01Who is responsible
Axio, the company that makes Forge Cloud, is responsible for the personal data described here.
Axio Technologies Limited ("Axio", "we") is the controller of the personal data we collect to run Forge Cloud. You can reach us about privacy at privacy@forgecloud.cc [confirm this address, or use support@forgecloud.cc].
When you use Forge to run your own apps, you decide what personal data those apps handle. For that data you are the controller, and it stays on your servers.
02What we collect
Account and workspace details, billing details, the settings you give Forge, and the records needed to run and secure it.
Account: your name, email address, a hash of your password (never the password itself), your authenticator settings, and who invited you to Forge.
Workspace: its name, members and their roles, projects, services, domains and settings. Secrets you store, such as environment variables and access tokens, are encrypted.
Billing: your billing contact, company, tax ID, address and country, your plan and payments. Card payments are handled by Paystack; we only receive the card type, last four digits, expiry, issuing bank and country, never the full card number.
Servers: details the Forge Agent reports, such as hostname, IP address, operating system, resource usage, and the status and logs of deployments you run through Forge.
Email sent through Forge: the sender, recipients, subject, delivery status, bounces and complaints, kept to deliver mail and protect the sending network.
Security and usage: sign-in records, IP addresses, browser type, and an audit log of actions taken in your workspace.
Website visits: on forgecloud.cc we count page views and which buttons are clicked, with the site page group, the site you came from (its domain only), your browser, operating system and device type (desktop, mobile or tablet), and campaign tags in the link you followed (source, medium and campaign name). Query strings, fragments, arbitrary paths, form text and person properties are removed before events are sent. This uses PostHog in cookieless mode: nothing is stored on your device. To count visitors without cookies, PostHog combines your IP address and your browser's user agent into a daily hash and then discards both; it does not keep them. Analytics for the contact form includes only the approved topic and plan; the pre-filled email you choose to send contains your message.
03What we don't collect
Your workloads live on your servers. Features you explicitly use can process selected database results or logs through Forge.
Your apps' data and your databases live on servers you control. Forge processes selected data when you explicitly use database inspection, exports, logs or other operations. Database inspection results are encrypted while relayed through the control plane; retention follows the owning operation. Backup payloads use the supported storage path.
When you use Forge's AI failure explanations, the relevant build logs are sent to the AI provider you configure, using your own key.
04How we use it
To run Forge, keep it secure, bill you and support you. Never to sell it or for advertising.
We use your data to provide Forge (our contract with you), to bill you and keep tax records (legal obligation), and to secure Forge, prevent abuse and improve it (our legitimate interests).
We send you service emails, such as verification codes, billing notices and security alerts. Product news is sent only if you agree, and you can stop it at any time.
We do not sell your personal data or use it for advertising.
06How long we keep it
Only as long as needed. Audit history follows your plan.
Account and workspace data: while your account is open, then deleted within [90] days of closing it, except what we must keep.
Invite requests (name, company name, company email and reason) are used to review access and, when approved, send an email-bound invitation. Requests and pseudonymous request-abuse records are kept for up to 365 days. Registration invite/referral metadata is kept for up to 365 days, except that an account keeps who invited it for as long as the account exists; encrypted invite emails and pseudonymous anti-abuse counters for up to 90 days. Audit logs: kept for your plan's retention period (90 days on Starter, 180 days on Pro, 1 year on Business, 2 years on Agency).
Billing records: kept as long as tax law requires [e.g. 6 years].
Email delivery records and server logs: kept for [30–90] days, unless needed to investigate abuse.
07How we protect it
Encryption, least-privilege access, and a full audit trail.
Secrets are encrypted at rest, sessions and passwords are protected, two-factor authentication is required for workspace owners and admins, and staff access to workspace data needs your approval and is logged. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.
08Your rights
Ask to see, export, correct or delete your personal data at any time.
Depending on where you live, including under Nigeria's Data Protection Act 2023 and the EU and UK GDPR, you can ask to access, correct, export or delete your personal data, object to or restrict how we use it, and withdraw consent.
Email privacy@forgecloud.cc [confirm] from your account's address. We reply within 30 days. You can also complain to your data protection authority, such as the Nigeria Data Protection Commission.
Forge is not meant for children, and we do not knowingly collect their data.
09Cookies and changes
Forge uses only the cookies it needs. We tell you before this policy changes.
The Forge app uses a sign-in cookie that it needs to work. The forgecloud.cc website sets no cookies: its analytics are cookieless, and you can block them in your browser.
We will tell you about material changes to this policy before they take effect.