Where is the data stored?
Your financial data lives in a PostgreSQL database hosted by Neon in the United States. When you upload a P&L or balance sheet as a CSV or XLSX export, the file is read in your browser and structured into rows. The file itself is not stored or forwarded to a third party. The files added through Add documents (PDFs, decks, spreadsheets, photos of statements) are different: they are stored in Vercel’s private file storage, so each figure can be checked against its page, and sent to Anthropic to be read. A file is deleted 12 months after it was added, unless the workspace owner chooses another period in Settings, and sooner when you delete the document, its workspace or your account. The figures confirmed from it stay.
Billing is handled entirely by Stripe. We store only your Stripe subscription ID, never your card number, bank details, or any payment credentials.
Account passwords are hashed with bcrypt before storage. We never store or log your password in plain text. If you connect QuickBooks, Xero or Gusto, the OAuth tokens that allow us to pull your data are encrypted at rest.
Who can access it?
You, and any workspace members you explicitly invite. Workspace data is scoped. Members of one workspace cannot see data in another.
Forecraft staff can access server logs and error reports (IP addresses, error traces, event IDs) for debugging and support. Error reports have email addresses and link secrets removed before they leave the app. We do not have a back-office view that shows us your clients’ financial figures. Neon operates the database infrastructure but has no application-level access to your data.
No advertiser, data broker, or analytics platform sees your financial data. We do not sell it, rent it, or share it with third parties beyond the infrastructure providers listed above.
Is it used to train AI models?
No. When you use an AI feature, such as the executive narrative or variance explanation, your financial data is sent to Anthropic (maker of Claude) as context for that single request. Anthropic deletes API inputs and outputs automatically within 30 days, and keeps them longer only if a request is flagged for a usage-policy violation or the law requires it. Anthropic’s API terms prohibit using API inputs to train or improve their models without customer consent, which we have not given.
Forecraft does not build, fine-tune, or train any model from your data. Your client’s numbers are used to produce your deliverable and nothing else.
What happens when you cancel?
Your account stays active and fully functional until the end of the current billing period. Nothing is deleted or locked when you cancel. You continue to have access to your workspaces, saved packs, and exports until the period ends.
After the period ends, your account moves to the free plan. Your workspaces, saved packs and exports stay where they are, and nothing is deleted because you stopped paying. Features the free plan does not include stop working until you resubscribe. You can take a copy at any time: “Download my data” in Settings, under You, for your personal data, and the pack exports in the dashboard for your client deliverables. See our Privacy Policy for how long data is kept.
To delete everything, go to Settings, under You, and use the “Delete account” option. This removes your account at once, along with every workspace you are the only member of. Workspaces you share with other people stay with them. Or email privacy@forecraft.tech and we will delete it within 30 days and confirm when it is done.
For users in the European Union
Forecraft complies with the General Data Protection Regulation (GDPR). Your financial data is processed under Standard Contractual Clauses for international data transfers to the United States.
You have the right to:
- Access your data
- Correct inaccurate data
- Request deletion of your data
- Export your data in a portable format (one JSON file, from Settings)
- Lodge a complaint with your local data protection authority
To exercise any right, contact: privacy@forecraft.tech
UK users (post-Brexit)
Forecraft complies with the UK GDPR as incorporated into UK law by the Data Protection Act 2018. Your rights are identical to those listed above.
Controller and processor roles
For the purposes of GDPR, Forecraft acts as a data processor for your clients’ financial data. You, as the fractional CFO or advisory firm, act as the data controller. This means you are responsible for ensuring you have the appropriate legal basis and consents to share your clients’ financial data with Forecraft as your processor.
Last updated: November 6, 2026
If you have a question not covered here, email privacy@forecraft.tech. For the full legal detail, see our Privacy Policy and Terms of Service.