Privacy Policy

Information we handle

• Website activity. Our hosting and security providers may receive your IP address, request details, and browser information to serve and protect the site. The signed-in app uses cookies or similar storage to keep your session active and secure.
• Accounts and workspaces. We receive account and organization identifiers, workspace names and membership information, and contact and billing email addresses through your account or workspace. We record which terms were accepted, who accepted them, when, and the associated IP address.
• Forwarding and verification. A workspace administrator gives us destination email addresses and configures which number forwards to each address. We record whether and when each recipient verifies that address. Telnyx provides incoming message text and routing information such as sender, assigned number, message identifier, and time. We use the text to filter abuse and deliver eligible messages, and we record delivery status and counts.
• Billing and support. When purchasing is available, FastSpring collects payment information directly. We receive order, contact, and subscription information needed to provide the service and assist with billing. We do not receive full card numbers. If you contact us, we use the details you submit to respond and investigate. Please do not send passwords or verification codes to support.

How we use information

We use information to operate accounts and workspaces, verify destinations, route SMS, provide support, administer subscriptions and refunds, prevent abuse, and meet legal obligations. Where data protection law requires a lawful basis, we rely on contract performance when necessary to provide the service to you, legitimate interests in operating and securing the service and preventing misuse, and compliance with legal obligations. Where we rely on consent, you can withdraw it for future processing.

Who receives information

Service providers handle information needed for their role: website hosting and security, Clerk for sign-in and workspaces, Neon for database hosting, Telnyx for incoming SMS, Inngest for delivery jobs, and ZeptoMail for verification and forwarding email. FastSpring handles checkout and payment as merchant of record under its own privacy statement.

Incoming message text is sent to the verified inboxes selected by the workspace. Workspace administrators manage destinations and can access delivery status when delivery history is available. We may also disclose information as required by law or as necessary to protect the service or others from fraud, abuse, or security threats. We do not sell personal information or share it for cross-context behavioral advertising.

Message content and retention

Delivery history is limited to details such as sender, time, and delivery status. We do not show SMS bodies in the dashboard logs. The app encrypts the message body before placing it in the processing queue. It clears the temporary database copy when delivery succeeds or fails permanently. Delivery attempts expire 24 hours after receipt; scheduled cleanup removes temporary database copies that remain after expiration.

An encrypted event in the delivery provider’s system, records held by messaging and email providers, and copies in recipients’ inboxes follow separate retention practices. Removing a destination stops future forwarding to it and does not recall already delivered emails. We keep account, routing, delivery metadata, support, and transaction records for as long as needed to operate the service, investigate abuse, resolve disputes, and meet legal and recordkeeping obligations.

Location, choices, and privacy rights

We operate from the United States. Information may be processed in the United States or other countries where our providers operate. Where applicable law requires a safeguard for a transfer, we use an approved mechanism and you can contact us for details about the safeguard that applies.

You can ask us to access, correct, or delete personal information, or exercise other rights available where you live. These may include requesting a copy, restricting or objecting to certain uses, withdrawing consent, and complaining to your local data protection authority. Contact support@forward2fa.com to make a request. We may verify your identity. If a customer controls the information at issue, we may direct your request to that customer. If you received an unexpected destination verification email, do not confirm it; contact us if you want help removing the address.

Forward2FA is for business account administration and is not directed to children. We will post updates to this notice and give notice of material changes as required by law.