GDPR Compliance
1. Data controller
For the purposes of the GDPR, the data controller for personal data processed through avakode.com and the Forge Suite plugins is:
Individual Entrepreneur Darya Avakova
Tax Identification Number: 534556558
Registered address: Parkent street 9, apt. 78, Mirzo Ulugbek district, Tashkent, Republic of Uzbekistan
Contact for privacy matters: [email protected]
2. Who this page is for
This page is aimed at:
- End customers who purchase Forge Suite licenses from inside the EU/EEA, the UK, or Switzerland
- Website visitors located in those regions
If you operate a WordPress site that uses Forge Suite plugins and that site collects data from EU residents, you are the data controller for that visitor data — not Avakode. The plugins store that data in your own WordPress database. You are responsible for your own site’s GDPR compliance, and we act as a data processor only to the extent that specific plugin features (such as AI translations or Forge API integrations) route data through our infrastructure.
3. Your rights under GDPR
As a data subject under the GDPR, you have the following rights in relation to personal data we hold about you:
3.1 Right of access (Article 15)
You can request a copy of the personal data we hold about you, along with information about how we process it.
3.2 Right to rectification (Article 16)
If any of the data we hold about you is inaccurate or incomplete, you can ask us to correct it.
3.3 Right to erasure / “right to be forgotten” (Article 17)
You can ask us to delete your personal data. We will comply unless we are required to retain it for a legitimate legal or contractual reason (for example, tax records).
3.4 Right to restrict processing (Article 18)
You can ask us to limit how we use your data in certain circumstances — for example, while a dispute about accuracy is being resolved.
3.5 Right to data portability (Article 20)
You can request your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) to transfer it to another service.
3.6 Right to object (Article 21)
You can object to processing based on legitimate interest, and to any direct marketing.
3.7 Right not to be subject to automated decision-making (Article 22)
We do not make any decisions about you purely based on automated processing. Our use of AI is limited to content generation at your request — it does not produce legally significant decisions about you.
3.8 Right to withdraw consent (Article 7(3))
Where we rely on consent to process your data (for example, optional product announcements), you can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
3.9 Right to lodge a complaint (Article 77)
You have the right to lodge a complaint with a supervisory authority — typically the data protection authority in the EU/EEA country where you live or work. A list is maintained by the European Data Protection Board at edpb.europa.eu.
4. How to exercise your rights
Email [email protected] with the subject line “GDPR Request” and tell us which right you’d like to exercise. To protect you, we may ask you to verify your identity before acting on the request — typically by confirming the email address registered to your account.
We respond to all requests within 30 days. If the request is unusually complex, we may extend this by a further two months and will notify you of the delay and the reason.
Exercising your rights is free of charge. We only charge a fee in the rare case of manifestly unfounded or excessive requests, and we will tell you before doing so.
5. Legal bases for processing
We process personal data under the following legal bases:
| Activity | Legal basis | Article |
|---|---|---|
| Creating and managing your Avakode account | Performance of a contract | Art. 6(1)(b) |
| Processing payments and issuing invoices | Performance of a contract, legal obligation | Art. 6(1)(b), 6(1)(c) |
| License verification | Performance of a contract | Art. 6(1)(b) |
| Routing AI requests to providers | Performance of a contract | Art. 6(1)(b) |
| Responding to support requests | Performance of a contract | Art. 6(1)(b) |
| Security, fraud detection, abuse prevention | Legitimate interest | Art. 6(1)(f) |
| Tax records and accounting retention | Legal obligation | Art. 6(1)(c) |
| Optional product announcements, newsletters | Consent | Art. 6(1)(a) |
6. International transfers
Because our infrastructure and sub-processors operate globally, your personal data may be transferred outside the EU/EEA — in particular, to the United States (where some of our AI providers and hosting partners operate) and to the United Kingdom.
For transfers outside the EU/EEA where no adequacy decision applies, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by additional technical and organizational measures where appropriate.
7. Sub-processors
The following third parties may process personal data on our behalf:
| Sub-processor | Role | Jurisdiction |
|---|---|---|
| Paddle.com Market Ltd | Merchant of record: payment processing, tax invoicing, refunds | United Kingdom / United States |
| Freemius Inc. | Payment processing and license management for purchases made before September 2026 | United States |
| Cloudflare, Inc. | API hosting (Workers, D1, KV, CDN) | Global |
| Hostinger International Ltd. | Marketing-site hosting | European Union |
| OpenAI, L.L.C. | AI text generation | United States |
| Anthropic, PBC | AI text generation | United States |
| Google LLC | OAuth for Sheets / Calendar integrations | United States |
All sub-processors are bound by data processing agreements that include GDPR-compliant safeguards. We maintain the right to change sub-processors and will update this list when we do. If you object to a new sub-processor, you may terminate your license and request a pro-rated refund.
8. Data retention
We keep personal data only as long as necessary for the purposes for which it was collected. Specific retention periods are detailed in Section 7 of our Privacy Policy. Summary:
- Active account dataretained while the account is active
- Closed account dataup to 3 years after closure
- Tax and payment records7 years
- Support tickets3 years after closure
- Technical logsup to 90 days
- AI request metadata2 years (content of prompts and responses is not stored)
9. Children
Forge Suite is a professional product intended for users aged 16 and older. We do not knowingly process personal data of children under 16. If you believe we have done so inadvertently, contact us and we will delete the data.
10. EU representative
Avakode currently does not have an appointed EU representative under Article 27 GDPR. EU and EEA residents can reach us directly by email at [email protected] for any privacy-related request. We treat inquiries from EU residents with the same priority as requests from any other jurisdiction.
11. Data breach notification
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected individuals, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by Article 33 GDPR, and will notify affected users without undue delay where required by Article 34.
12. Cookies
We use only strictly-necessary first-party cookies — for authentication and essential preference storage. We do not use advertising cookies, third-party analytics cookies, or any cross-site trackers. Because we do not rely on consent-based cookies, we do not display a consent banner.
13. Contact for privacy matters
All privacy-related questions, requests, and concerns should be directed to:
Email: [email protected]
Postal: Individual Entrepreneur Darya Avakova, Parkent street 9, apt. 78, Mirzo Ulugbek district, Tashkent, Republic of Uzbekistan
14. Changes to this page
We may update this GDPR compliance page from time to time. When we make material changes, we will notify active customers by email and post a notice on avakode.com at least 30 days in advance. The “Last updated” date at the top always reflects the most recent revision.