Privacy Policy
Effective: [effectiveDate]
This policy explains how we handle personal data about the people who visit our website, join our waiting list, or sign up for and pay for the Service. It does not cover the personal data inside the applications you host with us (for example your own users' logins): for that we are your processor and the data processing terms in Annex 1 of our Terms of Service apply.
1. Who is responsible
The data controller is Kristian Mandrup, a sole proprietorship (enkeltmandsvirksomhed), CVR [cvr], Dr. Priemesvej 5, 3tv, 1854 Frederiksberg C, Denmark. You can reach us at admin@blueforge.studio for anything in this policy.
2. What we collect, why, and on what legal basis
| What | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Name, email address and organisation, when you create an account | To create and run your account and contact you about the Service | Performance of a contract (6.1(b)) |
| Billing details and payment status (card details go straight to Stripe; we never see or store a full card number) | To charge for Pro, issue invoices and handle refunds | Contract (6.1(b)); legal obligation to keep accounting records (6.1(c)) |
| Technical and usage data: IP address, timestamps, request and error logs, device and browser type | To run, secure and troubleshoot the Service and to prevent abuse | Legitimate interest in a secure, working service (6.1(f)) |
| Messages you send us (support, abuse reports, legal notices) | To answer you and meet our legal duties | Contract or legitimate interest (6.1(b), 6.1(f)); legal obligation for notices (6.1(c)) |
| Email address when you join the waiting list or ask for occasional updates | To tell you when the Service opens and send occasional updates | Your consent (6.1(a)), which you can withdraw at any time |
We do not sell personal data, and we do not use it for automated decisions that significantly affect you.
3. Who receives it
We use a small number of service providers (processors) who handle personal data on our instructions:
- Hetzner Online GmbH: hosting and storage of the Service and its backups.
- Stripe: payments and invoicing. Stripe also acts as an independent controller for its own legal duties, such as fraud prevention, under its own privacy policy.
- Resend: sending the emails the Service sends (for example account and billing messages and waiting-list updates).
- Cloudflare: backup copies of files held in our object storage (stored in Cloudflare R2).
We may also disclose data where the law or an authority requires it, to our professional advisers under a duty of confidentiality, and to a successor if the business is transferred (section 17.1 of the Terms).
4. Where it is processed
Our servers are located in [dataLocation]. If a provider processes data outside the EU/EEA, we rely on a valid transfer mechanism, such as an adequacy decision or the EU standard contractual clauses.
5. How long we keep it
- Account data: while your account exists. When you close it, we delete it after the export period in the Terms, except what we must keep by law.
- Accounting records (invoices and payments): five years from the end of the financial year, as the Danish Bookkeeping Act requires.
- Technical logs: only as long as needed for security and troubleshooting.
- Support and legal messages: as long as needed to deal with the matter and any follow-up claim.
- Waiting list: until you unsubscribe or the list is closed.
- Backups: recent nightly backups are kept for about two weeks and are then overwritten; data you have deleted can therefore remain in a backup until then.
6. Your rights
You have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to our processing, and to receive your data in a portable format. Where we rely on consent, you can withdraw it at any time without affecting what was done before. Write to admin@blueforge.studio and we will answer within one month.
You may also complain to the Danish Data Protection Agency (Datatilsynet, www.datatilsynet.dk) or to the authority in your own country.
7. Cookies
The site uses only the cookies it needs to work, such as the session cookie that keeps you signed in to the console. We do not use advertising cookies. If we add analytics or any non-essential cookie, we will ask for your consent first and update this policy.
8. Security
We protect personal data with appropriate technical and organisational measures, described in section 9 of our Terms. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.
9. Children
The Service is for businesses and professional use and is not directed at anyone under 18.
10. Changes
We may update this policy. For material changes we will tell you by email or in your account before they take effect.