Forge Signals Privacy Policy
Version 1.0
Effective date: 2025-12-28

1. Who we are
   Forge Signals is operated by Heron Group LLC (”Heron”, “we”, “us”).

Contact

• Email: info@theherongroupllc.com

• Mail: 8 The Green #11713, Dover, DE 19901

2. What this policy covers
   This Privacy Policy explains how we collect, use, share, and retain personal information when you subscribe to, read, comment on, or purchase from Forge Signals (the “Services”).

If you use Substack to access the Services, Substack also collects and processes information as the platform provider under its own Privacy Policy. (Substack)

3. Roles: who is the controller
   For Forge Signals subscriber and audience data, publishers are generally the data controllers and Substack acts as a data processor for that audience data. (Substack Support)
   Substack may also be a data controller for some data it collects independently of a publisher-reader relationship. (Substack Support)

4. Personal information we collect
   Depending on how you use the Services, we may collect:

• Identity and contact

  • Email address (required to subscribe)

  • Name (if you provide it)

• Subscription and transaction

  • Subscription status (free/paid)

  • Purchase history

  • Payment status and billing metadata

  • Note: payment card details are handled by Substack and its payment processors, not stored by us. (Substack)

• Usage and device

  • Interactions with emails and posts (opens, clicks)

  • Basic device and browser data (as provided by the platform)

• Community content

  • Comments and replies you post

5. How we use personal information
   We use personal information to:

• Deliver the newsletter and provide access to posts and archives

• Process subscriptions and provide customer support

• Improve content and understand what is useful (analytics such as opens and clicks)

• Enforce our Terms, prevent abuse, and protect the Services

• Communicate service updates (for example, billing or access changes)

6. How we share personal information
   We share personal information only as needed to operate the Services:

• Platform providers and processors

  • Substack processes subscriber and delivery data to run the publication. (Substack)

• Payment processors

  • Payments are processed through Substack and underlying payment providers. (Substack)

• Legal and safety

  • If required to comply with law, enforce our policies, or protect rights and safety

If you communicate a privacy complaint about editorial content through Substack, Substack notes it may route that notice to the appropriate data controller (the publisher/creator). (Substack)

7. Other properties (storefront and books)
   Forge Signals may link to other services we use for distribution:

• Payhip (storefront) has its own Privacy Policy and acts as a data controller for its platform operations. (Payhip)

• Leanpub (ebooks) has its own Privacy Policy governing purchases and reader accounts there. (Leanpub)

If you buy through those services, your information is also processed under their policies.

8. Cookies and tracking
   The Services may use cookies and similar technologies via the platform provider to:

• Keep you signed in

• Measure performance (opens, clicks, visits)

• Prevent fraud and abuse

See Substack’s Privacy Policy for details on its cookies and platform tracking. (Substack)

9. Data retention
   We retain subscriber and transaction records for as long as needed to:

• Provide the Services

• Maintain business records

• Comply with legal and tax obligations
  Retention may also be governed by platform retention practices. (Substack)

10. Your choices and rights
    Depending on where you live, you may have rights to:

• Access or correct your information

• Request deletion (subject to legal and record-keeping requirements)

• Object to or restrict certain processing

• Opt out of marketing emails (unsubscribe link in every email)

How to exercise rights

• Use the unsubscribe link in emails to stop delivery

• Contact us at info@theherongroupllc.com for access, correction, or deletion requests

• If your request relates to platform-held data, we may direct you to Substack’s controls or help center, because some actions must be executed by the platform. (Substack Support)

11. Security
    We take reasonable measures to protect information, but no system is perfect. The platform provider also operates its own security controls.

12. Changes to this policy
    We may update this Privacy Policy. We will change the effective date at the top when we do. Continued use of the Services after an update means you accept the updated policy.

Per ignem, veritas.