Privacy Policy

1. What We Collect

When you create an account, we collect your email address and the display name you choose. When you make a purchase or set up as a seller, Stripe collects your payment or payout details directly — GetForged never sees or stores your full card number or bank account details. We also collect standard usage data (pages visited, browser type, approximate location derived from IP) to understand how the Platform is used and to improve it.

2. How We Store Your Data

User accounts and product data are stored in Supabase, a Postgres-based cloud database hosted on AWS infrastructure in the EU. Supabase is SOC 2 Type II certified. Your password is never stored in plain text — authentication is handled via Supabase Auth using bcrypt hashing. We retain your account data for as long as your account is active, plus a reasonable period after deletion for legal and fraud-prevention purposes.

3. Third-Party Services

• Stripe — processes all payments. Stripe's own privacy policy governs the data you share with them at checkout.
• Resend — handles transactional email (order confirmations, password resets). We share only your email address and the minimum data needed to send the relevant email.
• Supabase — database and authentication infrastructure.
• Vercel — hosts the application. Vercel may log request metadata for security and performance purposes.

We do not sell your data to any third party, ever. We do not use your data for advertising targeting on other platforms.

4. Cookies & Tracking

We use essential session cookies required for authentication. We do not use advertising cookies or third-party tracking pixels. Basic analytics (page views, referrers) may be collected in aggregate form; this data is not linked to individual identities.

5. Your Rights (GDPR)

If you are located in the UK or EU, you have the right to access, correct, or delete your personal data. You may also request a portable copy of your data or object to certain processing. To exercise any of these rights, email privacy@getforged.io with “Data Request” in the subject line. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority (in the UK: the ICO at ico.org.uk).

6. Data Retention & Deletion

You may request deletion of your account at any time by emailing privacy@getforged.io. We will delete or anonymise your personal data within 30 days, except where retention is required by law (e.g., financial records for tax purposes, which may be kept for up to 7 years).

7. Changes to This Policy

We may update this policy as our services evolve. Material changes will be communicated by email or prominent notice on the Platform. Continued use after the effective date constitutes acceptance of the revised policy.

Privacy questions? Email privacy@getforged.io