Privacy Policy

PumpForge is a pump operator training platform for fire departments. This policy explains what information we collect, why, who it is shared with, and the choices you have. It applies to pump-forge.com and to the PumpForge platform used by departments, instructors and trainees.

1. Information We Collect

Account information: Your name, email address, rank, station and department, entered when you sign up or when your department adds you. A department that signs up also gives its own phone number and website and the administrator's title and phone number.

Phone confirmation: When we confirm a phone number by text, we send a six-digit code to that number. We keep the number you confirmed and when you confirmed it. The code itself is stored only in a scrambled form and expires after 10 minutes.

Training records: Simulation runs, scores, pump discharge pressure calculations, quiz results, training log entries, skill sign-offs and certificates created as you use the platform.

Activity on the platform: While you are signed in, we record each page and action you use, with the time, your IP address and your browser type. Each day this is summed up into a short record of when you were online and for how long, how many times you signed in, and how many simulations, quizzes and certificates you started, completed or earned. We use it to keep accounts secure, to fix problems, and so your department administrator and instructors can see this record for the people in their department.

Billing contact: For a paying department, the name, email and address of the person who handles billing. Card and bank details go straight to Stripe and never reach PumpForge.

Forms on our website: When you contact us, ask for the cheat sheet, book a call or request a quote, we collect your name, title, email address and phone number, and your department's name, website, street address and number of stations (for a statewide quote, your agency's name, website and address and the number of departments it covers), so we can answer you. A department that signs up for a trial gives its website, street address, size and number of stations too.

Checking a new department: When a department signs up, we check that its details look real before the trial opens: that its email domain receives email, that both phone numbers are numbers a US phone could have, that the US Census Bureau's public address lookup finds its street address, that it is in the national fire department directory we hold, and that its website exists and the administrator's email address is on the website's domain. The address lookup sends the street address, city, state and ZIP code to the US Census Bureau. The results are kept on the department's record for our staff, and a detail we cannot confirm means we may call you; it never stops the sign-up.

Where visitors come from: When anyone opens a page of our website or the platform, our servers look up the general area of the internet address the visit came from (country, state and town) in a location database kept on our own servers. Nothing is sent to anyone else for this. We keep only a count of visitors and pages opened for each town and day, never the address, the browser or which pages you opened. So that each visitor is counted once a day, a scrambled form of the address and browser type is held for two days and then deleted. This uses no cookie and runs whether or not you accept analytics cookies.

Trial sign-up: When you start a trial we record the first page you visited on our site and the website that referred you, to understand which of our resources are useful.

Support requests and email: When you open a support ticket we collect your browser and version, operating system, screen size, language and IP address to help us diagnose the problem. Email you send to a PumpForge address is kept, and email to our support address becomes a support ticket.

Questions to the AI assistant: What you type into the PumpForge AI assistant, and its answers, so it can reply in context.

Your location, only if you allow it: The simulator panel shows the current weather where you are, so it asks your browser for your location. If you allow it, your browser sends your coordinates directly to OpenStreetMap, to name the nearest town, and to Open-Meteo, for the weather. Once you have allowed it, other pages of our site show the weather too, and your browser sends your coordinates to Open-Meteo for it. PumpForge does not store your location, and if you do not allow it, nothing is sent.

Files you upload: Such as a background image for a pump panel, or an attachment to an email sent through PumpForge.

2. How We Use It

We use this information to run the platform; to produce training reports, scores and certificates; to send the emails the platform depends on, such as account set-up, password resets, assignment and certificate notices; to answer support requests; to keep accounts and data secure; and to improve PumpForge. We do not use your training records for advertising.

3. Where It Is Stored and How It Is Protected

Everything is stored on Amazon Web Services in the United States (US East). Data is encrypted in storage and in transit, passwords are stored only as salted hashes, sessions are held on our servers rather than in your browser, and access inside the platform follows your role. We monitor the platform for security problems and back it up automatically.

4. Who We Share It With

We do not sell or rent personal information. We share it only with the companies that help us run PumpForge, and only what each one needs:

Amazon Web Services: hosting and storage, receiving the email sent to us, sending our email when Postmark cannot, and sending the text messages that confirm a phone number.
Postmark: sending our email.
Stripe: payments. Stripe receives the department's billing contact and handles card and bank details itself.
Anthropic: runs the AI assistant. The questions you type are sent to Anthropic with what it needs to answer them: your name, role, rank, station and department, and your own training, meaning your assignments and due dates, recent scores and pass rate, certificates and course progress. For an instructor or department administrator it also includes a summary of the department's training, which names trainees by first name and last initial. Anthropic is also used to sort the email that arrives at PumpForge addresses, so the sender, subject and message are sent to it.
Sentry: error reports, so we can fix problems quickly. We remove cookies, passwords, form contents and IP addresses before a report is sent.
Google reCAPTCHA: checks our contact and sign-up forms for spam. Google's privacy policy and terms apply to that check.
OpenStreetMap and Open-Meteo: the weather shown on some pages, only if you allow your browser to share your location (see section 1).
Microsoft Clarity, Google Analytics and Ahrefs: see section 8.

If your department connects PumpForge to its own systems through the API or webhooks, PumpForge sends your department's records to the addresses your department sets up.

Certificate check: Every certificate has a number. Anyone who has that number can check it on our public certificate check page, which shows the holder's name, department, the certificate and whether it is current.

We will also disclose information when the law requires it, through valid legal process. Inside the platform, trainees see their own records, instructors see their department's trainees, and department administrators see their whole department.

5. How Long We Keep It

Training records and certificates are kept while your department's account is active. If a department is deactivated or deleted, its records are kept for at least 12 months, during which your department administrator may request an export; after that they may be permanently deleted. The detailed record of pages and actions is kept for 90 days. The daily counts of visitors by town are kept for 400 days. The daily activity summary described in section 1 is kept permanently, with your name and email, so a department can always show the training its people did; it is kept even after your account or your department is deleted. Audit logs are kept for 365 days, except the few records we need for billing and for knowing which department a person's past training belongs to (a subscription ending or lapsing for non-payment, and a person moving between departments), which are kept permanently. You can ask for an export of your records at any time through your department administrator.

6. If There Is a Data Breach

If we confirm a breach that exposes personal information, we will tell the affected department administrators within 72 hours of finding it, by email and inside the platform. We will say what happened, what kinds of data were involved, roughly how many records, and what we have done about it, and we will meet any state or federal notification requirements that apply.

7. Public Agencies and Records Requests

Many of our customers are public agencies subject to public records laws. We cooperate with lawful records requests made to the subscribing department. We do not hand a department's data to a third party without telling the department first, unless the law forbids us to.

8. Cookies and Analytics

Cookies we need: PumpForge uses a session cookie to keep you signed in. They end when you sign out, or after a period without activity: 30 minutes for trainees and 2 hours for everyone else. The platform cannot work without it.

Analytics: We use Microsoft Clarity, Google Analytics and Ahrefs Web Analytics to understand how the site and platform are used. Clarity and Google Analytics may set their own cookies; Ahrefs sets none. Clarity records session replays, meaning mouse movements, clicks and scrolling, so we can find what is confusing. Google Analytics and Ahrefs count page views and how people move around the site. None of them receives training scores, pressure calculations or simulation data. We do not use advertising cookies.

Your choice: Analytics only start after you click Accept All on the cookie banner. If you choose Essential Only, or have not chosen yet, none of them runs. You can also block analytics in your browser settings or with a content blocker. PumpForge works the same without them. The count of visitors by town described in section 1 is separate: it sets no cookie, and nothing about you leaves our servers for it.

9. Children

PumpForge is built for professional fire service training. We do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it promptly.

10. Your Choices and Rights

You can ask to see the personal information we hold about you, to correct it, to delete it (except the daily activity summary described in section 5, and anything the law requires us to keep), to export your training records and certificates, and to stop non-essential emails. Ask your department administrator, or write to us at contact@pump-forge.com.

11. Your Department's Role

Your department decides who has an account and manages its own trainees' records. For questions about why your department holds certain information, your department administrator is the first person to ask.

12. People We Contact About PumpForge

To introduce PumpForge to fire departments and training academies, we keep the work contact details that departments and governments publish on their official websites, such as a training officer's name, title, work email and work phone, with the page we found them on. When we write to someone, the emails and any reply are kept in our sales records. We may use the AI service described in section 4 to help write and sort those emails. To be left off, write to contact@pump-forge.com.

13. Sales Representatives

Someone who applies to sell PumpForge gives us their contact details and their Social Security number, which we need for tax reporting on commissions. The Social Security number is stored encrypted, and only the representative and PumpForge's administrators can view it.

14. Changes to This Policy

If we make a material change, we will email department administrators at least 30 days before it takes effect, and update the date at the top of this page.

15. Contact

For any privacy question, email contact@pump-forge.com or use our contact page.

PumpForge LLC, 400 N Tampa St, Ste 1550 #127547, Tampa, FL 33602