Your data should have a defined job.

Information needed to operate your workspace.

Shield processes account identity, subscription and usage state, security events, consent choices, encrypted connections, and files or text you deliberately submit for a workflow. Until September 10, 2026 it also processed the identifiers you approved for self-search, the metadata of breach and open-web scans, and the history of privacy requests; what those retired features stored was deleted on September 11, 2026, as set out under Retired features below.

The workflow note is yours, and it is not scan input.

Setup offers an optional box for describing what you need protected. Whatever you type there is stored on your account and read by the Shield team to understand what people need; it is never used as input to a scan, never sold, and never shared. Leaving it empty changes nothing about the service. You can ask for it to be removed at any time by writing to privacy@forg3t.io, and deleting your account deletes it with everything else.

An invitation records a link between two accounts, and nothing more.

If you invite someone, Shield records that your account issued that invitation and, once they accept, that their account joined your circle. You are told counts and stages only: how many people you invited, how many joined, how many completed their own setup. You are never shown their identity, their findings, their exposure, or anything they scanned, and this is enforced on the server rather than in the interface. The person you invited sees nothing about you beyond the name you chose to put on the invitation, which can be left blank. Legal basis: Article 6(1)(b) contract, because sending the invitation is the action you asked for, and Article 6(1)(f) legitimate interests in preventing abuse of invitation links.

Use data to deliver the action you selected.

Information is used to authenticate you, perform scans and redaction, generate evidence, enforce limits, prevent abuse, and maintain service security. Until September 10, 2026 it was also used to search identifiers you approved, to run AI providers you connected with your own key, and to prepare or send privacy requests; those purposes ended with the features that served them.

Each purpose names the ground it relies on.

Under Article 6 of the GDPR, Shield relies on a contract with you, on your consent, or on its own legitimate interests. Where more than one ground could be argued, the one named below is the one Shield uses.

• Account identity and authentication: Article 6(1)(b) contract, because an account cannot be created or kept yours without it.
• Taking payment: Article 6(1)(b) contract. Stripe hosted checkout takes the payment details directly; Shield receives the subscription events and the address given at checkout, never the card.
• The membership welcome mail, sent once when a payment completes: Article 6(1)(b) contract, because it confirms the purchase and states what the payment activated. Legitimate interests could also be argued here; Shield relies on contract.
• The exposure-change notification, sent until September 10, 2026: Article 6(1)(a) consent, given by switching email notifications on and withdrawn through the one-click unsubscribe the message carried. It is no longer sent.
• The weekly summary: Article 6(1)(f) legitimate interests in reporting on the service you pay for. It is on by default for members with a paid membership, which is why it is not consent, and every message carries a one-click unsubscribe.
• Searching identifiers you approved against breach sources and on the open web, until September 10, 2026: Article 6(1)(a) consent, given by the explicit authorization tick at onboarding and withdrawn by turning search approval off for that identifier or removing it from your identity vault. Those searches have stopped, and the tick is no longer asked for.
• Sending a privacy or removal request to another organization, until September 10, 2026: Article 6(1)(b) contract, because acting on the exact message you approved was the service you asked for. Shield no longer prepares or sends requests.
• Security and abuse prevention: Article 6(1)(f) legitimate interests in keeping sessions, rate limits, and audit records sound against misuse.

KVKK reaches the same processing through its own grounds.

KVKK Article 5 covers this processing through contractual necessity for your account, your payment, and the actions you ask Shield to take, and through the controller’s legitimate interests for security and for the weekly summary. Where this notice relies on consent, KVKK requires explicit consent, which is what the notification switches record, and what the onboarding authorization tick recorded for the searches that ended on September 10, 2026. The difference that matters is emphasis: KVKK treats explicit consent as the rule and every other ground as an exception, so anything Shield turns on by default keeps a one-click way out on every message.

What Shield stopped doing on September 10, 2026, and what happened to what it stored.

Until September 10, 2026 Shield offered features it no longer offers: breach and dark web monitoring, which checked identifiers you approved against Have I Been Pwned, XposedOrNot and LeakCheck; the open-web exposure scan, which searched for identifiers you approved through Brave Search; privacy and removal requests, which Shield drafted and, once you approved the exact message, sent from its own domain or through the Gmail account you connected; the bring-your-own-key AI exposure audit, which sent an identity query to OpenAI, Anthropic, Perplexity or Google with keys you connected; and the audit reports screen in the web app. No new lookups, searches or requests are made, and none of those services receives anything from Shield now. Conversation and file scans you ask for through the Shield connector are not affected. What those features stored, including the identifiers in identity vaults, masked breach and exposure results, and request records and their timelines, was deleted on September 11, 2026; by then no Gmail connection and no AI provider key was held for any account. A copy exported just before the deletion is kept in a private, encrypted storage bucket in the EU for 30 days, so that a deletion made by mistake can be undone, and is then deleted automatically. The database’s own point-in-time recovery keeps deleted records for up to seven days.

Security procedures are in place, and encryption is one of them.

Security procedures are in place to protect the confidentiality of the data you give Shield, and encryption is used to protect that data in transit and at rest. Traffic to the Shield site and to the Shield API travels over HTTPS, and the site sends a two-year strict-transport-security header covering its subdomains. Storage is encrypted at rest by Google Cloud, and on top of that Shield applies its own envelope encryption to the values that would matter most if a store were ever read without permission: a freshly generated 256-bit key encrypts each record with AES-256-GCM, that key is itself wrapped by a Cloud KMS key that never leaves KMS, and the plaintext key is erased from memory as soon as it has been used. Values protected this way include file-redaction selections and evidence reports; a record whose wrapping key is neither the current key nor an accepted earlier key is refused rather than decrypted, and an attempt to store one of these values while no key is configured fails instead of falling back to plain text. Runtime secrets are held in Google Secret Manager rather than in application code, and no credential is kept in the source repository. Authorization is decided on the server and never in the browser: signing in requires a verified email address and produces an HTTP-only, Secure, SameSite session cookie that expires after five days and can be revoked server-side, state-changing requests must present a matching anti-forgery token, cross-origin requests are refused unless the origin is on a fixed allowlist, and every read of account data is filtered by your account or re-checked against it before it is returned. Browsers cannot write to the database directly and cannot read any sensitive collection. Uploaded files sit in private buckets and are reachable only through signed links that expire in fifteen minutes for upload and ten minutes for download, under an object path that must begin with your own account. Sensitive endpoints are rate limited, evidence reports keep masked previews and hashes instead of the detected values, your email address is held in the database only as a hash, and every operational action appends an audit entry that is hash-chained to the one before it, so a removed or altered entry can be detected. Shield does not currently offer multi-factor authentication and holds no third-party security certification; the controls described here are the ones the code performs, and anything on this page that the code does not perform is a defect you can report to security@forg3t.io.

Send-only Gmail access, retired with privacy requests.

Until September 10, 2026, connecting Gmail was optional and served one step: sending a privacy request you had approved. Shield requested a single scope, https://www.googleapis.com/auth/gmail.send, which permits sending a message and nothing else. Shield could not read, list, search, draft, label, modify, or delete anything in your mailbox, and it never received your mail content, contacts, or profile data through this scope. Privacy requests were retired on that date: Shield no longer offers a Gmail connection and sends nothing through Gmail. No Gmail connection was still held when the data of the retired features was deleted on September 11, 2026, so Shield keeps no Gmail credential for anyone. If you want to check, your Google Account lists every app that has access at myaccount.google.com/connections. For requests sent before September 10, 2026, Shield recorded the resulting Gmail message and thread identifiers so the request timeline could show that the send happened; the message body it sent was the draft you had approved, and those records were deleted with the other request records on September 11, 2026.

External transmission follows a user-controlled action.

Stripe processes checkout and subscription events, Resend delivers the email described in the next section, and infrastructure processing is described on the Subprocessors page. Until September 10, 2026 some features sent data further, each only when you started them: Gmail received an outbound request you approved; AI providers you connected with your own key received only the identifiers authorized for a run; Brave Search received the search queries built from identifiers you approved; and independent breach-intelligence sources received an approved identifier or its privacy-preserving hash, while Forg3t retained normalized masked evidence. None of them receives anything from Shield now.

Every message Shield sends leaves through Resend.

Shield sends its own mail through Resend (resend.com), from a sending domain verified on the Forg3t account and registered in their us-east-1 region, so these messages are processed in the United States while every other Shield service runs in the EU. Resend receives the recipient address, the subject line, and the full body of each message. The messages are the membership welcome mail, sent once when a payment completes; the weekly summary, on by default for members with a paid membership and carrying a one-click unsubscribe; for an organization, the monthly report to its admins and the invitation an admin sends to a new member; and a Team or Enterprise inquiry sent from Shield, which goes to the Forg3t team. Member-facing mail carries counts and dates, never your text or the values Shield protected. Until September 10, 2026 two more messages used it: the exposure-change notification, sent only if you had switched email notifications on, and a privacy or removal request you approved, which was addressed to the organization rather than to you and carried your own address as Reply-To and your name in the sender display name, the subject line, and the body.

One named person answers for this.

Forg3t is the controller for the processing described here. Burak Tayyip Çevik is the person responsible for data protection and answers questions about it. Write to privacy@forg3t.io, in English or Turkish, and say what you want: a copy of your data, a correction, deletion, a restriction, an objection, or an explanation of a decision. If a request needs identity checks, we ask only for what is needed to be sure it is you, and nothing further. If you think the answer is wrong you can complain to a supervisory authority: in the EU, the authority where you live or work; in Turkey, the Kisisel Verileri Koruma Kurumu.

Each kind of record has its own clock, and most are short.

A file you upload for redaction is deleted from storage after two days, and the cleaned copy after thirty. An evidence report expires ninety days after it is created, removed automatically rather than on request. Scan history and finding decisions follow the retention you choose in settings, between one and three hundred and sixty five days, with thirty days as the default; a scheduled job deletes what has passed that age, and changing the setting applies to what is already stored rather than only to what comes next. Two kinds of record from the features retired on September 10, 2026 are not on that clock. The most recent breach scan stored on an account is kept whatever its age, as it was while each new scan was compared against it; and records of privacy requests sent before that date, with their timelines, stay because an organization could answer weeks later. Both are deleted when you ask, or when you delete your account. Account identity and billing records last while the account does, because without them there is no account. Audit entries are the exception and are kept indefinitely, because they are what lets you prove later what was done and by whom; when an account is erased those entries stay but stop naming the account, so what remains cannot be traced back to a person. Deleting your account removes the rest.

Change the inputs and notifications.

You can turn notifications off, delete individual outputs where available, and start account deletion, all from Shield. What the features retired on September 10, 2026 stored was deleted on September 11, 2026. Privacy questions can be sent to privacy@forg3t.io.

Inspect locally; synchronize only privacy-safe counters.

The Shield browser extension reads only the active composer or attachment on explicitly listed AI sites, scans supported content locally, and does not store raw prompts or files. If you pair an account, Shield synchronizes the AI surface, protection decision, and finding count for limit enforcement and aggregate analytics. It never sends the detected values, prompt text, file contents, browsing history, passwords, or unrelated tab data.

Google user data serves only the action you asked for.

Forg3t Shield’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Gmail authorization was used only to send a privacy request you explicitly approved and to record the delivery event in your own request timeline; since September 10, 2026, when privacy requests were retired, it is used for nothing except revoking the grant. It is not sold, not used for advertising or personalized ads, not used to determine creditworthiness or for lending purposes, and not used to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models. It is never sent to any AI provider: the bring-your-own-key AI audit, retired on September 10, 2026, never received Google user data, and Google user data is never stored in conjunction with any model. It is not transferred to third parties except as necessary to provide or improve this feature, to comply with applicable law, or as part of a merger or acquisition. No humans read this data except with your explicit consent, to resolve a support issue you raised, for security purposes, where required by law, or where the data has been aggregated and anonymized for internal operations.

Use extension data only for the protection users requested.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Extension-handled data is used only to provide or improve Shield’s disclosed protection purpose and related security, reliability, quota, and support operations. It is not sold, used for advertising, used for creditworthiness or lending, or transferred for unrelated purposes.

Measure the public website only after consent.

Google Analytics is used on the Shield website only when you allow the Analytics category in Cookie preferences. It may receive page and device metadata needed to produce aggregate usage reports; ad storage, ad personalization, and advertising data use remain disabled. Raw scans, prompts, files, detected values, passwords, identity numbers, and AI conversations are never sent to Google Analytics.