Privacy policy

1. Who we are (data controller)

ForgeLetter is operated by [Legal entity name], a company registered in the Republic of Bulgaria under EIK [EIK number], with its seat at [Registered address]. For all matters under this policy, [Legal entity name] is the data controller within the meaning of Article 4(7) GDPR.

2. How to reach us

All privacy and data-protection requests are handled by our designated privacy contact. ForgeLetter is not required to appoint a formal Data Protection Officer under Article 37 GDPR — our processing is not large-scale monitoring of individuals and does not involve special-category data — but we still respond to GDPR requests within the statutory timeframes.

• Privacy and data-protection requests: privacy@forgeletter.app
• Postal: [Legal entity name], [Registered address], Republic of Bulgaria

3. What we collect

We collect only what is needed to run the product:

• Account data: name, email address, hashed password (or the OAuth identifier if you sign in with Google or Facebook).
• Application content: the resume snippets, employer / internship / university entries and cover-letter drafts you save.
• Generation inputs: the job description text and the prompt parameters you submit to the AI pipeline.
• Billing identifiers: a Stripe customer ID and subscription metadata. Raw card numbers are handled by Stripe and never reach our servers.
• Technical data: IP address, user-agent and request timestamps in standard server logs.
• Consent log: the cookie-category choices you make in the banner, plus a timestamp and policy revision.

4. Why we collect it (lawful bases)

Each category of data has a specific purpose and lawful basis under Article 6 GDPR:

• Account + application content + generation inputs — Contract (Art. 6(1)(b)): we need this to provide the service you signed up for.
• Billing identifiers — Contract + Legal obligation (Art. 6(1)(b) and (c)): required to take payments and meet tax / accounting rules.
• Server logs — Legitimate interest (Art. 6(1)(f)): needed to keep the site secure and to debug outages.
• Analytics / marketing cookies (if you opt in) — Consent (Art. 6(1)(a)): only set after you accept them in the banner.

5. How long we keep it

We apply specific, time-bound retention periods to each data type. Where Bulgarian or EU law mandates a longer retention (notably for billing and tax records), that period prevails.

6. Who we share it with (sub-processors)

We use a small number of vetted sub-processors and never sell personal data. All transfers outside the European Economic Area rely on the EU Standard Contractual Clauses (Commission Decision 2021/914) and, where applicable, the EU-US Data Privacy Framework adopted by the European Commission on 10 July 2023.

7. International transfers

Some sub-processors are located outside the EEA / UK. We rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and the EU-US Data Privacy Framework as the legal basis for these transfers. Copies of the SCCs we use are available on request via privacy@forgeletter.app.

8. How we protect your data

We apply technical and organisational measures appropriate to the risk, in line with Article 32 GDPR:

• All traffic between your browser and ForgeLetter is encrypted with TLS 1.2 or higher.
• Data at rest on Supabase is encrypted with AES-256.
• Passwords are stored hashed with bcrypt (12+ rounds) — we cannot read your plaintext password.
• Two-factor authentication is offered for accounts and required for production access by our staff.
• Production access is least-privilege, logged, and reviewed quarterly.
• All third-party providers we use are SOC 2 Type II or ISO 27001 certified (Vercel, Supabase, Stripe, Anthropic).
• We monitor for vulnerabilities and apply security patches promptly.
• We will notify you and the relevant supervisory authority of a personal data breach within 72 hours where required by Article 33 GDPR.

9. Your rights

Depending on where you live, you have some or all of the following rights. We will respond within 30 days (extendable by two months for complex requests, per Article 12 GDPR).

• Access — request a copy of the data we hold about you (Art. 15 GDPR).
• Rectification — correct anything inaccurate (Art. 16 GDPR).
• Erasure / Right to be forgotten — delete your account and associated data (Art. 17 GDPR).
• Restriction — ask us to pause processing while a dispute is resolved (Art. 18 GDPR).
• Portability — receive your data in a machine-readable format (Art. 20 GDPR).
• Objection — object to processing based on legitimate interest (Art. 21 GDPR).
• Withdraw consent — change your cookie choices at any time from the footer; this does not affect anything processed before withdrawal (Art. 7(3) GDPR).
• Not be subject to fully automated decisions with legal effect — note that AI-generated cover letters are advisory drafts you review, not automated decisions (Art. 22 GDPR).
• California residents (CCPA / CPRA): right to know, delete, correct, limit sensitive data and opt out of sale or sharing. We do not sell or share personal data for cross-context behavioural advertising.
• Brazilian residents (LGPD): equivalent rights under Articles 18-22.
• Lodge a complaint with your local data-protection authority — see section 10.

10. Supervisory authorities

If you believe we have not handled your data lawfully you have the right to lodge a complaint with a supervisory authority. Our lead authority is Bulgaria's CPDP, but you may complain to the authority in your country of residence:

• Bulgaria — Commission for Personal Data Protection (Комисия за защита на личните данни, CPDP) — https://www.cpdp.bg, +359 2 91 53 518, kzld@cpdp.bg
• United Kingdom — Information Commissioner's Office (ICO) — https://ico.org.uk
• Ireland — Data Protection Commission (DPC) — https://www.dataprotection.ie
• Germany — your federal-state DPA (BfDI for federal matters) — https://www.bfdi.bund.de
• France — Commission nationale de l'informatique et des libertés (CNIL) — https://www.cnil.fr
• California — California Privacy Protection Agency (CPPA) — https://cppa.ca.gov
• Other EU/EEA — list at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

11. How to exercise your rights

Email privacy@forgeletter.app from the email address on your account, or submit a request via the contact page. We may ask for additional information to verify your identity before acting on the request. We do not charge a fee unless the request is manifestly unfounded or excessive, in line with Article 12(5) GDPR.

12. Sign in with Google — limited use disclosure

ForgeLetter's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request only the scopes needed to authenticate you (email and basic profile). We do not use Google user data to develop, improve, or train generalised AI models; we do not transfer Google user data to third parties for advertising; we do not allow humans to read your Google user data unless we have your specific consent, it is necessary for security investigations, or as required by law. You can revoke ForgeLetter's access at any time from https://myaccount.google.com/permissions.

13. Sign in with Facebook

When you choose Sign in with Facebook, Meta passes us your name, email address, and Facebook user ID under your direction. We use this only to create or look up your ForgeLetter account. We do not post to Facebook on your behalf and do not run a Meta Pixel on the site. You can revoke ForgeLetter's access from your Facebook Settings → Business integrations.

14. Cookies

For the full list of cookies set, why each exists, and how to change your choices, see the Cookie policy. You can re-open the consent banner from the Cookie preferences link in the footer or sidebar at any time.

15. Children

ForgeLetter is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has signed up, contact us at privacy@forgeletter.app and we will delete the account. In jurisdictions where the digital-consent age is higher (e.g. 13 under US COPPA, 16 in most of the EU), the local minimum applies.

16. Changes to this policy

We will post any material change here, update the revision number, and — if the change touches consent — re-prompt you in the cookie banner. Minor wording fixes will not trigger a re-prompt. The current version is always available at this URL; previous versions are kept for two years and available on request.

17. Contact

Privacy questions and rights requests can be sent to privacy@forgeletter.app or via the contact page. We aim to respond within one working week and at the latest within 30 days as required by the GDPR.