Privacy Policy
This policy explains what personal data Forja (forja.build) collects, why, and what your rights are. It covers our own website and workspace. For a product built with Forja, the person or company running that product is responsible for its visitors' data; Forja processes it on their behalf.
Who is responsible
Forja is operated from Ireland. Contact for anything related to personal data: hello@forja.build.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Account details: e-mail, name, password hash or Google identity, workspace name, photo | To create and secure your account and sign you in | Contract |
| Projects, content, media, settings and the databases of your projects | To provide the service you asked for | Contract |
| Billing details and invoices (handled by Stripe; we store no card numbers) | To charge subscriptions and comply with tax law | Contract, legal obligation |
| Usage inside the workspace: actions in the admin, errors, page views without cookies | To keep the service working, secure and auditable | Legitimate interest |
| Messages you send us (contact form, e-mail) | To reply | Legitimate interest |
| Text, references or images you submit to AI features | To generate the content you requested | Contract |
We do not sell personal data and we do not use advertising trackers.
Cookies
The website works with one strictly necessary session cookie once you sign in, plus a security cookie for forms. Visits are counted without cookies or fingerprinting. There is no cookie banner because there is nothing to opt out of.
Who else sees data
We use a small number of providers, each bound by a data processing agreement:
- Hetzner (Finland, EU): servers and backups. All project data is stored in the EU.
- Stripe: payments and invoices.
- Resend: transactional e-mail and campaigns sent by projects.
- Google: optional sign-in with a Google account.
- Anthropic and OpenAI: AI text and image generation, only for the content you submit to those features.
- Namecheap: domain registration, when you buy a domain through Forja.
Where a provider processes data outside the EU, the transfer is covered by the European Commission's standard contractual clauses or an adequacy decision.
How long we keep data
Account and project data are kept while your account is active. Archived projects are kept so they can be restored; you may delete them at any time. Deleted accounts and projects are removed from live systems immediately and from backups within 30 days. Invoices are kept for the period required by tax law.
Your rights
You can access, correct, export or delete your data from Account and from each project's admin. You may also ask us by e-mail to exercise any right under the GDPR, including objection and restriction, and you may complain to the Irish Data Protection Commission or your local supervisory authority.
Security
Data is encrypted in transit, secrets are encrypted at rest, admin access requires two-factor authentication, every project has its own isolated database, and backups run daily. If a breach affects your data we will tell you without undue delay.
Changes
We will announce material changes to this policy by e-mail. Last updated: 6 September 2026.