Who is responsible
Lala Forge is operated by AMG DIGITAL SOLUTION, LLC. For privacy questions or requests, contact privacy@lalaforge.com.
Information we handle
We handle account and workspace details, information people submit to use the service, support communications, and data from connected services that a workspace owner explicitly enables. Connections are used to provide workspace reporting, follow-up context, calendar views, and related marketing-and-sales operations.
Google connection setup and resource selection
Google data is accessed only after the workspace owner authorises a connection. During setup, Lala Forge may temporarily retrieve the Google resources the user can access—such as mailbox identity, calendar identifiers, Analytics accounts and properties, Search Console sites, or Google Ads customer accounts—so the user can choose one permitted resource. The selected resource identifier and display label are stored with the connection. Short-lived selection data can expire and cannot then be used to complete a connection.
Gmail metadata
Lala Forge requests Gmail message metadata rather than message content. The retained fields can include mailbox address, message and thread identifiers, From and To addresses, Subject and Date headers, Google’s internal received timestamp, labels, and sent or unread state. These fields support follow-up context and aggregate counts such as inbound, outbound, unread, and thread totals.
The Gmail reader does not request message bodies or attachment content. Message snippets are not retained or used. The Gmail connection cannot send, compose, modify, label, archive, trash, or delete email.
Google Calendar data
For the calendar selected by the user, Lala Forge retains the calendar identifier, display label, and time zone. For events, it can retain the event identifier, iCalUID, title, status, start and end times, original occurrence time, update time, sequence, recurrence identifier, and attendee count. The attendee collection may be read to calculate that count, but attendee names, addresses, and response details are not retained. Event descriptions, locations, organisers, conferencing details, and attachments are not retained.
This information supports a read-only calendar view and aggregate event reporting. Lala Forge does not create, change, or delete Google Calendar entries.
Google Analytics, Search Console, and Google Ads reports
Google Analytics reporting can include selected account and property identifiers and labels; date, source, medium, campaign, landing page, country, and device dimensions; sessions, users, key events, and revenue metrics; and currency or time-zone metadata. It is used for acquisition, conversion, landing-page, device, geographic, and revenue reporting.
Search Console reporting can include the selected site URL and permission level, query, page, country, device, and date dimensions, and clicks, impressions, click-through rate, and average position. It is used for organic-search performance reporting.
Google Ads reporting can include selected customer identifiers and labels, currency, time zone, account status, campaign, ad-group, and ad identifiers, names and statuses, channel type, date, impressions, clicks, cost, conversions, and conversion value. It is used for read-only campaign and spend analysis. Lala Forge does not create, edit, pause, or delete Google advertising resources.
Storage, derived information, and Ask Lala
In the audited QA implementation, selected connection details, mapped provider records, synchronisation state, and derived reporting aggregates are stored in Lala Forge’s workspace-separated database. Vercel provides application hosting and request processing; Supabase provides authentication and PostgreSQL database infrastructure. OAuth credentials are encrypted by the application and restricted to server-side processing. Provider reporting records are protected by workspace and role-based access controls; this does not mean every stored field is individually encrypted.
In that audited QA implementation, Ask Lala receives permission-checked aggregate summaries—such as message counts, calendar counts, and marketing-performance totals—not raw Gmail headers or individual Calendar attendee identities. Production and the current review deployment run the same application source commit. Their database, provider configuration, connected data, and operational status remain separate: Production Google integrations remain disabled pending approval, and review-environment evidence does not establish that Google data is available or processed in Production. No external AI model provider is active in the audited application path.
Use boundaries
Google Ads and Analytics data supports reporting inside the user’s workspace. Lala Forge does not sell Google user data or use it for audience creation, ad targeting, retargeting, personalised ad serving, or creditworthiness decisions. Lala Forge does not use Google user data to train or improve generalised AI or machine-learning models.
Lala Forge does not create, enable, or facilitate AI-generated non-consensual intimate imagery and does not use Google APIs or Google user data for that purpose.
Access and service operation
Access is limited through account roles, workspace boundaries, and connection permissions. Authorised infrastructure services process data only to host, secure, and operate the requested features. Support personnel do not receive subscriber-content access merely because they have platform authority; any operational access must be separately authorised.
Disconnecting, revoking, and deleting data
Disconnecting a provider in Lala Forge retires the local connection and stops future imports through it. Disconnecting does not revoke Lala Forge in the user’s Google Account and does not automatically delete records already imported or derived from them. Users can separately revoke access from their Google Account settings.
Deletion requests are handled through the public data-deletion process. Imported records, derived summaries, connection history, security or audit records, logs, and backups may not all follow the same retention path. Lala Forge does not currently publish a fixed automatic deletion timetable. A response to a deletion request will identify what can be removed and explain any information that must be retained for security, legal, audit, backup, or request-resolution purposes.
Your choices
You can ask about your information, request correction or deletion where applicable, disconnect a provider in Lala Forge, or revoke a Google authorisation in your Google Account. See the data-deletion instructions or email privacy@lalaforge.com. Do not send passwords, OAuth tokens, client secrets, or private customer records by email.