Privacy Policy
Effective date: 24 July 2026
1. Controller
The controller is XForge / [LEGAL NAME OR BUSINESS ENTITY], [BUSINESS ADDRESS]. Contact: xforge.plugins@gmail.com.
2. Account data
XForge processes email address, display name, password hash, verification status, account sessions, terms acceptance and security metadata required to operate customer accounts. Passwords are not stored in plaintext.
3. Orders and licenses
XForge stores Paddle transaction identifiers, product entitlements, order status, invoice references and the Paddle customer identifier where supplied. XForge does not receive or store full payment-card details.
4. Paddle
Paddle processes checkout, payment, applicable tax, invoicing, refunds and related fraud controls as merchant of record. Customers should review Paddle’s privacy information presented during checkout.
5. Email delivery
Verification and password-recovery emails may be delivered through Resend when configured. The provider processes recipient, sender, subject, content and delivery metadata for this purpose.
6. Hosting and databases
The production host and managed database provider process technical requests, IP addresses, timestamps, logs and stored account records as necessary for hosting, security, backup and reliability. Insert the final providers and retention periods before launch.
7. Protected downloads
Download requests are checked against active account entitlements. Security logs may record account, product, time, IP-derived metadata and download outcome to prevent abuse.
8. Asset Finder
Search queries and filters are sent to the XForge backend to return results. The product index is based on publicly available Fab listing metadata. Opening a listing transfers the visitor to Fab.
9. Legal bases and retention
Processing may be necessary to perform a contract, take pre-contractual steps, comply with legal obligations, prevent abuse and pursue legitimate operational interests. Define final retention periods with legal and accounting advice.
10. Rights
Depending on applicable law, users may request access, correction, deletion, restriction, portability or objection and may complain to the competent supervisory authority.
11. International transfers
Identify transfer mechanisms and processor locations for Render, the database provider, Paddle, Resend and any future analytics or support tools before publication.