Privacy Policy

1. Introduction

keysa gaan OÜ ("Forge," "we," "our," or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

Data Controller:
keysa gaan OÜ
Pallasti tn 33-154, Tallinn 11416, Estonia
Registry code: 17531664
Email: privacy@forge.actor

2. Information We Collect

2.1 Personal Information

We collect the following categories of personal data:

• Identity Data: Name, username, date of birth
• Contact Data: Email address, billing address
• Financial Data: Payment card details (processed by our payment provider)
• Transaction Data: Purchase history, credit balance
• Technical Data: IP address, browser type, device information
• Usage Data: How you use our website and services
• Communications Data: Your messages to us and preferences

2.2 How We Collect Data

We collect data through:

• Direct interactions (account creation, purchases, correspondence)
• Automated technologies (cookies, server logs, analytics)
• Third parties (payment processors, analytics providers)

3. Lawful Basis for Processing

We process your personal data under the following lawful bases:

• Contract Performance: To provide services you've requested and manage your account
• Legal Obligation: To comply with tax, accounting, and other legal requirements
• Legitimate Interests: To improve our services, prevent fraud, and ensure security
• Consent: For marketing communications and non-essential cookies (where required)

4. How We Use Your Information

We use your personal data to:

• Provide and maintain our services
• Process transactions and manage your credit balance
• Match you with appropriate artificers for your projects
• Communicate with you about your account and services
• Send marketing communications (with your consent)
• Improve our platform through analysis and research
• Prevent fraud and ensure platform security
• Comply with legal and regulatory obligations

5. Information Sharing and Disclosure

We do not sell your personal data. We may share data with:

• Service Providers: Payment processors, cloud hosting, email services, analytics (acting as data processors)
• Artificers: Limited information necessary to fulfill your creation requests
• Legal Authorities: When required by law or to protect rights and safety
• Business Transfers: In connection with merger, acquisition, or asset sale (with notice to you)

All third-party processors are bound by data protection agreements and process data only as instructed by us.

6. International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA). When we transfer data internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions confirming adequate data protection levels
• Other legally recognized transfer mechanisms

7. Data Retention

We retain your personal data only as long as necessary for the purposes set out in this policy:

• Account Data: Until you close your account, then 30 days for recovery period
• Transaction Records: 7 years from transaction date (legal requirement)
• Communications: 3 years from last interaction
• Marketing Data: Until you withdraw consent, then deleted within 30 days
• Technical/Usage Data: 2 years from collection

After the retention period, we will securely delete or anonymize your personal data.

8. Your Rights Under GDPR

As a data subject in the European Union, you have the following rights:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent for processing at any time
• Right Not to be Subject to Automated Decision-Making: Including profiling

To exercise any of these rights, contact us at privacy@forge.actor. We will respond to your request within 30 days.

Right to Lodge a Complaint: You have the right to lodge a complaint with your local supervisory authority if you believe we have not handled your data properly.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Regular security assessments and penetration testing
• Access controls and authentication mechanisms
• Employee training on data protection
• Incident response and breach notification procedures

While we strive to protect your data, no method of transmission over the Internet is 100% secure. We will notify you and the relevant supervisory authority of any data breach where required by law.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to improve your experience. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

You can control cookie settings through your browser preferences. Note that disabling essential cookies may affect platform functionality.

11. Children's Privacy

Our services are not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child under 16, please contact us immediately at privacy@forge.actor and we will delete it promptly.

12. Marketing Communications

We will only send you marketing communications if you have given us consent or where we have a legitimate interest (and you have not opted out).

You can opt out of marketing communications at any time by clicking the unsubscribe link in our emails or updating your preferences in your account settings. You will continue to receive essential service-related communications.

13. Automated Decision-Making

We use automated systems to match users with artificers based on project requirements and artificer expertise. This does not involve fully automated decision-making with legal or similarly significant effects. You can request human review of any matching decisions by contacting support@forge.actor.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes via email or prominent notice on our website at least 30 days before they take effect. The "Last updated" date at the top of this page indicates when this policy was last revised.