Waitlist Contact us
Contact us

Privacy Policy

Updated October 2, 2026

Privacy Policy

Effective Date: October 2, 2026

This Privacy Policy describes how CarbonForge Systems Inc. ("CarbonForge", "we", "us", "our") collects, uses, discloses, and safeguards personal information in connection with our website, our energy-optimization software, and our hosted inference API (together, the "Services"). It follows Québec's Act respecting the protection of personal information in the private sector (Law 25) and Canada's PIPEDA first, and explains below what changes if the EU or UK GDPR applies to you. Capitalized terms not defined here have the meaning given in our Terms of Service. Where a Customer has signed a Data Processing Addendum, that addendum governs our processing of personal information within that Customer's Customer Content, and this Privacy Policy governs all other personal information we process in connection with the Services.

The short version, because our two products handle data very differently:

  • Our energy-optimization software runs inside our customers' own infrastructure. For it, we do not host AI workloads and we never see the content processed (no models, weights, prompts, inference inputs or outputs, or datasets); that exclusion is built into the software's design, not a configuration option.
  • Our hosted inference API does receive the requests you send, in order to process them and return a response. The "Hosted Inference API" section governs what we receive and how long we keep it. We never use that content to train, and requests routed to us by a platform such as OpenRouter are processed to generate a response and are not retained afterward.
  • We do not sell personal information, and never have.

 

1. Who We Are

CarbonForge Systems Inc. is the organization accountable for the personal information described in this Privacy Policy and for compliance with applicable privacy law with respect to it. Our Privacy Officer, the person in charge of the protection of personal information under section 3.1 of the Québec Act, can be reached at privacy@carbonforge.ai, CarbonForge Systems Inc., 6666, rue Saint-Urbain, Montréal (Québec) H2S 3H1, Canada.

 

2. The Products This Covers

  • Website, portal, sales, support, and recruiting: ordinary business contact and usage information, as described below.
  • Energy-optimization software (Local Deployment): runs in the customer's environment. What reaches us is content-free operational telemetry, never Customer Content. See Section 6.
  • Hosted inference API (Hosted Service): requests sent to our inference endpoints directly by API customers or routed to us by a platform such as OpenRouter. See Section 5.

 

3. Personal Information We Collect, and For How Long

  • Account and contact information (name, business email and phone, job title, employer, credentials): to create and administer accounts and orders. Kept for the contract, then 12 months (portal accounts), or 24 months after the last interaction (forms and prospects).
  • Order and billing information: to process orders and payments and meet tax obligations. Kept for the contract, then 7 years.
  • Support and communications: the content of your request and associated account details. Kept for the contract, then 12 months.
  • Website usage (IP, device and browser, pages, cookies): to operate and secure the site and, with consent, to measure our audience. Kept 13 months.
  • Product telemetry from the software (random instance ID, hardware and driver and runtime versions, summary timing and energy measurements, recipe metadata, quality-check results, error events): to support the software, verify licence scope, and improve our energy models. Content-free by design. Kept 12 months linked to an instance, then only as aggregated, de-identified signals.
  • Hosted inference API Request Content and metadata: see Section 5.

Our legal bases under the Québec Act and PIPEDA are your consent (express for the newsletter and any tracking technology), the necessity of performing a contract, and compliance with legal obligations. Newsletter messages identify us and carry a working unsubscribe link, honoured within ten days, as CASL requires. Telemetry is designed to contain no personal information; if an error log nevertheless identifies a person we treat it as personal information, delete it within fifteen days of learning of it, and fix the logging.

 

4. How We Use Personal Information

To provide, operate, maintain, secure, and support the Services; to administer accounts, orders, and payments; to respond to support; to send administrative and, with consent, marketing communications; to detect and prevent fraud, misuse, and security incidents; to improve the Services through content-free telemetry and Service Data; and to comply with law and enforce our agreements. We do not use Customer Content, or hosted inference API Request Content, to train, fine-tune, or evaluate any model, and we do not sell, rent, or share it.

 

5. Hosted Inference API

This section covers requests to our hosted inference endpoints, whether sent directly with a CarbonForge API key or routed to us by a platform such as OpenRouter. Inference under this section runs on infrastructure in the United States.

What we receive. Prompts, system instructions, tool definitions and arguments, and generated outputs (together "Request Content"), plus request metadata (request ID, timestamp, model, token counts, latency, status code, and the API key or partner identifier used). Request Content may contain personal information if you include it; please avoid sending sensitive personal information you do not need to send. A platform such as OpenRouter normally routes a request to us without the end user's identity, and that platform's privacy policy governs what it collects from you.

How we handle it.

  • No training, no sale. We do not use Request Content to train, fine-tune, evaluate, or improve any model, and we do not sell, rent, or share it.
  • Platform-routed traffic (such as OpenRouter). Request Content is processed to generate a response and is not retained after the request is served; we do not log its prompt or completion content.
  • Direct API traffic. Request Content may be retained in access-controlled operational traces to debug, secure, and investigate abuse of the service. We minimize what is kept, remove Request Content on your written request, and are establishing a defined retention period and deletion process for it. Content-free request metadata is kept as long as necessary for billing, reconciliation, and abuse prevention.
  • Human review. Our staff do not review Request Content, except for direct-API traces when needed to resolve a support case or a security incident, under role-based access.
  • Derived computation state, such as prompt caches, may remain in GPU memory briefly to speed later requests; it is never written to storage.

 

6. Our Role for Software Telemetry and Customer Content

For the energy-optimization software (Local Deployment), the software runs in the customer's environment, we do not host the workload, and Customer Content never leaves that environment except where the customer expressly provides it to us for support. Where personal information nevertheless forms part of data a Customer provides to us, CarbonForge acts as a service provider or processor on that Customer's behalf and processes it under the Customer's instructions; where a Data Processing Addendum is in place, it governs that processing.

 

7. Cookies and Similar Technologies

Cookies that identify, locate, or profile you (our analytics and any marketing cookies) are off by default and run only if you turn them on; strictly necessary cookies run without consent. You can see the current list, with purpose and duration, and change your choice at any time, in Cookie preferences. Where law requires, we request consent before placing non-essential cookies and provide a way to withdraw it.

 

8. How We Disclose Personal Information

We do not sell personal information. We disclose it to: service providers bound by written agreement and authorized to use it only to serve us (HubSpot for website, forms, CRM, and newsletter; Google Workspace; Google Analytics with consent; Amazon Web Services and Google Cloud Platform for the portal, telemetry endpoint, and internal systems; a third-party cloud GPU provider for the hosted inference API; Intuit QuickBooks for invoicing); in a corporate transaction under confidentiality safeguards; where a law of Québec or Canada requires it; and with your consent.

 

9. International Transfers and Processing

Our website, portal, and telemetry providers store and process personal information in the locations their services use, which may be in Canada or elsewhere, and their staff may access it from other countries, including the United States, for support and maintenance. Our hosted inference API runs in the United States, so Request Content and its metadata are processed there. Storage in Canada is not storage in Québec. Before communicating personal information outside Québec we conduct the assessment required by section 17 of the Québec Act and put appropriate contractual protections in place with the recipient. Using our site, portal, or inference API informs you that this may happen; it does not by itself constitute your consent to it.

 

10. Data Security

Access is limited by role. Authentication secrets are stored hashed or encrypted and access keys are revocable and rotatable. Traffic is encrypted in transit using TLS 1.2 or higher, and we use multi-factor authentication on our core systems. The hosted inference API uses dedicated credentials per route and keeps the platform-routed path separate from our direct-customer systems. We are an early-stage company and hold no third-party security certification such as SOC 2 or ISO/IEC 27001; we describe our practices as they are rather than warranting standards we have not certified. No method of transmission or storage is completely secure.

 

11. Retention

We keep personal information only as long as necessary for the purposes it was collected for, per the periods in Section 3 and the Hosted Inference API rules in Section 5, and to meet legal, accounting, and dispute-resolution needs, then destroy, erase, or anonymize it.

 

12. Your Rights and Choices

In Québec and elsewhere in Canada: access, rectification, withdrawal of consent, de-indexation where the law provides, and portability of the computerized information you gave us. Write to privacy@carbonforge.ai; we acknowledge within two business days and answer within thirty days. If we refuse, we give reasons and tell you how to complain to the Commission d'accès à l'information (Québec) or the Office of the Privacy Commissioner of Canada. If the EU or UK GDPR applies, our bases are consent, performance of a contract, and legitimate interests; you also have erasure, restriction, objection, and portability rights, and for transfers we rely on the European Commission's adequacy decision for PIPEDA-subject organizations and on Standard Contractual Clauses or another lawful mechanism where it does not apply, including for Request Content processed in the United States. We do not profile individuals or make automated decisions producing legal or similarly significant effects.

 

13. Data Incidents

We keep an incident register, assess the risk of serious injury, and notify the Commission d'accès à l'information and affected individuals where that risk exists, as sections 3.5 to 3.8 of the Québec Act require. If an incident affects a customer's portal account, access keys, telemetry, or hosted inference API credentials or Request Content, we notify that customer within seventy-two hours of confirming it.

 

14. Children's Information

The Services are for business use and are not directed to anyone under 14; we do not knowingly collect their personal information, and will delete it if we learn we have.

 

15. Changes

We may update this Policy by posting a new version with a new effective date; where changes are material or reduce protections we give the notice the law requires and, for platform partners, at least 30 days' notice.

 

16. Contact

privacy@carbonforge.ai. Privacy Officer under section 3.1 of the Québec Act. CarbonForge Systems Inc., 6666, rue Saint-Urbain, Montréal (Québec) H2S 3H1, Canada.