Privacy Policy
Last updated: 13 July 2026
This policy explains what data Forgelo collects, why we collect it, who we share it with, and what you can do about it. We have tried to write it in plain language rather than legal fog.
It applies to forgelo.com, to the Forgelo app, and to the websites you generate and publish with us. It does not apply to third party sites you reach by clicking a link.
Who we are
Forgelo is an AI website builder operated by Creativism, a digital marketing agency based in Yogyakarta, Indonesia. When this policy says "we", "us", or "Forgelo", that is who it means.
For anything in this policy, including a request to access or delete your data, email admin@mail.forgelo.com. We are the data controller for the data described here, except where we say otherwise in the section on sites you publish.
The short version
- We collect what we need to run your account, generate your sites, and take your payment. Nothing more.
- We do not sell your personal data, and we never have.
- Your prompts and site content are sent to an AI provider so that we can generate the site you asked for. That is the whole point of the product.
- Analytics and marketing cookies stay switched off until you turn them on. Rejecting them is one click, in the same place as accepting them.
- You can ask us to export or delete your data at any time, and we will do it.
What we collect
We collect three kinds of data: what you give us, what you create, and what your browser tells us.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Name, email address, password (stored hashed, never in plain text), profile photo if you upload one, language preference, referral code | You, at sign up and in your profile |
| Site content | The prompts you type, the business details you describe, the text and images in the sites you generate, your custom domain names | You, when you build and edit a site |
| Payment data | Plan, billing status, invoice history, transaction references. Card numbers are handled by our payment providers and never reach our servers | You, through the payment provider |
| Usage data | Pages viewed, features used, generations and edits run, quota consumed, errors hit | Your browser and our servers |
| Technical data | IP address, browser and device type, approximate location derived from IP, timestamps, rate limit counters | Your browser, automatically |
| Support data | Messages you send us and our replies | You, when you contact us |
Why we use it, and on what legal basis
Under the GDPR and Indonesia's Personal Data Protection Law (Law No. 27 of 2022), we have to name a lawful basis for every use. Here it is, one row per purpose.
| What we do | Data used | Legal basis |
|---|---|---|
| Create and run your account, generate and host your sites, take payment | Account, site content, payment | Performance of a contract with you |
| Keep the service secure: rate limiting, abuse detection, fraud prevention, taking down phishing and scam sites | Technical, usage, site content | Our legitimate interest in a service that is not abused, and our legal obligations |
| Send service emails, such as a notice that your site is ready or that your plan is about to renew | Account | Performance of a contract with you |
| Improve the product by understanding which pages and steps people get stuck on | Usage, technical | Your consent, given through the cookie banner |
| Measure our advertising and reach people like you | Usage, technical | Your consent, given through the cookie banner |
| Send marketing emails about Forgelo | Account | Your consent, which you can withdraw from any such email |
| Keep tax, accounting and payment records | Payment, account | Our legal obligations under Indonesian tax law |
How AI generation works, and what happens to your prompts
When you describe a business and ask Forgelo to build a site, that description, along with the current content of the site when you edit it, is sent to the AI service that generates the page. This is necessary to deliver the product you asked for, so it happens under our contract with you.
We do not use your prompts or your site content to train our own models, and we do not sell them. We do not publish your drafts. A site becomes public only when you publish it.
AI output is generated text and images, and it can be wrong, generic, or resemble other content. You are responsible for reviewing what you publish. See the Terms of Service for who owns the output.
Cookies and tracking
Cookies that are strictly necessary, such as the one that keeps you signed in and the one that records your cookie choice, are always on. Everything else, meaning analytics and marketing, is off until you switch it on.
We support Google Consent Mode v2 and we honour the Global Privacy Control signal your browser can send. The full list of cookies, and what each one does, is in the Cookie Policy. You can change your choice at any time from the cookie settings link in the footer.
Who we share data with
We do not sell your personal data. We do share it with the service providers we need to run Forgelo. Each of them is bound by a contract that limits them to processing data on our instructions.
| Provider | What they do for us | Where they process |
|---|---|---|
| Vercel | Hosts the app and serves the sites you publish | United States and global edge network |
| Supabase | Database, sign in, and file storage | Outside Indonesia |
| Cloudflare | Object storage for the images used in your sites | Global network |
| AI model providers | Generate and edit the sites you ask for, from your prompts | United States |
| Resend | Sends transactional email, such as verification and site ready notices | United States |
| Lemon Squeezy | Merchant of record for card payments and subscriptions | United States |
| Xendit | Processes QRIS and Indonesian payment methods | Indonesia and Singapore |
| Google Analytics, and Google Ads if you allow marketing cookies | United States | |
| Microsoft | Microsoft Clarity product analytics, if you allow analytics cookies | United States |
| Meta and TikTok | Advertising measurement, only if you allow marketing cookies | United States |
Sending data outside your country
Forgelo is operated from Indonesia and most of the providers above are outside Indonesia, mainly in the United States. That means your data crosses borders.
For data covered by the GDPR we rely on the European Commission's Standard Contractual Clauses, or on an adequacy decision where one exists, and we check that the provider offers protection equivalent to what you would get in the EU.
For data covered by Indonesia's Personal Data Protection Law we follow Article 56: we first check whether the receiving country offers a level of protection equal to or higher than Indonesian law, and where it does not, we put adequate and binding safeguards in place before the transfer.
If you would like a copy of the safeguards that apply to a specific transfer, email us and we will send it.
How long we keep it
| Data | How long |
|---|---|
| Account and site content | For as long as your account is open. Deleted within 30 days of you deleting your account, and purged from backups within 90 days |
| Published sites | Until you unpublish or delete them, or until the account is closed |
| Payment and tax records | 10 years, because Indonesian tax law requires it |
| Support messages | 24 months |
| Server and security logs | 90 days |
| Analytics data | Up to 14 months, and only if you consented to analytics |
How we protect it
- Traffic is encrypted in transit with TLS, and data is encrypted at rest by our hosting and database providers.
- Passwords are stored hashed. Nobody at Forgelo can read your password.
- Database access is restricted by row level security, so one account cannot read another account's sites.
- Access to production systems is limited to the people who need it.
- No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority: within 72 hours under the GDPR, and within 3x24 hours under Indonesia's Personal Data Protection Law.
Your rights
Wherever you live, you can ask us to do all of the following, and we will not charge you or treat you worse for asking.
- Access. Get a copy of the personal data we hold about you.
- Correction. Fix anything that is wrong or incomplete.
- Deletion. Have your data erased, subject to records we are legally required to keep, such as tax records.
- Portability. Receive your data in a common machine readable format, or have it sent to another provider.
- Objection and restriction. Object to processing based on our legitimate interests, or ask us to pause processing while a dispute is resolved.
- Withdraw consent. Turn analytics and marketing off at any time in the cookie settings, or unsubscribe from any marketing email. Withdrawing consent does not undo what was lawful before you withdrew it.
- Automated decisions. We do not make decisions with legal or similarly significant effects about you by automated means alone.
How to exercise your rights, and how to complain
Email admin@mail.forgelo.com and tell us what you want. We will answer within 30 days. If we need more time, or if we need to verify who you are first, we will tell you why.
If you are in the EU or the UK and you think we have handled your data badly, you can complain to your national data protection authority. If you are in Indonesia, you can raise it with the authority responsible for personal data protection under Law No. 27 of 2022. We would rather you came to us first, so that we can fix it.
If you are in California
Under the CCPA as amended by the CPRA you have the right to know what personal information we collect and why, the right to delete it, the right to correct it, the right to opt out of its sale or sharing, and the right not to be treated worse for exercising any of those rights.
We do not sell personal information for money. Allowing marketing cookies does count as "sharing" for cross context behavioural advertising under California law, so we give you a way out of it.
Use the Do not sell or share my personal information link in the footer, or open cookie settings, and switch marketing off. We also honour the Global Privacy Control signal automatically, so if your browser sends it, marketing stays off without you having to click anything.
The categories of personal information we collect, and the purposes we collect them for, are in the tables above. We disclose those categories to the service providers listed above. We do not knowingly collect or share the personal information of anyone under 16.
The sites you build and publish
The websites you create with Forgelo are yours. If your site collects data from its own visitors, for example through a contact form or a WhatsApp lead form, then you decide what happens to that data. In legal terms you are the controller of it and we are only your processor. You are responsible for putting your own privacy notice on your site, and for having a lawful basis for what you collect.
If you need a signed data processing agreement covering that relationship, we have one: see the Data Processing Agreement.
We may access the content of your site where we have to, for example to fix a bug you reported, to keep the service running, or to investigate a report that a site is being used for phishing or fraud.
Children
Forgelo is not built for children. You must be at least 16 to have an account, or older if the law where you live sets a higher age. We do not knowingly collect data from children. If you believe a child has given us data, email us and we will delete it.
Changes to this policy
If we change something that matters, we will update the date at the top of this page, and for significant changes we will tell you by email or in the app before the change takes effect. If a change requires your consent, we will ask for it.
Contact
For any privacy question or request, email admin@mail.forgelo.com.