1. Who we are
ForgeVexa is an AI website-building service operated under the legal name forgevexa (“ForgeVexa,” “we,” “us”). This policy covers forgevexa.com and the ForgeVexa workspace. For privacy requests or questions about the operator, use our contact form and choose “Privacy & data.”
This policy describes our own service. Third-party sites and services you visit through links have their own policies.
2. Information we collect
Account information: your name, email address, a securely hashed password, account role, email verification status, and account creation time. Registration activates your workspace immediately; it does not automatically establish ownership of your email address.
Project information: prompts, conversations, project names, generated and manually edited code, saved versions, chosen models, build status, and usage records.
Billing information: your plan, credit balance, credit ledger, and payment processor customer, subscription, invoice, and transaction references. Stripe handles payment details; we do not store full card numbers or card security codes.
Support information: contact details and the contents of requests you submit. We also receive basic technical information, such as IP address, browser request details, security events, and service errors, when you access the service.
3. How we use information
We use information to create and secure accounts, save and generate projects, process authorized payments, calculate credits, respond to support and privacy requests, troubleshoot problems, prevent abuse, and meet applicable legal obligations.
Where data protection law requires a legal basis, we rely on performance of our contract for the service, legitimate interests in operating and protecting it, legal obligations for required records, and consent where applicable. We do not sell personal information or share it for cross-context behavioral advertising. We do not use your projects to train our own AI models.
4. AI processing and service providers
When you choose a live AI model, your prompt, current project files, and relevant recent conversation are sent through OpenRouter to the selected model provider. Available model families may include Anthropic, OpenAI, Google, and DeepSeek. Providers process this content under their own terms and policies. We request routing that excludes providers permitting data collection; that setting is not a promise that all operational retention is zero.
Template demo mode runs without sending prompts or project files to an AI provider. Do not put passwords, API keys, sensitive personal information, or material you are not authorized to share into prompts or project files.
Other providers may include Stripe for billing, Cloudflare for web delivery and security, Resend for transactional emails when enabled, and infrastructure providers for hosting. A provider receives information only as needed for the feature being used. We may disclose information where legally required, to protect rights and security, or as part of a business transfer with appropriate safeguards.
5. Cookies and browser storage
We use an essential, HTTP-only session cookie to keep you signed in. Temporary browser storage may preserve a draft prompt while you create an account. We do not currently install advertising cookies or third-party analytics trackers. Our CDN may use security cookies when needed. See the Cookie Policy for details.
6. Retention and deletion
Account and project records remain while your account is open unless you delete a project. You can delete projects, export account data, and delete your account in Settings. Account deletion removes your active account, projects, saved conversations, and versions, and anonymizes linked support content.
Expired sessions and email tokens are removed regularly. Financial transaction references may be retained for up to seven years, or longer where law requires, with the account link removed after deletion. Resolved support requests may be retained for up to two years. Operational logs are kept for a limited period, generally no more than 30 days. Deleted information may remain in rotating backups for up to 30 days before it is overwritten.
A preservation duty, dispute, fraud investigation, or other legal requirement may justify retaining specific records longer. Stripe and other processors manage their own records under their applicable obligations.
7. Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information; restrict or object to certain processing; withdraw consent; and complain to your local data protection authority. We will not discriminate against you for exercising applicable rights.
Use Settings for account updates, export, and deletion. For other requests, use our contact form. We may need to verify ownership before acting on a request and will respond within the time required by applicable law. An authorized agent may submit a request where the law permits, subject to verification.
8. Security and international processing
We use HTTPS, hashed passwords, access controls, server-side provider credentials, and isolated website previews. No system is completely secure. Information may be processed in countries other than your own through our infrastructure and service providers. Where required, appropriate legal transfer safeguards must apply to that processing.
9. Age requirements
The service is intended for people aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided information, contact us so we can investigate and remove it where appropriate.
10. Changes and contact
We may update this policy as the service changes. The effective date will be updated, and we will provide additional notice where required for material changes. Send privacy questions to forgevexa through our contact form and keep the request reference for follow-up.