or share your personal information.
Hashed (one-way fingerprint): scrambled by a mathematical function so the original, such as a password or IP address, cannot be read back, while a later copy can still be checked against it.
Legitimate interests: a legal basis under European and UK law that allows processing needed for a reasonable business purpose, when it is balanced against your rights.
Local storage: space in your web browser where a website can keep information on your own device; it works like a cookie but is not sent to us with every request.
Personal information: information that identifies, relates to or describes a particular person, or can reasonably be linked to them, directly or indirectly, such as a name, email address, IP address or account identifier. It does not include information that has been aggregated or de-identified so that it can no longer reasonably be linked to anyone. In the Data Processing Addendum it is called Personal Data. Personal information can be about you as an account holder (your account information) or about other people whose details you put into a Platform, such as your team members and customers (part of Your Content).
Records: information we keep about activity rather than content: AI usage records, AI safety signals, API request records, records of refused access attempts, alert records, sharing records, export records, error reports, server logs, billing records, records of staff actions (our audit log), records of deleted accounts and records of deleted programs. Each is described below, with how long we keep it.
Standard Contractual Clauses (SCCs): contract terms approved by the European Commission (with UK and Swiss equivalents) that protect personal information when it is transferred to a country such as the United States.
Webhook: a web address that one service gives another so it can send messages automatically, such as a Slack or Teams channel address for alerts, or a Product Architect metric’s intake address.

Information we collect

At a glance

Category	Examples	Where it comes from	What we use it for
Identifiers and contact details	Name, email address, job title and work phone (business contacts), account ID	You; someone who invites you (your email address)	Running your account, replying to you, sending service emails
Sign-in and security information	Password (hashed, held by our authentication provider), authenticator set-up, sign-in times, Platforms you have authorized	You; automatically when you sign in	Signing you in and protecting your account
Billing and plan information	Plan, billing period, subscription status, add-on pack purchases and the credits left on them, Stripe customer, subscription and payment IDs (never your card number)	You; Stripe	Billing, plan limits, accounting and tax
Information about other people in Your Content	Team members’ names, emails, roles and skills; customers’ and stakeholders’ names, emails and customer feedback; people you share with	You or your organization	Providing the Platform features you use, on your organization’s behalf
Activity records	Sharing, export and download records, AI usage records, AI safety signals, API request records, records of refused access attempts, records of staff actions	Automatically, as you use the Services	Plan limits, viewer expiry, showing owners who exported or downloaded their work, security
Device and technical information	Browser and device type, app version, error messages, IP address in server logs, a hashed IP address on website forms	Automatically	Fixing problems, preventing spam and abuse, security
Messages, Feedback and reports	Contact messages, feature suggestions, reasons for canceling, bug and service incident reports, screenshots you attach	You	Replying, fixing problems and deciding what to build
Third-party service and API information	Jira or ClickUp account identifiers and item status, Slack or Teams webhook addresses, API key names and fingerprints, metric intake address fingerprints, Stripe restricted keys (encrypted) and totals read from a Stripe account you connect	You; the third-party services you connect	Making the connections you set up work

What we don’t collect. We don’t collect payment card numbers, government ID numbers, health information, precise location, or information from data brokers, and we don’t use tracking or advertising cookies. Some state laws treat account sign-in details as sensitive personal information; we use them only to sign you in and protect your account.

In detail

Your VektorForgeAI account (account information). Your name, email address and password, and the authenticator app you set up for the multi-factor authentication we require. Passwords and authenticator secrets are handled by our authentication provider; passwords are stored only in hashed form, and we never see them. We also keep which Platforms and plans your account includes, which Platforms you have authorized to use your account, and when you signed in. Product Architect still has its own sign-in, and keeps the same kinds of account information for your Product Architect account until it moves to your VektorForgeAI account.

Your Content. Everything you create or upload in a Platform, such as products, programs, research, strategy and vision documents, requirements, roadmaps, risks, metrics, comments, files and images you attach, conversations with the Platform’s AI coach and AI research features, AI drafts waiting for your approval, notes you have asked the AI coach to remember, and the version history of your documents. Each Platform keeps its own content in its own database.

Information about other people that you enter. The Platforms let you record details about your team members (such as name, email, role and skills), your customers or stakeholders (such as names, email addresses and customer feedback) and the people you share with. This information is part of Your Content. You are responsible for having the right to share that information with us.

Please don’t put sensitive information into the Services, such as payment card numbers, government ID numbers or health information; our Acceptable Use Policy lists what the Services are not designed for.

Billing information. When you subscribe to a paid plan, payment is handled by Stripe on Stripe’s own pages. We receive your plan, billing period, subscription status and Stripe customer and subscription identifiers. We never receive or store your card number.

Messages, forms and Feedback. If you contact us, join a waitlist or send us Feedback, such as a feature suggestion or why you canceled a plan, we keep your name, email, the topic and your message so we can reply. Messages sent through our website forms also record the page you sent them from and a one-way hashed (not readable) version of your IP address, used only to stop spam. Feature suggestions you submit, and our replies, are visible to other users of that Platform so they can vote on them; your name and email are shown only to our staff. Please don’t include confidential information in a feature suggestion.

Business contacts. If you work with us or your organization is talking with us, for example about consulting, a Guided plan or our Platforms, we keep business contact details for you as a contact at that organization: your name, title, work email and phone, plus notes about our working relationship, such as agreements and projects. We use them only to manage that relationship.

Bug and service incident reports. If you report a bug or a service incident (an outage, error or data problem) from inside a Platform, we keep what you write, any screenshot you attach, and details collected automatically with the report: the page you were on, your browser and device type, the app version, what you were working in, and recent error messages from your browser, with emails, tokens and keys removed, plus your name and email so we can reply. Reports are visible only to you and our staff.

Screenshots. We never capture your screen; a screenshot is only an image you choose to attach to a report. Attaching one asks us to view what it shows, and we use it only to handle your report. We remove sensitive details from the automatic report details, but we cannot do that for an image. Before you attach a screenshot, crop it or black out anything sensitive, such as:

personal information about anyone (often called PII), such as names, email addresses, phone numbers or customer feedback;
health information, including protected health information under HIPAA;
payment card numbers, bank account details or government ID numbers, such as Social Security numbers;
passwords, API keys, tokens or other secrets;
anything else you are not allowed to share with us, such as another organization’s confidential information.

If you attach a screenshot with sensitive information by mistake, tell us and we will delete it.

Information from third-party services and API keys. If you connect Jira or ClickUp, we receive the information needed to make the connection work, such as account identifiers and the status of items you sync. If you set up Slack or Microsoft Teams alerts, we store the channel’s webhook address and post summaries of changes to it, including the names of the people who made them, and reminders, such as releases still waiting for their review and risks overdue for review, including each risk’s owner as written in the Risk Register. If you create API keys, we store each key’s name, its first few characters, a one-way fingerprint of the key (not the key itself), and when it was created, last used and revoked. If you turn on a metric’s intake address in Product Architect, we store its first few characters, a one-way fingerprint of the address (not the address itself), who set it up, and when it was set up and last used; it is deleted when it is turned off or replaced, or when the metric, the product or that person’s account is deleted. Each metric reading records whether it was entered by hand, sent through the API, sent to an intake address or read from Stripe. If you connect your own Stripe account to a product in Product Architect, you give us a Stripe restricted key, which we store encrypted, never show again (only its last four characters) and use only to read your Stripe data once a day and when you ask for a sync. From your subscriptions, charges, refunds and customers we work out totals, such as monthly recurring revenue, subscription counts, net revenue and the number of customers, and save only those totals as metric readings; we don’t save your Stripe customers’ names, email addresses or other details. The key is deleted when you disconnect Stripe, or when the product or the account of the person who connected it is deleted. This connection is separate from the Stripe account we use to bill you.

Usage and technical information.

AI usage records: which AI feature was used, the model, the amount of text processed and the number of web searches, to apply plan limits and control costs. They do not contain the text of your prompts.
AI safety signals: our servers check AI requests and AI answers (and, in Product Architect, content written through an API or sent to a metric’s intake address) for known manipulation patterns, such as instructions hidden in a document. When one is found, we record which check matched, where it was found (for example, in a request or in an answer), how many times, the account (and the API key, if one was used), the AI feature, the item and when, never the text itself. They are used only for security and kept for 12 months. If the same match is found again in the same item’s content within 24 hours, we record it only once.
API request records: (Product Architect) for each request made with an API key, including by an AI assistant you connect, or sent to a metric’s intake address, we record the key (if one was used), what was requested (the type of document and the item, or the product for an intake address), the result, how long it took and its size, and a one-way hashed version of the IP address it came from (not the address itself). They never contain the content sent or received, or the intake address. When a product is connected to Stripe, each sync is recorded the same way (the product, the result, how long it took and any error code), never the key or the numbers read. They are used to keep the API secure and are deleted after 90 days. To limit how often an intake address can be used, we also keep a count of recent requests for each hashed IP address, which is deleted once that IP address hasn’t sent anything for a day.
Records of refused access attempts: (Program Forgemaster) when someone who is signed in tries to open a program they don’t have access to, or to use a feature their role in a program doesn’t allow, we record their account identifier, the program (and, for an import, the Product Architect item), which part of the app refused, why, and the minute it happened, with the number of attempts in that minute. They never contain names, email addresses, IP addresses or content. They are used only to keep programs separate and secure: if one account is refused many times in a short period, our team is alerted. They are deleted after 90 days, or when the account is deleted.
Alert records: (Program Forgemaster) when the owner or a manager of a program dismisses or follows up one of its alerts (for example, a roadmap item slipping past its limit), we record which alert, what they did, the reason they gave for a dismissal, their name (or email address, if no name is set), role and account identifier, and when. Everyone the program is shared with can see them. They are kept for 12 months, or until the program is deleted. If the person’s account is deleted, their alert records stay with the program, shown as “Former member”, without their name, email address or account identifier.
Error reports: if something breaks in your browser, the page route (without query strings), the error message and stack trace, the app version and your browser’s user-agent string, with emails, tokens and keys removed. We do not record your IP address.
Sharing records: when you open something shared with you, we record the time. In Product Architect this lets a viewer’s access that goes unused for 90 days expire; the owner is emailed a week before. In Program Forgemaster the owner sees when each person last opened the program, and access ends only on a date the owner sets, if they set one. When someone exports content from a Platform, downloads it, copies it out or imports it into another Platform, we record who did it (their name and email), what, from which page and when; the owner can see these records, and so can our staff. In Product Architect, files a viewer exports or downloads show the viewer’s name, email and the date. In Program Forgemaster, files that anyone other than the program’s owner prints or downloads, including program and project managers, show that person’s name, email and the date.
Page-view analytics: Vercel Web Analytics counts page views without cookies and without identifying you; we strip query strings and page fragments first.
Server logs: our hosting and database providers automatically record technical details of each request, such as IP address, time and browser type, for security and troubleshooting, for the short period those providers allow.

How we use information

To provide the Services: sign you in, store your work, run the features you use, and let you collaborate with the people you invite.
To run AI features you request (see “AI processing” below).
To manage subscriptions, billing and plan limits.
To send service emails: account confirmation, password resets, sign-in and security notices, sharing invitations and reminders, notices to owners about inactive viewers, notices that a status report was published (in Program Forgemaster, only if you turn them on), plan-usage notices (also shown once in the app, and we record when you saw them), renewal reminders, payment problems and replies to your messages. We do not send marketing email unless you ask us to. You can turn off some notification emails in each Platform’s settings; account, security and billing emails cannot be turned off while you have an account.
To support you, investigate and fix problems you report, and respond to vulnerability reports and suspected Security Incidents.
To manage our relationship with your organization, kept in our internal records.
To learn from Feedback, understand how the Services are used and improve them, using usage records, error reports and aggregated analytics, not Your Content or AI conversations.
To keep the Services secure: prevent abuse, enforce plan limits and protect our users and systems.
To comply with law and enforce our Terms of Service.

AI processing

When you use an AI feature, the content needed for that request (your prompt, the relevant information from your work, and any files or images you attach) is sent from our servers to Anthropic, which provides the Claude models that power the AI features. AI features run only when you or someone you share with uses them; we do not send Your Content to AI in the background. AI research features can also search and read public web pages, using terms from your request. Anthropic processes this content to return a response and does not use data sent through its commercial API to train its models. Anthropic deletes this content within 30 days, unless it is flagged for violating Anthropic’s usage policies, in which case it may be kept for up to two years. Our AI page has more detail.

This section covers our AI features. If you connect an external AI assistant, such as Claude or Cursor, to your work through MCP or an API key, the information it retrieves is handled by that assistant’s provider under its own terms, even if the provider is Anthropic; it is not processed under our agreement with Anthropic.

Staff access

Only VektorForgeAI’s staff can use our internal admin tools, which are separate from the Platforms. Staff sign in with company accounts protected by multi-factor authentication. They can see account details (such as your name, email, plans and usage) to run the Services and support you, but never your passwords. Staff can change your plan, send you a password-reset link or sign you out of all sessions, for example to fix a billing problem or secure your account; they cannot edit Your Content. Viewing Your Content requires a recorded reason and is limited to 30 minutes at a time; we do this only to support you, at your request or with your permission, or when needed for security or legal reasons. Every staff action is recorded in our audit log, which cannot be changed and is kept for at least three years. If we view Your Content for security or legal reasons without your request, we will tell you afterwards unless the law prevents it. On a Guided plan or a consulting engagement, our consultant works in Your Content only through access you give them, such as inviting them as an editor or viewer, like anyone else you share with.

We share personal information only as described here.

Subprocessors that process personal information on our behalf, under written contracts that require them to meet the same data protection obligations as our Data Processing Addendum. They provide hosting and databases, AI models and web search, payments, email, staff sign-in, bot protection and issue tracking. Our Subprocessors page names each one, with its purpose, the data it handles, where it processes it and which parts of the Services use it.

Our databases and files are stored in the United States. Some subprocessors may process information in the United States and other countries where they operate, under the safeguards described in the section on the EEA, the UK and Switzerland. We update our Subprocessors page at least 30 days before we start using a new subprocessor.

Between our Platforms. Your VektorForgeAI account tells each Platform that uses it (today, Program Forgemaster) who you are and which plan you have. Product Architect still has its own sign-in and keeps this itself. A Platform receives Your Content from another Platform only when you ask, for example when you link or import work from one Platform to another. When you import, you approve it in the Platform the content comes from, and the receiving Platform keeps its own copy in its own database. That copy follows the receiving Platform’s retention and deletion rules. Deleting the original does not delete the copy, and changes to the original do not update it.

At your direction. When you share something, invite someone, connect a third-party service, set up alerts, or use an API key or external AI assistant with your work, we send the relevant information to the people or services you choose, which handle it under their own terms. People you collaborate with see your name and email on work you share with them or contribute to; in Program Forgemaster everyone a program is shared with sees the name, email and role of the owner and of each other person who has access, and the name on each comment, on each decision a sponsor records and on each alert someone dismisses or follows up.

For legal reasons. If required by law, to protect the rights, safety and security of our users, the public or VektorForgeAI, or to report suspected illegal activity to the authorities. If we report suspected illegal activity involving your account, we will tell you afterwards unless the law or an investigation prevents it. If we receive a legal demand for your information, we will tell you before we respond unless the law prevents it.

Business transfers. If VektorForgeAI is involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction, subject to this policy. We will notify you before your information becomes subject to a different privacy policy.

We do not sell personal information and do not share it for cross-context behavioral advertising.

Cookies and browser storage

The Services and our website do not use advertising or tracking cookies, and our analytics do not use cookies. To keep you signed in and remember your preferences, the Services store information in your browser’s local storage: your sign-in session, your current selections, cached AI coach conversations and display preferences. Your session ends when you sign out, 30 days after you sign in, or after 7 days without use; clearing your browser’s site data removes the rest. Because this storage is needed to provide the Services you asked for, we don’t ask for cookie consent. On a shared computer, sign out and clear your browser’s site data when you finish. Sign-in, sign-up, password-reset and website forms use Cloudflare Turnstile to block automated abuse; it may set a cookie needed for that protection.

We do not track you across other websites or sell or share your information, so browser “Do Not Track” and Global Privacy Control signals do not change how the Services or our website work.

How long we keep information

Account and content: while your account is active. Version history (in Product Architect, of your product documents, including requirements, roadmap items, sprints, tasks, metric check-ins and comments) is kept for 12 months, and after that the latest 50 versions of each item, plus its first version; versions you name and baselines are kept as long as the item exists. A comment’s history is kept only as long as the comment.
Deleted items: (Product Architect) a requirement, roadmap item, sprint, task or comment you delete goes to Recently deleted for 30 days; after that it is permanently deleted. An editor of the product can bring back a requirement, roadmap item, sprint or task, and a copy of its last version stays in the product’s version history under the rule above until the product is deleted. A comment can be brought back by its author or the product’s owner, and when it is permanently deleted, its history is deleted too.
Invitations: until accepted or declined; unanswered invitations expire after 30 days and are deleted 90 days after they expire. In Product Architect they are also deleted as soon as the invited address’s account is deleted. In Program Forgemaster, when an account is deleted, invitations still waiting for an answer are deleted if they were sent to an address Program Forgemaster already holds for that account (for example, because it accepted another invitation). Invitations that were accepted, declined or canceled in Program Forgemaster are deleted 90 days after they were answered or canceled, even if the account is deleted before then.
Sharing records: in Product Architect, viewer access expires after 90 days unused; in Program Forgemaster, access doesn’t expire from disuse and ends only on a date the owner sets, if they set one. Export records are kept for 12 months, or until the item or the person’s account is deleted.
Error reports: 30 days after the error last occurred.
API request records: 90 days.
Records of refused access attempts: (Program Forgemaster) 90 days, or until the account is deleted.
Alert records: (Program Forgemaster) 12 months, or until the program is deleted.
AI safety signals: 12 months.
Server logs: for the short period our hosting and database providers allow.
AI usage and billing records: as long as needed for plan limits, accounting and tax obligations; billing records up to seven years.
Messages, form submissions and Feedback, including feature suggestions: up to two years after we last reply.
Business contacts: while we have a relationship with your organization, and afterwards only as long as we need them for our records.
Bug and service incident reports: up to two years after the report is closed, including any screenshot and the copy in our Jira.
Records of staff actions (audit log): at least three years; entries are never changed or deleted before then. They include the account or item involved, but not Your Content.
Records of deleted accounts: three years, holding when the account was deleted and what was canceled and removed, with only a one-way fingerprint of the email address, so we can show the deletion was carried out.
Records of deleted programs: (Program Forgemaster) 12 months, holding the program’s identifier, the owner’s account identifier, when it was deleted, whether the owner or our staff deleted it, and how many records of each kind it held, but not its name or content, so we can show the deletion was carried out. If the owner’s account is deleted, the account identifier is removed from these records.

When your VektorForgeAI account is deleted, Your Content on every Platform that uses that account is deleted with it, including items you own (for everyone they’re shared with); today, that is Program Forgemaster. Product Architect still has its own sign-in and its own account: you delete that account in Product Architect’s Settings, which deletes Your Content in Product Architect in the same way. Until Product Architect moves to your VektorForgeAI account, deleting one account does not delete the other. In both cases, what you added to items other people own stays with those items for their teams, but shows as “Deleted user” (in Program Forgemaster, “Former member”) instead of your name or email, and anything assigned to you is unassigned. Your access to items other people shared with you ends. Billing records are kept as described above. Backups expire within 30 days, and anything left in them is deleted then. Canceling a paid plan does not delete any of this information. If an account on a Free plan has not been used for 24 months, we may delete it and its content after emailing you at least 30 days in advance.

Security

We protect your information with encryption in transit and at rest, multi-factor authentication, access controls in our databases so that each person can reach only their own and shared work, server-side checks on every request, and limited, logged staff access. No system is perfectly secure; if we learn of a Security Incident affecting your personal information, we will notify affected account holders without undue delay, and in any event within 72 hours after becoming aware of it, and as otherwise required by law. To report a suspected Security Incident, use a Platform’s “Report an incident” form and tick “Possible security issue”, or email security@vektorforgeai.com. Testing our security, including security research, needs our written permission in advance; our Security page explains how to ask and how to report a weakness, and has more detail.

Your choices and rights

Access and export: you can view your information in the Services and export Your Content in the formats each Platform offers.
Correction: you can update your name and edit Your Content at any time. To change your email address, contact us.
Deletion: you can delete items you own (as their owner), delete your VektorForgeAI account from your account settings and delete a Product Architect account from Product Architect’s Settings, or email us and we will delete either within 30 days. We email you a confirmation when your account is deleted. Some deleted items can be brought back for a short time, as described under “How long we keep information”; a deleted product, program or account cannot.
Email preferences: manage notification emails in each Platform’s settings.

Depending on where you live, you may have additional rights under state privacy laws, such as the right to know, access, correct or delete personal information, and to appeal a decision about your request. To make a request, email info@vektorforgeai.com. We will verify your request using your account email and will not discriminate against you for exercising your rights. We will respond within 45 days. If we decline your request, you can appeal by replying to our decision, and we will answer your appeal within 45 days; if you’re not satisfied, you can contact your state attorney general. An authorized agent can make a request for you with your written permission. We do not sell personal information, use it for targeted advertising, or use it for profiling that has legal or similarly significant effects, so there is nothing to opt out of.

Children

The Services and our website are for business and professional use by adults. They are not intended for anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us personal information, contact us and we will delete it.

Users outside the United States

VektorForgeAI is based in the United States, and the Services and our website store and process information in the United States. If you use them from elsewhere, your information will be transferred to and processed in the United States.

European Economic Area, United Kingdom and Switzerland. Our Services are offered to businesses in the United States, and we do not market them in these regions. If you use them from there anyway, this applies: VektorForgeAI LLC is the controller of your account information, billing and usage records, and the messages and Feedback you send us. For content your organization puts into the Services, including information about other people, your organization is the controller and we process it on its behalf under our Data Processing Addendum. We process personal information to perform our contract with you; for our legitimate interests (keeping the Services secure, preventing abuse, fixing errors and managing customer relationships), which we balance against your rights; to meet legal obligations; and with your consent where we ask for it, which you can withdraw at any time. For transfers from these regions we use the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss equivalents, including with our subprocessors; you can ask us for a copy. You have the right to access, correct or delete your personal information, to restrict or object to its processing, to receive it in a portable format (for Your Content, through the export features) and to withdraw consent. Email info@vektorforgeai.com and we will respond within one month. You can also complain to the data protection authority where you live or work.

Changes to this policy

We may update this policy at any time. Changes take effect when we post them here with a new date at the top. If a change is significant, we will also tell account holders by email or in the Services.

Contact us

VektorForgeAI LLC, 8401 Mayland Dr, Ste 1121, Richmond, Virginia 23294, United States

Email: info@vektorforgeai.com