Forgot Password exists to help agencies store sensitive client account details more responsibly. This policy explains what information the service handles and how it is used.
When you create an account or invite teammates, the service may collect names, email addresses, role assignments, and other workspace administration details.
Workspace content may include client profile information, usernames, passwords, recovery notes, TOTP setup keys, website URLs, and other operational context entered by your team.
Forgot Password is built to encrypt credential payloads before storage and to minimize unnecessary plaintext exposure. Sensitive values are intended to be revealed only when an authenticated user completes the required verification flow.
Audit events may capture metadata about actions such as reveals, failed access attempts, invitations, and role changes to support accountability and security review.
Information may be used to operate the service, authenticate users, secure workspaces, and support product improvement.
We may also use it to investigate misuse, protect customers, troubleshoot workspace issues, and understand how plan thresholds or product features are being used.
Customer workspace data should not be shared outside the scope of operating, securing, or supporting the service unless required by law or authorized by the customer.
Retention periods for account and workspace data should be finalized in your production policy based on hosting, compliance, and contractual requirements.
Workspace administrators can manage user access, remove memberships, and control who can create, reveal, or delete stored credential records.
If you need a customer-facing version of deletion rights, subprocessors, or cookie disclosures, this page should be expanded before public launch.
Together, these pages give your public site a more complete trust layer while keeping the same premium visual system as the rest of the brand. Privacy-related questions can be sent to admin@draftroom.works.