Privacy Policy

Last updated 19 October 2026

1. Who we are

This website (avakode.com), the Forge Suite plugins (Lang Forge, Rank Forge, Fillin Forge, Field Forge, Guard Forge, Velocity Forge, Draft Forge, Cascade Forge, Clearway Forge, Profit Forge, Inclusive Forge and Renew Forge) and their product websites are operated by:

Tigran Avakov, a self-employed individual, Mirzo-Ulugbek 45A, 100007 Tashkent, Uzbekistan

Contact: [email protected]

Throughout this document, “Avakode”, “we”, “us”, and “our” refer to the above entity.

---

2. Scope of this policy

This policy describes how we collect, use, store, and share personal data when you:

• Visit avakode.com or any plugin-specific website we operate
• Create an Avakode account
• Purchase a Forge Suite license
• Use any Forge Suite plugin on your WordPress site
• Contact us for support or any other reason

It does not cover the data your own WordPress site collects from its visitors — that’s governed by your own privacy policy, since the plugins store that data in your own database, not ours. (Inclusive Forge, a hosted service, keeps its scan results on our infrastructure; its own page says what it stores.)

One exception: if you turn on a Fillin Forge Pro integration listed in section 3.5, the submission data needed for that integration passes through our API on its way to the service you connected. The same goes for the PDF of a single submission that an administrator downloads on a site with Fillin Forge Pro: our API builds it and sends it back. We relay this data and do not store its content.

Guard Forge has two more exceptions.

Security events. When an administrator presses Explain next to an event, the plugin sends that event to our API, which passes it to our AI provider and returns the explanation (sections 3.4 and 5). The plugin sends: for an entry of the sign-in log, its number, the time, the IP address, the username, the result and the browser user-agent; for an entry of the audit log, its number, the time, the login name of the user, the type of the event, the type and the name of the object, the details and the IP address; for a changed or removed file, the path, its hash and its scope in the integrity scan.

If you turn on the hourly AI analysis of Guard Forge Pro (it is off by default), the add-on sends, once an hour when there are events to send, the events it has collected since the last analysis, the latest 25 at most, each with its time: the IP address, the username and the number of attempts of a locked sign-in; the paths of the files that an integrity scan found changed or removed (10 of each at most); the path and the matched signatures of a malware finding; and, for a firewall block, the rule and up to 240 characters of the part of the request that set it off (the address, the referrer, the browser user-agent, or a query or form field).

Every such request also carries the address of your site, the WordPress version, the number of active plugins, the name of the theme folder and whether the site is a multisite. As for any AI request, we log the type of the operation, the credits spent and the time, and not the content (section 3.4).

Country lookup. When you block or allow countries on your site and the country of a visitor cannot be learned on the site, the add-on of Guard Forge Pro sends the visitor’s IP address to our API, which asks IPinfo for the country. We keep the address with its country for 30 days (section 3.3).

---

3. What data we collect

3.1 Account data

When you create an account, we collect: your name, email address, hashed password, and (optionally) your company name and billing country.

3.2 Payment data

Payments are processed by our merchant of record, Paddle: Paddle.com Inc. for buyers in the United States, Paddle.com (Canada) Ltd. in Canada and Paddle.com Market Limited in all other countries. We do not store your full card number, CVV, or bank account details on our servers. Paddle sends us a transaction ID, the amount, the billing country, your email address and the products purchased. Purchases made before September 2026 were processed by Freemius Inc., which shared the same fields. Paddle is an independent controller of the data it collects to take your payment; Paddle’s privacy notice applies to it.

3.3 License and site data

What WordPress adds to each request. When a plugin on your site sends a request to our API, WordPress puts in it a user-agent line with the WordPress version and the address of your site, unless the plugin sends its own line with only its name and version, as some do. Our API does not store this line, except with a download of an update package (below) and with a rating sent from a plugin (section 3.6).

When you activate a Forge Suite plugin on a WordPress site, or connect it to your Avakode account, the plugin sends our API the license key, the name of the product and the address of the site. We record on the license that it is in use on that site, with the address of the site and the date, so that a license is not used on more sites than it allows; when you deactivate or disconnect the license on the site, the site is taken off the list. A site on a local or test address (such as localhost, a private IP address, an address ending in .local or .test, or a staging address that some hosting companies give, such as one ending in .wpengine.com or .kinsta.cloud) is not put on the list and does not take a place on the license.

We also keep a record of each activation, connection and deactivation, and of each activation refused for lack of a free place on the license, with the time, the product, the host name of the site and, where there is one, the number of the license and the number of sites in use on it. The records of an activation (also on a local or test address), of a refused activation and of the start and the approval of a connection also hold the IP address of the request. The records of the approval and the completion of a connection also hold the email address and the number of your account. These records of activations and connections are deleted after 180 days.

When you move a license bought before September 2026 to another site from your account on avakode.com, we record the license, the number of your account, the product, the old and the new site, the time, and the IP address and the browser user-agent of the request. We keep these records with no set end date.

Pro add-ons. The Pro add-ons of Lang Forge, Rank Forge, Fillin Forge, Field Forge, Guard Forge, Velocity Forge, Draft Forge, Cascade Forge, Clearway Forge, Profit Forge and Renew Forge check their license and their updates with our API (api.avakode.com) only after a license key is entered or saved on your site, and send nothing about them without one. Two buttons talk to our API before a key is saved:

• Connect to Avakode (in all of these Pro add-ons except those of Clearway Forge, Profit Forge and Renew Forge) sends the name of the product, the address of your site and the address of its admin page, so that you can approve the connection on avakode.com.
• Start free trial, in the Pro add-ons of Lang Forge, Rank Forge, Fillin Forge, Field Forge, Guard Forge, Velocity Forge and Cascade Forge, sends the name of the product, the address of your site and the administration email address set in WordPress. The free Guard Forge plugin sends the same when an administrator asks for an AI explanation of a security event on a site with no license key and no trial yet. We keep the email address, the address of the site and the IP address of the request, so that each site and each email address gets one trial per product (section 7); our API counts the trial requests from an IP address for about an hour, to limit abuse.

After a key is saved, a Pro add-on sends:

• The license check. It sends the license key, the name of the product and the address of your site. It runs when an administrator activates, connects, checks or deactivates the license on this site and, in the background, about once a day. We use it to confirm that the license is valid and, when you activate or connect, to register the site on it. Rank Forge Pro and Fillin Forge Pro also run it, with the same items, each time you connect one of the services they work with through our API (such as Google), and before a request to such a service when the site holds no access token for it. Fillin Forge Pro also runs it each time a visitor submits a form that sends a WhatsApp notification or adds the person to Mailchimp or HubSpot. Renew Forge Pro also sends the license key, the name of the product and the address of your site, to free the place of the site on the license, when the Pro add-on is deactivated or deleted in WordPress.
• The update check. It runs when WordPress looks for plugin updates, when you open the details of the add-on and when an update is installed. It sends the license key and the address of your site with the version of the add-on, the version of the free plugin, and the WordPress and PHP versions (Renew Forge Pro does not send the WordPress and PHP versions). We use it to offer the update package for the license. The add-on keeps the answer for twelve hours (half an hour when the answer was empty or did not come) and asks again at once when you press Check again on the Updates screen of WordPress.
• The credit balance. When one of these Pro add-ons shows or refreshes your AI credit balance on its screens, it sends the license key and the name of the product. The add-on keeps the answer for five minutes. Our API reads the balance from the credit records (section 3.4) and counts the requests from an IP address for a minute, to limit abuse. If your account has not yet received its one-time welcome credits, the request adds them to the credit records, and it creates the balance of the current period when there is none. It keeps no other record of the request.
• Guard Forge Pro, the vulnerability list. Once a day while the daily update of the list is on (it is on by default), and when an administrator asks for an update, it sends the license key, the name of the product, the address of your site and the time of the last update it received, to get the newest list of known vulnerabilities. Our API keeps no record of the request in our database.
• Guard Forge Pro, country blocking. When you have set countries to block or to allow, and the country of a visitor who reaches the login page, XML-RPC or the REST API of your site cannot be learned from a Cloudflare header or from a country database on your site, the add-on sends the visitor’s IP address with the license key, the name of the product and the address of your site. Our API asks IPinfo (ipinfo.io) for the country and keeps the IP address with the country in its cache for 30 days (an hour when the country is not found). Your site keeps the answer for a week.
• Velocity Forge Pro, the functional check. It is off by default. When it is on and the add-on ends the period in which it watches a change made on your site, it sends, for each page to check, the license key, the address of your site, the name of the check, the address of the page, the device (desktop or mobile) and a time limit. Our API opens the page in a browser that runs at Cloudflare and does one thing on it: opens the mobile menu, sends a test form, or puts a product in the cart and takes it out. Each check that reaches the browser is written in the credit records (section 3.4); a request that is refused, or that finds no browser available, is not. Our API counts the checks of each license for a day.

The license check and the update check carry no order, customer or product data. Usage statistics, which some plugins send only if you agree, are described in section 3.11.

Profit Forge. The free plugin sends nothing to our API. The Stripe key that you can add in Profit Forge Pro goes to Stripe, to read your own transactions, and not to us.

Each update check leaves a record with its time, the product, the version of the add-on and the country, which Cloudflare works out from the IP address of the request; the address itself is not stored in this record. Downloading the update package leaves a similar record that also holds the IP address and the user-agent of the request (for an update made from your WordPress site, WordPress fills the user-agent with its version and the address of your site). Our API also keeps the IP address of a download for a minute, so that repeated downloads from one address in that minute are recorded once. Both kinds of record are deleted after 180 days, and a daily total by product, version and country is kept. A license check leaves no record in our database: our API counts the requests from an IP address for about a minute, to limit abuse, counts failed checks of a license key, under a short hash of the key, for up to an hour, and, when the license is valid, writes a line about the check in its logs (section 3.7).

3.4 AI request data

When you use an AI feature in any Forge Suite plugin, the request is sent to our backend (api.avakode.com) which then forwards it to the underlying AI provider. We log: the type of AI operation (e.g., “translate post”, “generate meta”), the number of credits consumed, and a timestamp. We do not log the content of your prompts or the AI’s responses. In Guard Forge, an AI request holds the security events described in section 2.

3.5 Integration tokens

When you connect a third-party service (Mailchimp, Google Sheets, Google Calendar, HubSpot, and Google Search Console, Google Analytics and the Google Indexing API for Rank Forge), the OAuth tokens or API keys are stored in our backend (Cloudflare D1 database) rather than in your WordPress installation. This keeps sensitive credentials off your server. Tokens are stored encrypted at rest.

When a visitor submits a form with one of the integrations below turned on, your site sends the data listed to api.avakode.com, and we pass it to the service:

• Telegram: the submitted fields, the form title, your site address and the ID of your Telegram chat
• WhatsApp: the form title, the email address, name or first text answer of the sender, the time and the number that receives the notification; your site address also comes to our API, is kept in the delivery record (section 7) and is not part of the message
• Mailchimp and HubSpot: the email address and any fields you mapped
• Google Sheets: one row with the values of all fields
• Google Calendar: the event title and description built from the fields, the start and end time of the event with its time zone, and the email address and name of the attendee

When a visitor picks a day for a booking, or submits one, on a Fillin Forge Pro form connected to a Google Calendar, your site sends our API the ID of that calendar and the start and end of the day or slot, our API asks Google which times in that calendar are busy and returns those times to your site, and it does not store any of this.

When an administrator downloads a submission as a PDF on a site with Fillin Forge Pro, the fields of that submission are sent to our API to build the file; if our API cannot be reached, the PDF is built on your site. We do not store the content of submissions, and our own code does not write it to its logs; what a log line about a failure holds is listed in section 3.7. Slack, Discord, webhooks and notification emails are sent by your site directly and never reach us.

AI analysis of submissions (Fillin Forge Pro) sends our API a summary, not the answers: the form title, whether the form has several steps, counts and rates for the form (views, submissions, abandoned sessions, failed payments, conversion rate), and for each field its type, label, whether it is required, how often it was filled in and how often it was the last field filled in before a visitor left. Our API passes the summary to OpenAI.

3.6 Support and communication data

When you write to [email protected] or submit a contact form, we store the full content of your message, your email address, and any attachments, so we can respond, resolve the issue, and reference the history on follow-ups. The support form in your account and the bug report form on our websites also record the IP address and the browser user-agent of the request.

Ratings from the plugins. The free plugins Lang Forge, Rank Forge, Fillin Forge, Field Forge, Guard Forge, Velocity Forge, Draft Forge and Cascade Forge show administrators, on their own screens, a card that asks how likely they are to recommend Forge, from 0 to 10, with a box for a comment. It appears no sooner than 30 days after the plugin starts, then at most once in 60 days for each administrator, and not for 14 days after Not now. When you press Send feedback, the plugin sends our API the score, the comment, the name of the product and the WordPress version, with no license key and no email address. For each of these plugins, and for the shared Forge Suite screen, our API keeps the score, the comment, the product, the WordPress version, the IP address of the server your site runs on and the user-agent line of the request, which holds the address of your site (section 3.3). A score of 6 or lower is also sent, with its comment, to our own Telegram chat. Our API counts the ratings from an IP address for a day, to limit abuse.

Reports from the documentation pages. On the documentation pages of our websites you can select a passage and press Report issue. The report sends our API the product, the address, title and section of the page, the passage you selected, your note and, if you give it, your email address; our API keeps them with the IP address and the browser user-agent of the request, and sends the page, the passage, the note, the email address and the IP address to our own Telegram chat. The form is protected by Cloudflare Turnstile, and our API counts the reports from an IP address for an hour, to limit abuse.

Renew Forge notification list. On renewforgewp.com you can leave your email address to get an email when the rules are out. Our API keeps the address with the product, its state, the times of the request, the confirmation and the emails, and the codes of the confirmation and unsubscribe links, and sends the confirmation email through Resend; it keeps no IP address, and counts the requests from a network for an hour under a keyed code of its address, to limit abuse. The privacy policy of renewforgewp.com describes this list in full.

3.7 Technical data

Standard web-server logs: IP address, browser user-agent, pages visited, timestamps. Used for security, debugging, and abuse detection.

Logs of our API. Our API runs on Cloudflare Workers. We have switched off the log of each request that Cloudflare Workers can keep for us. What is logged is the lines our own code writes about events in the API and the exceptions of the Worker. Each line has a time, a level, an event name, a request identifier and a few facts, such as an HTTP status, a product name or a numeric account or license number; a line about an unexpected failure also holds the method and the path of the request, without its query string, and the technical error text. The logs are kept for 7 days in Cloudflare’s dashboard and 30 days in a copy in our own storage (Cloudflare R2). Some of the lines hold personal data:

• Phone numbers. The lines about WhatsApp messages (a message accepted, its delivery reported or failed, a number connected or refused) hold the phone number of the recipient or the sender, and the address of the customer’s website.
• IP addresses. The lines about a failed human check (Cloudflare Turnstile), a rejected trial token (with the website domain the plugin reported), a failed administrator sign-in, or a call to our Telegram webhook with a wrong secret (with the first 100 characters of the caller’s User-Agent) hold the caller’s IP address.
• Email addresses. The lines about email that our API sends through Resend (sent, failed, or held back as a repeat) hold the address of the recipient; the line about a repeat also holds the subject.
• Website addresses. When a customer’s website exchanges a one-time connection token with our API, the line holds the website address and the first ten characters of the token.
• Answers of outside services. When an outside service (email, payments, messaging, a license or an AI provider) reports an error, the line holds up to a few hundred characters of its answer; for an AI provider, the answer can repeat words of the request.

Error monitoring (Sentry). We use Sentry, a service of Functional Software, Inc. in the United States, where our Sentry data is stored, to find and fix faults in our API. An error record is sent when a scheduled job fails or a request fails in a way our own error handling does not catch; it holds the error message and its technical stack trace, and either the name and schedule of the job or the method, the address and four headers (Content-Type, Content-Length, Accept and Origin) of the request. A performance trace is sent for about one request or scheduled job in ten; it holds the method (or the schedule), the address, the response status, the timing, the outside services called and the same four headers. Before anything is sent, our API removes the query string from every address and replaces with “[redacted]” any part of an address that looks like a UUID, an IP address, an email address or a long random token, the identifier of a purchase session, and the identifiers of customers’ calendars, sites and spreadsheets in the addresses of the outside services it calls; it does the same with web addresses, email addresses, IP addresses, UUIDs, bot tokens and product keys found in an error message. Our API does not send Sentry query strings, request bodies, cookies, credentials, your IP address, your browser identification (User-Agent), your country, time zone or language, user accounts or the lines of our API’s logs. Sentry itself may add an approximate place to a record, derived from the address of the Cloudflare server that ran our API, not from yours; Sentry is set not to store that address.

3.8 Cookies, analytics and advertising measurement

We use strictly-necessary cookies for authentication and security, and a small set of first-party cookies for remembering your preferences — including your cookie choice, kept in a cookie called forge_consent for about six months. Our websites also load these third-party tags and scripts:

• Meta Pixel (every Avakode and Forge Suite website): records page views and, when you click a link to download a free plugin, a PluginDownload event that names the plugin and the page you were on. Meta receives your IP address, browser details and its own cookies (_fbp, _fbc).
• Google Tag Manager (avakode.com, langforgewp.com, rankforgewp.com and fieldforgewp.com): loads Google Analytics, for traffic measurement, and on langforgewp.com, rankforgewp.com and fieldforgewp.com also Google Ads, for advertising measurement. fieldforgewp.com also loads a Google Ads tag directly, without Tag Manager. fillinforge.com and our other websites load no Google tag.
• Cloudflare Web Analytics (avakode.com): counts page views and measures how fast our pages load, without cookies and without building a profile of you; Cloudflare does not use your IP address or browser details to identify you for this. Cloudflare adds this script to our pages itself.

Websites that use this policy. clearwayforge.com, profit-forge.com, guardforge.app, velocityforge.app, cascadeforge.app and draftforgewp.com have no privacy policy of their own and link to this one. On each of them the Meta Pixel and Cloudflare Web Analytics load; no Google tag does. As everywhere on our websites, the rule in “When they load” below applies. The site assistant, with the Turnstile check that protects it, also works on each of them (section 3.10).

When they load. If your browser reports a European time zone, or one we cannot place, such as UTC, the Meta and Google tags are not loaded and no analytics or advertising cookie is set until you choose “Accept all” in the cookie banner; if you choose “Reject”, they stay unloaded. Elsewhere the Meta and Google tags load when a page opens, and you can switch them off at any time with “Cookie settings” in the footer of every page. Cloudflare Web Analytics does not wait for your choice: it sets no cookie and builds no profile of you. The plugins themselves set no advertising cookies on your own WordPress site.

Meta Conversions API. When marketing cookies are allowed and you download a free plugin, our servers also send that same download event to Meta directly (server to server), with your IP address, browser user-agent, the page address and Meta’s cookie identifiers, so the event still counts if your browser blocks the pixel. Meta receives the browser event and the server event with the same event ID and counts them once. We send no name, email address or anything you typed.

3.9 Google API Services and Data Usage

Avakode (specifically the Rank Forge and Fillin Forge plugins) requests access to certain Google APIs to provide core application functionality directly within your WordPress dashboard.

Rank Forge: Accesses Google Search Console (webmasters.readonly) and Google Analytics (analytics.readonly) to display SEO performance metrics. It also uses the Google Indexing API (indexing) to submit URL update requests to search engines on your behalf.

Fillin Forge: Accesses Google Drive/Sheets (drive.file) to append your form submissions to specific spreadsheets you select, and Google Calendar (calendar.events, calendar.readonly) to manage booking availability and create event invitations.

Avakode’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Explicit Limitations on Google Data:

• We strictly use this data only for providing or improving our application’s direct user-facing features.
• We do not use Google Workspace or Google API data to develop, improve, or train generalized AI and/or machine learning models.
• We do not sell, rent, or transfer this data to third parties.
• We do not use or share this data for advertising purposes.

3.10 The site assistant

When you use the site assistant (“Ask AI”), the question you type goes to our API with the name of the website you are on and a reference to the earlier part of the conversation. Our API passes it on, through Cloudflare’s AI Gateway, to OpenAI, L.L.C. in the United States, whose model writes the answer from our documentation. OpenAI keeps the conversation (your questions and its answers) for 30 days, as it does by default, so that the next question can build on it, and keeps its abuse-monitoring logs for up to 30 days, longer only where the law requires it or where OpenAI needs it to protect its services. Our API does not keep your questions or the answers: it counts the requests from your IP address for about a minute, to limit abuse, and keeps a count of all questions per day for two days. Our API’s own code writes neither your question nor the answer to its logs: it writes, for an error from OpenAI, its status, type and code and, for another failure, a technical error text of up to 200 characters, from which we remove your question if the text repeats it; your IP address is written there only if the check that you are not a bot fails. These logs are kept for 7 days in Cloudflare’s dashboard and 30 days in a copy in our own storage (Cloudflare R2). The conversation is also kept in your browser, in the local storage of the website you are on: it is deleted when you open a page of that website more than an hour after your last message, and you can delete it at any time by clearing that website’s data in your browser. Please do not write personal or sensitive data in the assistant. On every page that has the assistant, whether or not you open it and whatever you chose in the cookie banner, Cloudflare Turnstile runs invisibly when the page loads and receives your IP address and technical details of your browser to check that you are not a bot. We offer the assistant, and protect it with that check, on the basis of our legitimate interest in answering questions about our products.

3.11 Usage statistics from the plugins

The free plugins Lang Forge, Rank Forge, Fillin Forge and Field Forge, and the Pro add-ons of these four and of Guard Forge, Velocity Forge, Draft Forge and Cascade Forge, send us usage statistics only if an administrator agrees; nothing is sent before that. The plugin asks in a notice with two boxes, Share anonymous usage signals and Also include sanitised error context, and the buttons Save choices, No thanks or Ask me later. Once Share anonymous usage signals is ticked and saved, the plugin sends our API (api.avakode.com), about once an hour:

• a random install ID that is not derived from your site, the name and the version of the plugin, the WordPress and PHP versions rounded to major.minor, and the language of the site;
• up to fifty events: the consent itself, the screens of the plugin that are opened, the names (not the values) of the settings that are saved, the links to Pro, support, documentation and Connect that are clicked, a tip that is closed, the activation and the deactivation of the plugin (with the previous version and the number of days it was in use), each AI request (the feature, the answer code and how long it took, without the text), in Rank Forge Pro the start and the end of an A/B test (the post type, the length of the variants and how many times each was shown), and a daily signal that says whether the site is a multisite and whether a Pro add-on is active;
• for an error in the plugin, a hash of the error text and of the file name, the line number and the level of the error, and for a failed request to our API also the address on our API, the answer code and the kind of the error. The error text itself, cleaned of email addresses, web addresses and long numbers, and the file name are sent only if you also ticked Also include sanitised error context.

No license key, email address or content is sent, and the address of your site is not in the data; WordPress adds it to the request itself, and our API does not store it (section 3.3). Our API stores each event with the install ID, the plugin, the versions, the language, the time and the country, which Cloudflare works out from the IP address of the request; the IP address itself is not stored. These events are deleted after 30 days. We keep with no set end date a daily total of each event for each plugin, a summary for each install ID (when it was first and last seen, whether it is active, how many times the plugin was activated and deactivated, and the last plugin version, WordPress version, language and country), and for each kind of error a count and, if a plugin has sent the error text (only when Also include sanitised error context is ticked), the first text, file name and line number received. When an error suddenly becomes frequent, our API sends the plugin, the file name, the line number and the text, if it has them, to our own Telegram chat. Our API counts the requests from an IP address for about a minute, to limit abuse.

---

4. Why we collect it (legal basis)

Depending on your jurisdiction, we rely on the following legal bases:

• Performance of a contractto deliver the plugins, process payments, provide support, verify licenses.
• Legitimate interestto secure our infrastructure, detect abuse, improve the product.
• Consentfor optional communications (product announcements, newsletters). You can withdraw consent at any time.
• Legal obligationtax records, accounting, fraud prevention.

---

5. Who we share data with

We share personal data only with the following categories of recipients, strictly to deliver the service:

Services you connect yourself (Mailchimp, HubSpot, Google Sheets and Google Calendar) handle the data under their own terms. Telegram notifications are sent through our own bot, and Telegram handles them under its own terms. We do not sell or rent personal data to anyone, ever.

The Your products page (account.avakode.com)

When you are signed in and open the Your products page at account.avakode.com, our API asks the two of our products that have their own sign-in, WareAudit and Musterproof, whether each has an account with your email address. It sends only your email address and the time of the request, signed with a key that only our API and that product hold. The product answers only “yes” or “no” and the address of its dashboard, and it does not store the request. If you have a customer record with us, our API keeps the last yes or no answer for each of these two products (the answer, the address and the time of the check), without your email address, and replaces it at the next check; an answer older than 10 minutes is asked for again. If a product cannot be reached, nothing is kept. The other rows of the page come from your licences with us; nothing is sent for them. Your email address is not written to our logs in this check. These products are ours: no one else receives your email address in it.

---

6. International data transfers

Because our sub-processors operate globally, your data may be transferred to and processed in countries outside your own, including the United States and the European Union. When we transfer personal data from the EU/UK, we rely on Standard Contractual Clauses or an equivalent lawful transfer mechanism.

---

7. How long we keep data

• Account data: for as long as your account exists
• Payment records: kept with no set end date, for tax and accounting
• Licenses and the sites they are used on: a license (its key, product, plan and status, and the email address of the buyer) is kept with no set end date. The list of sites of a license is kept until a site is taken off the license; it is not deleted when the license expires. The records of activations and connections (section 3.3) are deleted after 180 days. Records of license moves are kept with no set end date. A license check leaves no record in our database.
• Update checks and downloads: the records are deleted after 180 days; the daily totals by product, version and country are kept with no set end date.
• Free trial records: we keep the email address, the website address and the IP address of a free trial, so that each website and each email address gets one trial per product and no more than three trials start from one IP address within 30 days. The IP address is erased 30 days after the trial starts, and the rest of the record is deleted 12 months after the trial ends.
• Usage statistics (section 3.11): the events are deleted after 30 days; the daily totals, the summaries for each install ID and the samples of errors are kept with no set end date.
• Country lookups for Guard Forge Pro: the IP address and its country are kept in the cache of our API for 30 days, or an hour when the country is not found.
• AI request metadata (credit usage): 90 days in the AI request statistics and 180 days in the credit records. The totals of credits granted and used in each monthly period are not deleted on these terms and stay with your account.
• The site assistant: the conversation stays in your browser, in the local storage of the website you are on, for an hour after your last message; it is deleted when you open a page of that website after that hour, and you can delete it sooner by clearing that website’s data in your browser. Our API does not keep your questions or the answers: it counts the requests from your IP address for about a minute, and keeps a count of all questions per day, without IP addresses, for two days. OpenAI keeps the conversation (your questions and its answers) for 30 days, as it does by default, and keeps its abuse-monitoring logs for up to 30 days, longer only where the law requires it or where OpenAI needs it to protect its services.
• Support messages: what you send through the support form, with the IP address and the browser user-agent recorded with it, is kept with no set end date; the files you attach are deleted after 180 days.
• Ratings from the plugins: kept with no set end date.
• Reports from the documentation pages: a report is deleted once it is more than 180 days old and we have closed it; a report we have not closed is kept until we do.
• Renew Forge notification list: an address that is not confirmed is deleted 7 days after the last confirmation email; a confirmed address is deleted 30 days after the email that says the rules are out, and on 31 December 2027 if that email has not been sent; an address that unsubscribes is deleted at once.
• Technical logs: up to 90 days
• Logs of our API: 7 days in Cloudflare’s dashboard and 30 days in a copy in our own storage (Cloudflare R2). They hold the lines our API writes about its own events (for example a message sent, a failed check or an error) and the exceptions of its Worker; some of these lines hold personal data, such as an IP address. Cloudflare’s own log of each request to our API is switched off.
• Error monitoring (Sentry): 30 days, for error records and for performance traces alike.
• Advertising and analytics data: held by Google, Meta and Cloudflare under their own terms
• Integration tokens: until you disconnect the integration
• WhatsApp notifications (Fillin Forge Pro): a number linked to a site is kept until the person sends STOP in the WhatsApp chat; we then delete the link and the delivery records of its messages. If you send STOP to our WhatsApp number, we stop sending notifications to that number and delete it from our active records: its connection to any website and the delivery records of messages sent to it. To remember your choice we keep only keyed codes derived from the number, including the ways websites wrote it, with the time of your STOP, until you send START or connect a website again from that number. The codes do not contain the number and cannot be turned back into it without our secret server key. Log lines that mention the number are kept for up to 30 days, and daily backup copies of the database for up to 90 days. Delivery records (message ID, recipient number, site address, status and any error Meta reports) are deleted after 90 days. We also keep a record of each attempt to connect a number (the message ID, the number, the result, the last six characters of the code sent and, if the code belongs to a site, the site address); it is deleted in the same way, when the person sends STOP or after 90 days. Backups keep deleted rows for up to 90 days, server logs for up to 30 days.

Every day we also make a copy of our database, to restore it after a failure. Each copy is deleted after 90 days, so data deleted from our database on the terms above can stay in a copy for up to 90 days longer.

You can request earlier deletion at any time (see Section 9).

---

8. How we protect your data

• All traffic to avakode.com and api.avakode.com is encrypted with TLS 1.3
• Passwords are hashed with bcrypt
• Integration tokens and API keys are encrypted at rest (AES-256)
• Access to production systems is limited to authorized team members
• We run automated security scans and dependency updates on a regular basis

No system is 100% secure, but we take reasonable technical and organizational measures aligned with industry best practice.

---

9. Your rights

Regardless of where you live, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your data (subject to legal retention requirements, see Section 7)
• Restrict how we use your data, for example while we check data you say is wrong or an objection you have made
• Port your data in a machine-readable format
• Object to processing based on legitimate interest
• Not be subject to a decision based only on automated processing that has legal or similarly significant effects on you. We make no such decisions about people. A few fixed rules run on their own to limit abuse: a free trial is refused for a site or an email address that already had one for the same product, or after three trials from one IP address in 30 days; checks of a license key are refused for up to an hour after repeated failures; and requests over a rate limit are refused for a short time. If one of these rules has stopped you, you can write to us and ask a person to look at it.
• Withdraw consent for optional communications
• Lodge a complaint with your local data protection authority

To exercise any of these rights, email [email protected]. We respond within 30 days, free of charge. If a request is complex, or you send us many, we may take up to two more months; we tell you so, with the reason, within the first 30 days.

---

10. Children

Forge Suite is a professional tool for building and managing websites. It is not intended for users under the age of 16. We do not knowingly collect data from anyone under 16. If you believe a minor has created an account, contact us and we will delete it.

---

11. Changes to this policy

We may update this policy occasionally. When we make material changes, we will notify active customers by email and post a notice on avakode.com at least 30 days before the changes take effect. The “Last updated” date at the top always reflects the most recent revision.

---

12. Contact

Questions about this policy, your data, or anything privacy-related:

Email: [email protected]
Postal: Tigran Avakov, a self-employed individual, Mirzo-Ulugbek 45A, 100007 Tashkent, Uzbekistan

Bot protection (Cloudflare Turnstile)

To protect our forms and AI assistant from automated abuse, we use Cloudflare Turnstile, a CAPTCHA alternative provided by Cloudflare, Inc. Turnstile runs invisibly in the background and processes client-side signals (such as your IP address, TLS fingerprint, User-Agent header, and the page you are on) to confirm that you are a human and not a bot, without showing you a puzzle. This processing is governed by Cloudflare’s Turnstile Privacy Policy / Addendum. Cloudflare does not use this information to track you across websites or for advertising.