Who we are
This site is operated by TM Works LLC, doing business as Here Forward. When this policy says “we,” that's us.
This privacy policy explains what personal information TM Works LLC (doing business as Here Forward, referred to in this policy as “we,” “us,” or “Here Forward”) collects from visitors to hereforward.ai and the related pages linked from it (together, the “Site”), how we use that information, and the choices you have about it.
This policy covers the Site. It does not cover services we provide under a separate written engagement (a Discovery audit, a Build, an Ongoing Support arrangement, or a workshop). Those engagements are governed by the terms in the agreement you sign with us.
What we collect
Two buckets. Things you give us (like your email when you request an audit). Things your browser sends automatically (like your IP and what pages you viewed).
Information you give us
When you request a Discovery audit, send a scoping form from the workshops page, email us at hereforwardai@gmail.com, or otherwise contact us, you may give us:
- Your name and email address.
- The name and website of your business.
- Your phone number, if you choose to give one.
- Free-text messages and notes about what you're trying to do, your team size, your industry, and any specifics you choose to share.
Information about other people you share
Some fields ask about your business, and you may choose to include information about other people (for example, a colleague to loop in, or context that lives in your CRM or inbox). Please share other people's personal information only when you need to and you have the right to. Anything you submit is handled under this policy; any personal data we process on your behalf during an engagement is governed by your engagement agreement (and, where applicable, a data processing addendum).
Information collected automatically
When you visit the Site, our analytics provider and our web host receive standard technical data, including:
- Your IP address and approximate location derived from it (country and city level).
- Your device and browser type, operating system, screen size, and language preference.
- The pages you visit, the order you visited them in, how long you stayed, and where you came from (referring URL).
- Standard log data about your request (timestamps, the file you requested, and the response status).
What we do not collect
We do not knowingly collect government identifiers, payment card numbers (the Discovery fee and engagement invoices are handled through a third-party payment provider outside the Site), biometric data, precise geolocation, or any data we'd label “sensitive” under California or other state privacy laws. We do not buy lists.
How we use it
To answer you, hold the call, and figure out which parts of the Site are working. That's it.
We use the information described above to:
- Respond to you. Answer your email, confirm your meeting, send the Discovery prep doc, follow up on a workshop inquiry.
- Research your business and prepare deliverables. Run the Discovery audit you booked, prepare the written read, deliver a workshop, or perform the consulting engagement you signed up for. As part of this work, your submitted information may be processed with AI tools as described in the section on AI tools below.
- Operate and improve the Site. Understand which pages people read, where things break, and what to write more of.
- Stay secure. Detect and prevent abuse, fraud, scraping, and other things we would rather not have happen.
- Meet legal obligations. Comply with applicable law, respond to lawful requests, and enforce our agreements.
We do not use your information for automated decisions that produce legal or similarly significant effects about you. We do not add your data to AI model training datasets, and we choose AI providers that contractually exclude business inputs from training their models.
How we use AI tools, and your data
We use AI tools in our work, including on the data you submit through this Site. We pick tools and configurations that don't add your data to model training, and a human reviews everything before it goes out.
We are an AI consulting practice. AI tools (Claude, ChatGPT, Gemini, custom workflows, research agents) are part of how we do our work — including when we research a business, prepare an audit, synthesize findings, and draft recommendations. Concretely:
- AI tools may process the data you submit. Your form responses, the public information about your business (website, social profiles, reviews), and the broader context we gather may be fed into AI tools as part of building your audit or other deliverable. We use AI to research, synthesize, and draft. We do not send the AI tools more data than the work requires.
- We choose providers that don't add your data to model training. We default to business-tier accounts at AI providers that contractually exclude business inputs from training their models. When we use other AI tools or self-hosted models, we evaluate their data-handling commitments before sending your data through them.
- A human reviews the deliverables we send you. We do not run fully automated decision-making that legally or significantly affects you. The recommendations and writeups we send you are read, edited, and approved by a human before they go out. If an engagement sets up AI that runs inside your own business (for example, automations that answer your customers), those operate without us reviewing each individual output; how that works is covered by your engagement agreement.
How long we keep it
Email threads stay in our inbox for as long as we run the business. Analytics data follows Google's default retention. If you ask us to delete something, we do.
We keep personal information for as long as we need it for the purpose it was collected, plus a reasonable period to handle follow-up, tax, accounting, and legal obligations. Concretely:
- Email correspondence stays in our Gmail inbox until we delete it or until you ask us to delete it.
- Form submissions delivered through Resend stay in Resend's sending logs and dashboard per Resend's retention settings, and in our inbox until we delete them.
- Analytics data in Google Analytics is kept for the default retention period set in our account (14 months) and then aggregated.
- Engagement records (signed contracts, invoices, project files) are kept for the period our accountant and the IRS recommend, currently seven years.
Your rights
Depending on where you live, you may have some or all of the following rights with respect to the personal information we hold about you:
- The right to know what personal information we have collected about you and how we have used it.
- The right to a copy of that information in a portable format.
- The right to correct inaccurate information.
- The right to delete your personal information, subject to limited exceptions (for example, tax records we are required to keep).
- The right to opt out of sale or sharing of your personal information. As noted above, we do not sell or share, but the right is yours regardless.
- The right to non-discrimination for exercising any of the above. We will not charge you a different price or provide a different level of service because you exercised a privacy right.
To exercise any of these rights, see How to make a request below.
California residents
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, “CCPA”), gives you the rights described in Section 7. This section gives you the specific CCPA disclosures.
Categories of personal information we have collected in the last 12 months
- Identifiers (name, email, phone number, IP address, online identifiers such as analytics cookie IDs).
- Commercial information (the fact that you requested an audit, the workshop you asked about, the service tier you considered).
- Internet or other electronic network activity (pages viewed, time on page, referring URL, device and browser data).
- Approximate geolocation derived from your IP address (country and city level).
- Professional information you voluntarily share about your business (industry, team size, role).
Sources
Directly from you, automatically from your device when you visit the Site, and from our service providers (Google Analytics, Vercel) acting on our behalf.
Business purposes for collection
The purposes described in Section 3 (How we use it).
Categories shared with service providers
The categories above, shared with the providers listed in Section 4 (Who we share it with), under written terms that limit their use to the services they provide for us.
Sale or sharing for cross-context behavioral advertising
We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We have not done either in the preceding 12 months. We do not have actual knowledge of selling or sharing the personal information of consumers under 16 years of age.
Sensitive personal information
We do not collect or process sensitive personal information as defined under California law. Because we do not use it to infer characteristics about you, the right to limit its use does not apply.
Authorized agents
You may use an authorized agent to make a request on your behalf. We will ask the agent to submit signed written authorization from you and may also ask you to verify the agent's authority directly.
Notice of financial incentive
We do not offer financial incentives in exchange for the collection, sale, or deletion of personal information.
How to make a request
To exercise any of the rights described above, email us at hereforwardai@gmail.com with the subject line “Privacy request” and tell us which right you want to exercise. You can also mail a written request to the address in Section 13.
So that we can verify it really is you, we will reply from our address and ask you to confirm the request from the email account associated with the information you're asking about, and we may ask one or two clarifying questions to match your request against our records. We will not ask for more information than we need.
We aim to respond within 45 days. If we need an extension, we will tell you why and how much longer it will take, up to a further 45 days. Verifiable requests are free; we reserve the right to charge a reasonable fee for requests that are manifestly unfounded or excessive, or to refuse such requests, in line with applicable law.
Security
We take reasonable steps to protect personal information against loss, unauthorized access, and misuse. Those steps include using vendors that offer industry-standard encryption in transit and at rest, limiting access to the people who need it, using strong authentication on our accounts, and keeping our software up to date. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security. If a breach affects you and the law requires us to tell you, we will.
Children
The Site is intended for adults running or working in businesses. It is not directed to children under 16, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.
Changes to this policy
We may update this policy from time to time. If we make a material change, we will update the “Last updated” date at the top of this page and, where appropriate, give you additional notice (for example, a banner on the Site or an email if we have one for you). Continued use of the Site after a change takes effect means you accept the updated policy.
Contact us
Questions about this policy, or want to exercise a right described above? Get in touch.
Denver, CO 80203
United States