Privacy Notice

Who is responsible

forge AI studio provides Forge AI Studio and acts as data controller for personal data processed to operate the service. Paddle separately processes payment-related personal data as Merchant of Record under its own privacy notice.

The seller's country and support email have not yet been supplied and will be published before live credit sales launch. Country-specific rights and transfer disclosures will be updated when the seller's jurisdiction is confirmed.

Data we collect and why

• Account details: email, account identifier, profile information where supplied, authentication records, sign-in provider and account timestamps. Used to create accounts, authenticate access and maintain account security.
• Project and AI content: prompts, chat and plan messages, generated website code, project names, SEO descriptions, published URLs and revisions. Used to answer requests, generate sites, save work and publish content you choose to make public.
• Preferences: default colours, currency and contact details such as email, phone or WhatsApp number that you provide. Used to apply your site defaults; these details may become public in sites you publish.
• Credit records: account balances, credit grants, transaction references, pack identifiers, order amounts and currencies. Used to maintain credit accounts, confirm purchases, prevent fraud and meet accounting obligations. Payment card details are handled by the payment provider, not entered into Forge's own forms.
• Usage and technical information: page and published-site view records, AI operation records, browser/device information, IP addresses and error or network logs handled by hosting and service infrastructure. Used for service operation, analytics, reliability and security.
• Support information: messages and order details you provide when seeking assistance. Used to answer requests and resolve disputes.

Providing account and request information is necessary for the features that use it. Do not include sensitive information or another person's data in prompts unless you have an appropriate legal basis and permission.

Legal bases

We process account, project, AI and preference data to perform our contract with you; operational logs and limited usage analytics for legitimate interests in securing and improving the service; accounting and required disclosures to meet legal obligations; and optional marketing or non-essential tracking only with consent where required. You may withdraw consent without affecting earlier lawful processing.

Who receives data

We share data as necessary with service providers for hosting, account authentication, database storage, operational analytics and support. Forge currently uses Lovable Cloud for hosting and account/data services, and OpenAI to process AI prompts and relevant project or conversation context. Forge requests that OpenAI API responses are not stored through the response-storage option; this does not guarantee the absence of provider security logs or other provider retention.

Paddle receives information needed for product sales, payment handling, tax compliance, invoicing, refunds and credit-purchase confirmation. Google or Apple receives authentication information when you choose its sign-in option. Authorised assistants receive only the access you approve through Forge's account permission flow.

We may also disclose necessary information to professional legal or accounting advisers and public authorities where legally required. Sites you publish are publicly accessible: do not publish confidential content.

Retention and deletion

Account details, saved projects, conversations and preferences are retained while needed to provide your account and requested service. Deleting a project removes its saved project record through Forge; copies, provider logs or backups may persist under the relevant provider's retention practices. Payment and credit records may need longer retention for accounting, fraud prevention and legal obligations.

Data should be deleted or anonymised when no longer needed, subject to legal and security obligations. Forge does not yet enforce a fixed automatic expiry for all account, usage or ledger records; specific retention schedules and the seller's direct request contact must be completed before live sales launch.

Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection to processing, withdraw consent, and complain to your local data protection authority. If UK or EEA data-protection law applies, these include GDPR rights and a response ordinarily within one month, subject to lawful extensions. We may need to verify your identity before acting.

You can update saved preferences and delete individual projects within your account. A direct seller contact for other privacy and rights-holder requests is awaiting the owner's support email; it will be added before live sales are enabled.

Security and international processing

We use appropriate technical and organisational safeguards, including encrypted connections, protected credentials and account-scoped access controls. No service can guarantee absolute security. Keep account credentials private and review public sites before publishing.

Service providers may process information outside your country. Where applicable law requires it, international transfers must use appropriate safeguards such as adequacy decisions or standard contractual clauses. The seller's jurisdiction and applicable transfer arrangements still require confirmation before live sales launch.

Cookies and browser storage

Forge uses essential browser storage for sign-in sessions and navigation or editor preferences. Hosting and payment checkout services may use essential cookies for security and transactions. Forge records page-view events for operational analytics; this notice does not imply that a separate advertising or marketing cookie programme is enabled.

You can manage cookies and stored site data in your browser; blocking essential storage may prevent sign-in or checkout. Optional analytics or marketing cookies, if introduced, will require the choices and consent applicable to your location.

Changes and payment support

We will update this notice when our practices change and provide any legally required notice. For payment-specific questions, visit paddle.net or review Paddle's Privacy Notice.