Smart Sequence Tech (智序資訊工作室) operates ForgeHelm, a code governance and compliance platform. This Privacy Policy explains how we collect, use, and protect personal data when you use smartsequence.tech or the ForgeHelm SaaS service. It addresses GDPR (EU 2016/679), CCPA (California), and Taiwan's Personal Data Protection Act (PDPA). For website visitors and billing data, we are the data controller; for data uploaded by SaaS customers or transmitted by the analysis engine, we are the processor and the customer is the controller.
1. Data Controller / Processor
| Field | Details |
|---|---|
| Entity | Smart Sequence Tech (智序資訊工作室) |
| Tax ID | 60295398 |
| Contact | service@smartsequence.tech |
| Data Protection Inquiries | service@smartsequence.tech |
2. What Data We Collect
2.1 Website Visitors
- Contact form: Name, business email, company, job title, headcount, plan of interest, inquiry type, and message content (received by the form service Web3Forms and forwarded to us)
- Analytics: The website currently uses no analytics or tracking scripts
- Cookies: The website sets no cookies; language and light/dark theme preferences are stored only in your browser's local storage
- Site assistant: Questions you type are recorded so we can improve the answers, truncated to 300 characters; no IP address or identifying field is recorded, and only the length of the answer is kept. Questions are sent to Google Gemini to generate the reply
2.2 ForgeHelm SaaS Customers
- Account data: Business email, name, company, role, subscription plan
- Usage data: Feature logs, login times, API records
- Billing data: Processed by payment provider; we do not store full card numbers
- Support data: Tickets and correspondence
2.3 How Source Code Is Handled
- Hybrid, on-premises, and air-gapped deployments: the analysis engine (Agent) analyzes code in your environment, and only masked file names, line numbers, and summary counts are sent to the SaaS platform; we do not receive source code
- The cloud-only Core plan: repositories you upload or specify are accessed by our hosted analysis engine for the duration of the analysis; the retention period follows your written agreement with us, and absent one, you may request deletion by email
- We do not collect GDPR Art. 9 special categories of personal data
3. Legal Basis for Processing (GDPR)
| Purpose | Legal Basis |
|---|---|
| Inquiries and demos | Legitimate interest (Art. 6(1)(f)) |
| Contracted SaaS services | Contract (Art. 6(1)(b)) |
| Billing and tax | Legal obligation (Art. 6(1)(c)) |
| Service improvement comms | Legitimate interest (Art. 6(1)(f)) |
4. How We Use Your Data
- Respond to demo, PoC, and sales inquiries
- Provision and operate ForgeHelm SaaS accounts
- Issue invoices and process subscriptions
- Provide support and maintain reliability
- Send service-critical notifications (not marketing unless opted in)
- Meet legal and tax obligations
5. Data Retention
| Data Category | Retention Period |
|---|---|
| Pre-sales inquiries | 2 years from last interaction |
| Active SaaS account data | Subscription term + 90 days after termination |
| Billing records | 7 years (legal obligation) |
| Support tickets | 3 years after closure |
| Source code uploaded on the Core plan | Duration of the analysis; retention period per written agreement, deletion available on request by email |
| Site assistant question logs | Held in the runtime logs of our hosting provider (Vercel) and rotated under its log retention policy; we keep no separate copy |
You may request early deletion of non-billing data (see Section 7).
6. Third-Party Services
We sign data processing agreements with sub-processors that handle personal data. Any prospective or current customer may request the sub-processor list by email; hosting location details for the ForgeHelm SaaS management platform are also available on request.
- Vercel: Marketing site hosting (EU/US; DPA in place)
- ECPay: payments from customers in Taiwan (Taiwan); international merchant of record: payments from customers outside Taiwan, with the platform handling the transaction and taxes as the seller (platform name available on request)
- Web3Forms: Contact form delivery (United States)
- Google Gemini API: Vector indexing and inference for cloud AI mode (Core, and Professional without a customer-provided model); it also generates the answers given by the site assistant
7. Your Rights
Depending on your jurisdiction, you may have the following rights:
California residents may opt out of sale/sharing under the CCPA. We do not sell personal data.
Under Taiwan's PDPA, you may request to access or review your data, obtain copies, supplement or correct it, and have collection, processing, or use stopped and the data deleted; data portability is a right we provide under the GDPR, and Taiwan customers may exercise it as well.
Contact service@smartsequence.tech. We handle access and copy requests within 15 days and correction, deletion, and cessation-of-processing requests within 30 days; where the GDPR applies, its one-month deadline governs.
8. Cookies
| Cookie Type | Purpose | Opt-out |
|---|---|---|
| Strictly necessary (SaaS platform) | Login session | Cannot be disabled |
| Website | No cookies set; language and theme preferences stored in your browser's local storage | Clear your browser data |
We do not use analytics, advertising, or cross-site tracking cookies.
9. International Data Transfers
With hybrid, on-premises, or air-gapped deployment, source code and analysis stay in the customer's environment and only masked compliance metrics reach the SaaS platform; on the cloud-only Core plan, source code is analyzed in our hosted environment.
9.1 Services that move data outside Taiwan or your region
- Vercel (United States): website hosting and the website assistant's question log
- Web3Forms (servers in the United States; operating company in India): contact form content. It does not store form submissions — it forwards them to our inbox — and deletes server logs about every two months. It does not offer standard contractual clauses; if you would rather your data not pass through it, email us directly at service@smartsequence.tech
- Google Gemini API (United States and Google's global facilities): website assistant questions; in cloud AI mode, code snippets and analysis results
- International merchant of record (depends on the platform): payment and billing data for customers outside Taiwan
- ForgeHelm SaaS management platform: account and usage data (hosting location available on request)
- Customers in Taiwan pay through ECPay, and their payment data stays in Taiwan
9.2 Legal basis
- Where the GDPR applies: Vercel relies on the EU Standard Contractual Clauses (SCCs) in its data processing addendum; Google relies on its processor terms, under the EU-US Data Privacy Framework (DPF) or standard contractual clauses
- Under Article 21 of Taiwan's Personal Data Protection Act, international transfers are permitted unless restricted by the competent authority
9.3 If you do not want data to leave your environment
- Choose on-premises or air-gapped deployment on Professional or above and bring your own model (BYOL); source code and questions stay in your environment
- To contact us, email us directly instead of using the contact form service
10. Security Measures
In the event of a personal data breach, as controller we notify the supervisory authority within 72 hours under GDPR Art. 33 and promptly notify affected individuals under Art. 34 and Article 12 of Taiwan's PDPA; as processor, we promptly notify the customer under Art. 33(2). Enterprise and government customers may agree to different notification deadlines by contract.
- Encryption in transit: TLS 1.2+
- Encryption at rest: Cloud databases use the hosting provider's storage-layer encryption; secret fields such as authentication tokens are additionally encrypted at the field level
- Access control: RBAC for personnel
- Audit logs: Administrative actions are written to a hash-chained audit log whose integrity can be verified
- Vulnerability management: Regular scanning and dependency updates
11. Policy Updates
- Published on this page with an updated effective date
- Active SaaS customers notified by email at least 30 days before material changes
12. Contact & Complaints
Privacy inquiries: service@smartsequence.tech
Business entity: Smart Sequence Tech (智序資訊工作室, Tax ID 60295398)
Under the GDPR, you may lodge a complaint with the supervisory authority where you live.