Privacy

Privacy Policy — Forge

Last updated: April 2026

This Privacy Policy applies specifically to Forge (https://forge.cognivance.org), an AI-powered website generation service operated by Cognivance S.L.

1. Data controller

2. What data we process

When you use Forge, we process:

• User inputs — text prompts, style settings, chat conversation
• Uploaded files — documents you attach (CSV, Excel, PDF, Word, JSON, text)
• Generated outputs — HTML websites produced by the service
• Technical data — session ID (in browser localStorage), IP address, browser type, request timestamps

We do not require account registration. We do not collect names, emails, or other identifiers unless you voluntarily include them in your inputs.

3. Purpose and legal basis

Purpose	Legal basis (GDPR Art. 6)
Provide the AI website generation service	Contract performance — Art. 6(1)(b)
Service operation, security, abuse prevention	Legitimate interest — Art. 6(1)(f)
Compliance with legal obligations	Legal obligation — Art. 6(1)(c)

4. AI processing and international data transfers

Important. Forge uses third-party AI infrastructure to generate websites:

• All user inputs (prompts, uploaded file contents, chat history) are transmitted to Anthropic PBC (San Francisco, California, USA), provider of the Claude AI models.
• Generated outputs are returned from Anthropic to our servers and to your browser.
• This involves an international transfer of personal data outside the European Economic Area to the United States.

Safeguards in place

• Our processing agreement with Anthropic incorporates the European Commission's Standard Contractual Clauses (SCCs) for transfers to third countries (Decision 2021/914).
• Anthropic's commercial API terms commit that customer inputs and outputs are not used to train their models by default.
• Anthropic retains API request data for up to 30 days for trust and safety purposes, after which it is deleted.

Automated processing. Forge uses Anthropic's Claude models to analyze your inputs and generate website code. This is automated content generation. It is not used for decisions producing legal effects on you (GDPR Art. 22 does not apply).

5. Subprocessors

Subprocessor	Role	Location
Anthropic PBC	AI model inference (Claude API)	United States
Hetzner Online GmbH	Hosting infrastructure	Germany (EU)

We will update this list before adding new subprocessors. Material changes will be reflected in the "Last updated" date above.

6. Your responsibilities when uploading files

When you upload files to Forge, you are responsible for ensuring you have the legal right to share that data:

• Do not upload personal data of third parties without a valid legal basis under GDPR.
• Do not upload special categories of personal data (Art. 9 GDPR — health, racial/ethnic, political, biometric, etc.) without explicit consent and necessary safeguards.
• Do not upload confidential information, trade secrets, or third-party intellectual property without authorization.
• Do not upload classified or regulated data (e.g., PCI-DSS financial data, HIPAA health data, government secrets).

You remain the data controller for any personal data contained in files you upload. Cognivance acts as your data processor for that content.

7. Data retention

Data type	Retention
Active session data (uploaded files, generated content)	Up to 1 hour after last activity, then automatically deleted
Logs (IP, request metadata)	30 days
Anthropic API request data	Up to 30 days (Anthropic's policy)

We do not retain your generated websites after your session expires. Download the HTML if you want to keep them.

8. Your rights under GDPR

You have the right to:

• Access the data we hold about you (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erase your data (Art. 17)
• Restrict processing (Art. 18)
• Data portability (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Lodge a complaint with the Spanish Data Protection Agency (AEPD — www.aepd.es)

To exercise these rights, contact us at hello@cognivance.org. Because Forge does not require user accounts, please provide enough information to locate your data (approximate date/time, IP address, file names).

9. Cookies and local storage

Forge uses one technical item in your browser's localStorage:

• sessionId — random identifier used to associate your uploaded files with your generation requests during a session

This is essential for the service to function. We do not use tracking cookies, analytics cookies, or advertising cookies in Forge.

10. Security

We use industry-standard measures to protect your data: TLS encryption in transit, server-side rate limiting, restricted access to infrastructure, and secure handling of API credentials. No method of transmission or storage is 100% secure.

11. Changes to this policy

We may update this policy. The "Last updated" date indicates when changes took effect.

12. Contact

For privacy questions or to exercise your rights:

• Email: hello@cognivance.org
• Postal address: Calle 202, 29 — 46182 Paterna (Valencia), Spain