Legal

Privacy Policy

Last updated: July 2026

Our Privacy Commitment

Z-Forge is built privacy-first. We collect the absolute minimum data needed to run the Service — just your email and subscription status. We do not store your prompt content or model responses. We do not log API request content. We do not use your data to train or fine-tune models. We do not sell your data. No data retention, no logs, no traces.

1. Company Information

This Privacy Policy is published by [COMPANY_NAME], a company registered in [COUNTRY] under registration number [COMPANY_REG_NO], with its registered address at [COMPANY_ADDRESS]. We are the data controller of your personal data for the purposes of the Singapore Personal Data Protection Act (PDPA).

Our Data Protection Officer can be contacted at dpo@z-forge.ai.

2. Data We Collect — And What We Don't

What we collect:

• Email address — for account identification and support
• Password hash — stored as bcrypt hash, never in plaintext
• API key — for authentication, stored encrypted in our database
• Usage metadata — token count, request timestamp, response time, error code
• Subscription status — plan tier, billing period, payment status (processed by Stripe)

What we do NOT collect:

• ✗ Credit card numbers or banking details (handled entirely by Stripe)
• ✗ Prompt content or model responses (deleted within 24 hours)
• ✗ Your real name, phone number, or physical address
• ✗ Your game project files or source code
• ✗ Tracking data for advertising or analytics
• ✗ Your IP address (used only for rate limiting, not stored)

3. How We Use Your Data

We use your data solely to:

• Authenticate your API requests and enforce plan token limits
• Process subscription payments via Stripe
• Provide usage analytics in your dashboard
• Send service notifications (billing, security, maintenance)
• Respond to your support requests

We do not use your data for:

• ✗ Training or fine-tuning AI models
• ✗ Marketing to third parties or selling your data
• ✗ Building user profiles or behavioral tracking
• ✗ Sharing with advertisers

4. Data Retention

We retain data for the minimum time necessary:

Data Type	Retention Period	After That
Account (email, password hash)	While subscription is active	Deleted within 30 days of cancellation
API request metadata	30 days	Permanently deleted
Prompt content & responses	24 hours (debugging only)	Permanently deleted
Billing records	90 days after cancellation	Permanently deleted
API key	While subscription is active	Deactivated on cancellation

5. Third-Party Services

We use the following third-party services, each governed by their own privacy policy:

• Stripe — payment processing. Stripe collects your payment method details and transaction data. We receive only your subscription status and payment outcome. See Stripe's Privacy Policy.
• Upstream model providers (Anthropic, OpenAI, Google, Meta, etc.) — we route your prompts to these providers to generate responses. Your prompt content is transmitted to them in real-time and is not stored by Z-Forge beyond 24 hours.

6. Data Security

We implement the following security measures:

• All data in transit is encrypted via HTTPS/TLS 1.3
• Passwords are hashed using bcrypt (10 rounds)
• API keys are stored in encrypted form, never returned in full after generation
• Database access is restricted to authorized personnel with audit logging
• No payment data is stored on our servers (handled by Stripe)
• Regular security reviews and penetration testing

7. Data Storage Location

Your data is stored on servers located in [COUNTRY]. Upstream model providers may process your prompts in their respective regions (United States, Europe, or Asia-Pacific). We do not transfer your personal data to any jurisdiction that does not provide a comparable standard of data protection to the Singapore PDPA.

8. Your Rights Under PDPA

Under the Singapore Personal Data Protection Act (PDPA), you have the right to:

• Access — request a copy of the personal data we hold about you (limited to your email and subscription status)
• Correction — request correction of inaccurate or incomplete data
• Withdrawal of consent — withdraw consent for data processing at any time
• Deletion — request deletion of your account and associated data
• Data portability — request export of your usage data in a machine-readable format

Given our minimal data practices, most requests can be fulfilled immediately — in many cases, the answer is simply that we do not hold the data you asked about. Nevertheless, we are committed to responding to every request.

To exercise any of these rights, contact our Data Protection Officer at dpo@z-forge.ai. We will respond within 30 days.

9. Data Breach Notification

In the event of a data breach that is likely to result in significant harm to you, we will notify you and the Personal Data Protection Commission (PDPC) as soon as practicable, in accordance with our obligations under the PDPA.

10. Cookies

We use only essential cookies for authentication and session management. We do not use tracking cookies, advertising cookies, or third-party analytics. No cookie data is shared with third parties.

11. Children's Privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us and we will delete it immediately.

12. Changes to This Policy

We may update this Privacy Policy at any time. We will notify you by email of any material changes at least 30 days before they take effect. The effective date above reflects the last revision.

13. Contact

For privacy questions, data requests, or to contact our Data Protection Officer:

Data Protectiondpo@z-forge.ai

Supportsupport@z-forge.ai

Generalhello@z-forge.ai