Privacy Policy
Last updated: October 1, 2026
BookForge is the shop system for independent booksellers: point of sale, inventory, special orders, trade-ins, purchasing and a web shop. This policy explains what information BookForge handles, why, who helps us run it, and the choices you have.
Contents
§1Who we are
BookForge is operated by DerMar Consulting Group LLC (doing business as ForgeWorks), 3151 Cape Horn Rd, Unit #2092, Red Lion, PA 17356, USA ("we", "us", "our"). It runs at my-bookforge.com and on each store's own address, such as yourstore.my-bookforge.com. By using BookForge you agree to the practices described here.
§2Your data and your customers' data
BookForge holds two kinds of personal information, and we play a different role for each:
Your account. The details of the store owner and staff who sign in to BookForge. For this information we decide how it is used, so we are the controller.
Your customers. The shoppers, trade-in sellers and web-shop buyers your store records in BookForge. Your store decides what to collect and why, so your store is the controller and we process that information only on your instructions, as your processor.
If you are a customer of a bookstore that uses BookForge and you have a question about your information, contact that store first. We will help the store answer you.
§3What we collect
Account and store details
- Store name, store web address, address, tax settings and branding
- The owner's and staff members' names, email addresses, usernames and roles
- Passwords and register PINs, which we store only as one-way hashes
- Your plan, trial dates and billing status
What you record while running the shop
- Your catalog and inventory: titles, ISBNs, prices, costs, stock levels and suppliers
- Sales, refunds and register sessions, special orders, purchase orders, trade-ins and used-book buys, events, book lists and store credit
- Files you upload to import data, such as CSV or ONIX files and backups exported from another shop system
- Connection details for services you link, such as a WooCommerce site address and its API keys
- Feedback you send us from inside the app
Information about your customers
- Names, email addresses, phone numbers, postal addresses, birthdays and reading interests your store enters
- Purchase history, store credit and loyalty balances
- Whether each customer has agreed to marketing emails or texts
- Customer portal sign-ins, where the store turns the portal on (passwords stored as one-way hashes)
- Web-shop orders: the buyer's contact details, the items ordered and the payment status
- For trade-ins and used-book buys: the seller's name and contact details, as your store records them
Technical information
- IP address, browser and device type when you use BookForge
- Sign-in session records (a session identifier, its start time, IP address and browser), so you can see and end sessions
- Server logs of requests and errors
- Usage measurements from Google Analytics on our public pages and in the BookForge app (see §8)
§4How we use it
- To run BookForge for your store: ringing sales, tracking stock, filling orders and showing your reports
- To look up book details (title, author, cover, price) from ISBN and title searches
- To create your account, sign you in, and keep each store's data separate from every other store's
- To bill your subscription and manage your plan
- To send account emails: your welcome email, password resets, username reminders and notices about your account or billing
- To send the emails and texts your store chooses to send to its customers (see §6)
- To answer support requests and act on feedback
- To keep BookForge secure, and to detect and stop fraud and abuse
- To understand how visitors use our public pages, so we can improve them
- To meet legal obligations
We do not sell personal information, and we do not use your store's data or your customers' data for advertising.
§5Payments
Your BookForge subscription is billed through Stripe. Stripe collects your card or bank details on its own pages; we never see or store your full card number. We keep the Stripe customer and subscription identifiers that link your store to its plan.
Payments you take from your customers run through your store's own Stripe, Square or PayPal account, which you connect to BookForge. The payment provider handles the card details under its own privacy policy. BookForge keeps the account identifier, the order's payment status and the provider's payment reference, so the order can be marked paid. BookForge takes no cut of your sales.
§6Emails and texts to your customers
BookForge lets your store send email and text messages to its customers, such as new-arrival news, event invitations and special-order updates. BookForge sends marketing messages only to customers your store has marked as having agreed to receive them. Emails go out through Resend and texts through Telnyx, using the email address or phone number your store holds.
Your store is responsible for collecting that consent, honouring opt-outs, and following the laws that apply to marketing messages, such as CAN-SPAM and the TCPA in the United States, CASL in Canada and the GDPR in Europe.
§7Service providers
We use these companies to run BookForge. Each receives only what it needs for its job and handles it under its own privacy policy.
- Stripe
- Subscription billing, and card payments on your own connected Stripe account. stripe.com/privacy
- Square and PayPal
- Card and PayPal payments on your store's own account, only if you connect one. squareup.com/legal/privacy · paypal.com/privacy
- Hetzner
- Servers and database hosting, located in Germany. hetzner.com/legal/privacy-policy
- Cloudflare
- File storage (R2) for uploads such as cover images and imports, and the Turnstile check that keeps bots off our sign-up form. cloudflare.com/privacypolicy
- Resend
- Delivery of account emails and of the emails your store sends its customers. resend.com/legal/privacy-policy
- Telnyx
- Delivery of the text messages your store sends its customers, if you use texting. telnyx.com/privacy-policy
- Google Analytics measures visits to our public pages and the BookForge app. Google Books helps look up book details from an ISBN or title; only the search is sent. Google Fonts serves the typefaces on our public pages. policies.google.com/privacy
- ISBNdb and Open Library
- Book details and cover images looked up by ISBN or title. Only the search is sent, never information about you or your customers. isbndb.com · archive.org
- Anthropic and Telegram
- Feedback you send from inside the app is sorted by Anthropic's Claude (it receives the message and the page you sent it from), then forwarded to our team on Telegram with your store's name and your email address, so we can reply. anthropic.com/legal/privacy · telegram.org/privacy
- WooCommerce
- If you connect your own WooCommerce site, BookForge exchanges product, stock and order data with that site. Your site's own privacy policy applies there.
Some of these providers are in the United States. Where we transfer personal information from the European Economic Area or the UK, we rely on Standard Contractual Clauses or an equivalent transfer mechanism.
§9How long we keep data
- Store data, including your customers' information, is kept while your account is open.
- You can download all of your store's data at any time from the app's export page.
- When an account is closed, we delete its store data within 30 days, unless the law requires us to keep it longer.
- Billing and account records are kept for up to 7 years for tax and accounting purposes.
- Server logs are kept for up to 30 days.
- Your store can delete a customer's record at any time; ask us if you need help removing data completely.
§10Security
- Every connection uses HTTPS encryption.
- Passwords and register PINs are stored only as one-way hashes.
- Each store's data is kept separate from every other store's.
- Owners can review staff accounts and end sign-in sessions; changing or resetting a password signs out old sessions.
- Payment card details are handled by the payment providers, never stored by BookForge.
No system is perfectly secure, and we cannot guarantee absolute security. If we learn of a breach that affects your information, we will tell you as the law requires.
§11Your rights
Depending on where you live, you may have the right to:
- see the personal information we hold about you, and get a copy
- correct information that is wrong
- have your information deleted
- receive your information in a portable, machine-readable form
- object to, or ask us to limit, some uses of it
- complain to your local data protection authority
California residents have the rights to know, to delete, to correct and to non-discrimination under the CCPA. We do not sell or share personal information for advertising, so there is nothing to opt out of.
People in the EEA and UK: we process account information because we need it to provide the service you signed up for (contract), and for security, fraud prevention and improving BookForge (legitimate interests).
To use any of these rights, email info@my-bookforge.com. We will confirm your identity and reply within 30 days (45 days for California requests). If your request is about a store's customer records, we will pass it to that store, which decides how to respond.
§12Children
BookForge is a business tool for adults and is not meant for anyone under 18. We do not knowingly collect information from children for our own purposes. Stores are responsible for any information they record about their customers, including younger customers.
§13Changes to this policy
We may update this policy. If a change is significant, we will email account owners or show a notice in BookForge before it takes effect. The date at the top of this page shows the latest version.
§14Contact
Questions about this policy or your information? Email info@my-bookforge.com, or write to DerMar Consulting Group LLC (dba ForgeWorks), 3151 Cape Horn Rd, Unit #2092, Red Lion, PA 17356, USA.