Privacy

What ForgeLab does with information

Two different sets of people appear here: the businesses that run shops on ForgeLab, and the shoppers who buy from those shops. We hold their information for different reasons, so they are covered separately.

If you run a shop on ForgeLab

We hold your email address, your password in hashed form (we cannot read it), your shop details, and the payment credentials you save so your shop can charge cards. Those credentials are encrypted, and the key is not stored with the database.

We use it to run your shop, to email you about your orders and your account, and to bill you. We do not sell it. We do not send you marketing you did not ask for.

If you bought something from a shop on ForgeLab

The shop you bought from decides what happens to your information. Under POPIA they are the responsible party and we are their operator, which means we store your details on their behalf and use them only to run their shop.

What is stored: your name, phone number, email address, delivery address, and what you ordered and paid. Card details are not among them. Those go straight from your browser to the shop's payment provider (Yoco or PayGate) and never reach us.

To see, correct or delete what a shop holds about you, contact that shop. Their details are on their shop's privacy page. They can delete you themselves, and the deletion reaches us at the same moment because it is the same records.

Cookies

ForgeLab sets a small number of cookies and none of them are advertising cookies: one to keep a merchant logged in, one to remember what is in a shopping cart, and two that count visits to a shop so the merchant can see how many people came. Those last two are first-party and are not shared with anyone.

A merchant can add their own Meta or Google tracking to their shop. If they have, those platforms' cookies are set on their shop's pages and their privacy terms apply as well as ours.

Where it lives, and for how long

The data is stored on a machine in South Africa, with encrypted backups. Order records are kept while the shop is active because merchants have tax and accounting obligations. When a shop closes, everything is deleted 30 days later, or sooner on request.

Who else sees it

Yoco or PayGate, whichever the shop uses, for taking card payments. The email provider that delivers order emails. Cloudflare, which sits in front of the site and passes traffic through. Nobody else, unless the law requires it.

Your rights

Under POPIA you can ask what is held about you, ask for it to be corrected, and ask for it to be deleted where there is no legal reason to keep it. If you bought from a shop, start with that shop. If it is about your ForgeLab account, contact us at [email protected] or WhatsApp 073 429 5517. If you are not satisfied, you can complain to the Information Regulator of South Africa.

Last updated 10 August 2026.