Privacy Notice

Last updated: May 2026

This notice explains how Dylan Mabe (the "Seller", "we", "us"), acting as data controller, processes personal data when you use ProfitForge AI (the "Service").

1. Data we collect

• Account data — name, email, login credentials.
• Profile & usage data — plan, credits, generated websites, deploys, listings, in-app preferences.
• Support data — messages you send us.
• Technical data — device identifiers, IP address, browser type, log/telemetry data.
• Cookies — essential cookies for sign-in and session; minimal analytics where applicable.

Payment card details are collected and processed directly by our Merchant of Record (Paddle) and are not stored by us.

2. Purposes & legal bases

• Provide the Service (contract): account creation, generation, deploys, billing reconciliation.
• Security & fraud prevention (legitimate interests): abuse detection, rate limiting, audit logs.
• Service improvement (legitimate interests): aggregated usage analytics.
• Customer support (contract / legitimate interests): responding to your requests.
• Marketing (consent): only where you have opted in; you can withdraw consent at any time.
• Legal compliance (legal obligation): tax, accounting, lawful requests.

3. How we share data

• Service providers / subprocessors — hosting (Lovable Cloud / Supabase), AI model providers, analytics, email delivery, support tooling.
• Merchant of Record — Paddle.com Market Limited handles the sale, subscription management, payments, tax compliance and invoicing.
• Professional advisers — legal and accounting where necessary.
• Authorities — when required by law or to protect rights and safety.

4. International transfers

Some processors are located outside the UK/EEA. Where personal data is transferred internationally, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

5. Retention

We keep personal data only as long as needed for the purposes above: account data while your account is active and for a reasonable period afterwards, transaction records as required by tax law (typically up to 7 years), and logs for a limited period. Data is deleted or anonymised when no longer needed.

6. Your rights

Subject to applicable law you may request access, rectification, erasure, restriction, portability, or object to processing, and withdraw consent at any time. Users in the UK/EEA have rights under the GDPR including the right to lodge a complaint with their supervisory authority. We aim to respond within one month.

7. Security

We use appropriate technical and organisational measures including encryption in transit, access controls, role-based permissions and row-level security on user data.

8. Children

The Service is not intended for individuals under 16.

9. Changes & contact

We may update this notice; material changes will be notified in-app or by email. To exercise your rights or ask questions, contact Dylan Mabe via the support channels in the dashboard.