Privacy Policy

This policy explains how Forge60 handles personal data and your rights under the EU General Data Protection Regulation (GDPR). Forge60 is a service operated by Castleground Group AB (reg. no. 559568-2849, VAT no. SE559568284901), Spånlöt 18, SE-186 97 Brottby, Sweden (“we”, “us”). For any privacy question, contact support@forge60.com.

Our two roles

We handle personal data in two different roles, and it matters which one applies:

• As controller — for the data we need to run Forge60 and your account (for example your email, your billing details, and the content you create). This policy covers that data.
• As processor — for the personal data your own website visitors give you through a site you publish with us (for example contact-form messages, newsletter sign-ups and visitor statistics). There, you are the controller and we only process that data on your instructions. See “Data we process for you” below.

What we collect (as controller)

• Account data — your email address and a securely hashed password. Authentication is handled by our provider (Supabase); we never see your plaintext password. If you choose Sign in with Google, Google shares your name, email address and profile picture with us.
• Content you create — the descriptions and instructions you enter, the websites we generate, your edits, site names, and any images you upload.
• Billing data — your plan, subscription status and payment confirmations. Payments are handled by Stripe; we never receive your full card number.
• Technical data — IP address, browser type, and basic server logs, used to run and secure the service.
• Support messages — anything you send us by email.
• Withdrawal requests — if you use our withdrawal form, the name, email address and purchase details you enter, which we keep with our records of that purchase (Article 6(1)(c), our legal obligation).
• Feedback — if you rate Forge60 or leave a review, your rating, comment and name, and whether you allow us to show it.

Why we use it and our legal basis

• To provide the service — create your account, generate, edit, host and publish your sites, take payment (Article 6(1)(b) GDPR, performance of a contract).
• To keep the service secure and prevent abuse — logging, rate-limiting, fraud prevention (Article 6(1)(f), our legitimate interest).
• To understand how forge60.com is used — cookieless usage statistics (Article 6(1)(f), our legitimate interest in improving the service).
• To meet legal obligations — for example keeping accounting records (Article 6(1)(c)).
• With your consent — where we ever ask for it; you can withdraw consent at any time (Article 6(1)(a)).

AI generation

To build and edit your website, the descriptions and instructions you enter are sent to our AI provider (Anthropic) for processing. Please do not enter sensitive personal data you do not want processed this way. Generated text and images are produced automatically and may be inaccurate — you are responsible for reviewing a site before you publish it.

We do not train AI models on your data. Your prompts, content and site data are used only to provide the service, never to train or improve any AI model. Our AI provider processes this data on our behalf under contract and does not use it to train its models either.

Analytics — cookieless

For sites you publish, we provide you with basic visitor statistics (page views, approximate unique visitors, referring site and country). This works without cookies and without storing anything on the visitor’s device. For each page view we store the site, the time, the referring website’s domain, the country, and a one-way hash made from the visitor’s IP address, browser and a value that changes every day. The IP address and browser string themselves are never stored, and because the daily value changes, a visitor cannot be followed from one day to the next. The hash is still a pseudonymous identifier, so we treat it as personal data: we process it on your behalf (see “Data we process for you”), on the basis of the legitimate interest in knowing how a website is used (Article 6(1)(f) GDPR), and it is deleted together with the site.

On forge60.com itself we use Vercel Web Analytics to count page views. It does not use tracking cookies; visits are identified only by a hash of the request, which is discarded after 24 hours, and the statistics we see are aggregated.

Cookies

We use only strictly necessary cookies — chiefly the cookie that keeps you signed in. We do not use advertising or cross-site tracking cookies, so no consent banner is needed to use Forge60.

Data we process for you (as processor)

When you publish a site, your visitors may submit personal data to you — for example a name, email and message in a contact form, or an email address in a newsletter sign-up — and we record cookieless visitor statistics for you. We store and process that data solely to deliver it to you and provide the feature; we do not use it for our own purposes. For this data you are the controller and we act on your behalf under Article 28 GDPR. Our Data Processing Agreement is part of our Terms of Service and applies automatically.

Third-party content on published sites. Fonts on published sites are delivered from our own servers, so visitors’ IP addresses are not sent to Google Fonts. Maps, videos and booking widgets from other services (for example Google Maps, YouTube or Calendly) load only after the visitor clicks to load them; until then, nothing is sent to that service. Stock photos are loaded from Pexels when a page is viewed.

Who we share it with (sub-processors)

We rely on a small set of vetted providers to run the service:

• Supabase — authentication, database and file storage.
• Anthropic — AI generation and editing of your website content.
• Stripe — payment processing for paid plans.
• Vercel — hosting the app and serving published sites, and cookieless usage statistics for forge60.com.
• Resend — sending transactional email (for example contact-form notifications and support replies).
• Cloudflare — DNS and email routing for our domain.
• Pexels — stock-image search for photos placed on generated sites (only the search words are sent, never personal data).

Purchases are sold through Link: Sold through Link, LLC, a Stripe company, is the merchant of record for your payment. It processes your payment and billing details as an independent controller under its own privacy policy.

If you use Sign in with Google, Google processes your sign-in under its own privacy policy.

We will give reasonable notice before adding or changing a sub-processor, and you may object to a change on reasonable data-protection grounds, as set out in our Data Processing Agreement. We do not sell your personal data, and we do not use it to train AI models.

International transfers

Some providers process data outside the EU/EEA (for example in the United States). Where they do, the transfer is covered by an appropriate safeguard under the GDPR, chiefly the European Commission’s Standard Contractual Clauses, together with supplementary measures where needed.

How long we keep it

• Account and site data — for as long as your account is active. If you delete a site or your account, we delete or anonymise the associated personal data within 30 days, except as noted below.
• Billing and accounting records — kept for 7 years as required by the Swedish Accounting Act (Bokföringslagen).
• Security logs — kept for a short period (typically up to 90 days) and then deleted.
• Backups — retained for up to 90 days on a rolling basis, then overwritten.
• Site statistics — kept for as long as the site exists and deleted together with it.

How we protect it

We use encryption in transit (HTTPS), access controls and row-level security so each account can reach only its own data, and we limit who and what can access personal data. No online service can be guaranteed perfectly secure, but we take the measures required under Article 32 GDPR.

Your rights

Under the GDPR you have the right to access, correct, delete, restrict and object to the processing of your personal data, to data portability, and to withdraw consent where processing is based on it. To exercise any of these, email support@forge60.com. You also have the right to lodge a complaint with your supervisory authority — in Sweden, the Swedish Authority for Privacy Protection (IMY, imy.se).

Children

Forge60 is not directed at children under 16, and we do not knowingly collect their personal data.

Changes to this policy

We may update this policy from time to time. We will change the date above and, for significant changes, notify you by email or in the app. Questions: support@forge60.com.