Privacy Policy
Effective Date: 9 Oct 2026
Entity: Forest Software Ltd (trading as “Forest”), registered in England and Wales, company number 17003615
Registered Office: Lodges Wood Oast, Goodley Stock Road, Westerham, Kent, TN16 1TW
Contact: privacy@forest.tools
At Forest, we recognise that the data you entrust to us — ranging from strategic roadmaps to granular financial forecasts — is your most sensitive asset. This policy explains what personal data we collect, how we use and protect it, where it is stored, and the rights you have.
1. Roles and Responsibilities
- Customer Data (the Platform): When you use the Forest platform, the organisation you work for (the “Customer”) is the Data Controller of the information it uploads, such as plans, forecasts, budgets, people and team details. Forest is the Data Processor and processes this data only on the Customer’s instructions, as set out in our Terms and Conditions.
- Account, security and website data: Forest is the Data Controller for the information we need to run your account and keep the Platform secure (for example your sign-in details and the security records described in section 2), for billing information, and for information collected through our website (for example contact forms).
If your organisation gave you access to Forest, please contact your organisation first about how it uses the data it holds in the Platform.
2. Information We Collect
| Category | Types of data |
|---|---|
| Account information | Name, username, business email address, job title, profile picture, and the company and projects you belong to. Your password is stored only as a one-way hash. If you turn on two-factor authentication, your authenticator secret is stored encrypted. |
| Sign-in information | If you sign in with Google or with your organisation’s single sign-on (SSO), we receive your name and email address from that service. If your organisation provisions accounts automatically (SCIM), we receive the details it sends. |
| Billing information | Billing contact, billing address, VAT number and payment details, for paying customers. |
| Security and usage records | Sign-in and sign-up events, data exports, and the volume and type of requests made to the Platform and its APIs, together with the associated user account, date and time, IP address and browser details. |
| Support and feedback | Messages you send us, and feedback you submit through the in-app feedback widget. |
| Integrations | Data exchanged with services your organisation chooses to connect, such as Jira, Slack, Anaplan, Looker, Tableau or Power BI. |
3. How We Use Your Data, and Our Lawful Basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Providing, maintaining and supporting the Platform, including your account, sign-in and notifications | Performance of our contract with the Customer, and our legitimate interest in providing the service to its users |
| Keeping the Platform secure: detecting and preventing fraud, misuse, unauthorised access and automated data extraction, and enforcing our Terms and Conditions | Legitimate interests (protecting our customers, their data and our Platform) |
| Processing payments and sending invoices and confirmations | Performance of a contract; legal obligation (tax and accounting records) |
| Sending technical notices, security alerts and support messages | Performance of a contract; legitimate interests |
| Improving the Platform using aggregated usage information | Legitimate interests |
| Anonymising and aggregating data for industry benchmarking | Consent — only if your organisation has explicitly opted in |
| Complying with the law and responding to lawful requests | Legal obligation |
We do not use Customer Data to train artificial intelligence models, and we do not sell personal data.
4. Data Sharing and Sub-processors
We share personal data only in the following circumstances:
- Sub-processors: with service providers that help us run the Platform, under contracts that require them to protect the data and use it only to provide their service to us:
| Provider | Purpose | Location |
|---|---|---|
| Render | Application hosting | United States and Europe |
| Neon (on Amazon Web Services) | Database hosting | United States and Europe |
| Amazon Web Services | File storage (S3) and email delivery (SES) | United States and Europe |
| Cloudflare | Network delivery, and bot protection on the sign-in page (Turnstile) | Global network |
| Sign-in with Google (only if you choose it) | United States | |
| Automattic (Gravatar) | Profile picture lookup, using a hash of your email address | United States |
| Hostinger | Hosting of our public marketing website, forest.tools | United States |
- Integrations you choose: when your organisation connects a third-party service, we exchange data with that service on your organisation’s instructions. That service’s own privacy policy applies to the data it holds.
- Legal compliance: if required by UK law, or to protect the safety and integrity of our Platform, our customers or others.
- Business transfers: in connection with any merger, sale of company assets or acquisition, in which case this policy will continue to apply to your data.
5. Data Security
Security is our baseline. We implement:
- Encryption: data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Two-factor authentication secrets are additionally encrypted within our database, and passwords are stored only as one-way hashes.
- Access control: role-based access control (RBAC) within the Platform, multi-factor authentication available for user accounts, single sign-on for organisations that use it, and access for Forest staff restricted to those who need it, with actions taken through our internal administration tools logged.
- Monitoring: rate limits and the security records described in section 2 help us detect and stop misuse, such as attempts to extract data in bulk.
6. International Transfers
Our application runs in the European Union (Frankfurt), and our database, file storage and email delivery are hosted in the United States. Some of our other sub-processors also process data outside the UK, as shown in section 4.
Where personal data is transferred outside the UK, we rely on a UK adequacy decision (including the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified), or on the International Data Transfer Addendum to the EU Standard Contractual Clauses, to ensure your data receives a level of protection equivalent to that in the UK.
7. How Long We Keep Data
- Customer Data: for as long as the Customer’s subscription is active. After the subscription ends, the Customer has 30 days to export its data, after which we delete it from our production systems. Copies in backups are overwritten on a rolling basis.
- Account information: for as long as your account is active. When an account is deleted, we remove its access straight away. Content you created (such as comments) stays attributed to you within the Customer’s workspace unless the Customer or you ask us to anonymise it.
- Security and usage records: up to 24 months.
- Billing records: six years, as required by UK tax law.
8. Your Rights (UK GDPR)
Under the UK GDPR, you have the following rights regarding your personal data:
- Access: request a copy of the personal data we hold about you.
- Correction: request that we fix inaccurate or incomplete information.
- Erasure: request that we delete your personal data (subject to legal retention requirements).
- Restriction and objection: ask us to restrict how we use your data, or object to processing based on our legitimate interests, including for marketing.
- Portability: request your data in a structured, machine-readable format.
- Withdraw consent: where we rely on consent, you may withdraw it at any time.
Where your data is held as Customer Data on behalf of your organisation, we will pass your request to the Customer and help it respond.
To exercise any of these rights, email privacy@forest.tools. If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk, although we would welcome the chance to resolve your concern first.
9. Cookies
The Platform uses a single cookie: a session cookie, set when you sign in, that keeps you signed in. It is strictly necessary for the Platform to work and does not require consent. The sign-in page also uses Cloudflare Turnstile to check that you are not a bot; Cloudflare’s own privacy policy describes how it processes that information. Our public website may use additional cookies, which are explained in its cookie banner.
10. Children
Forest is a business tool and is not intended for anyone under 18. We do not knowingly collect personal data from children.
11. Changes to This Policy
We may update this policy to reflect changes in our practices or for legal reasons. The Effective Date at the top of this page shows when it last changed. We will notify you of any material changes via the Platform or by email.
12. Contact Us
If you have questions about this policy or our data practices, please contact us at:
Email: privacy@forest.tools
Address: Lodges Wood Oast, Goodley Stock Road, Westerham, Kent, TN16 1TW