# Privacy policy

Last updated: 29 October 2026.

## Who is responsible

shoplab GmbH, Benzstraße 8, 85551 Kirchheim bei München, Germany. Email [hello@shoplab.cc](mailto:hello@shoplab.cc), phone +49 89 27780222. More details are in our [Impressum](https://forgeqa.io/impressum).

## Where your data is hosted

Forge QA runs on servers of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in their Falkenstein data center in Germany. The website, the app, your tests, run evidence and the test browsers all run there. Requests to forgeqa.io and app.forgeqa.io pass through Cloudflare (Cloudflare, Inc.), which protects the service against attacks and delivers it; Cloudflare processes your IP address and request details for that purpose.

## This website

forgeqa.io sets no cookies and uses no analytics or tracking. Our server processes your IP address and request details to deliver the page and keep it secure. We keep no access logs of page views; error logs needed to run the service are overwritten automatically once they reach a small fixed size.

## The Forge QA app

- **Account:** email address, a password hash, workspace and team membership. Sign-in uses one strictly necessary session cookie.
- **Identity check:** before a workspace can add websites or run browsers, its owner verifies their identity with Stripe Identity. Stripe collects the ID document and selfie; we store only the verification status and reference, not the images. We do this to keep bad actors away from other people's websites and to protect the shared IP addresses our customers allowlist.
- **Billing:** handled by Stripe, including card details, billing address and tax ID.
- **Tests and evidence:** your test steps, plus screenshots, videos, traces and network/console logs from your runs. Evidence files are kept for 7 to 60 days depending on your plan, then deleted; the run history stays. Logs remove query strings, request bodies and known secrets; screenshots and videos show whatever your site displays.
- **Email:** sign-in codes, invitations and alerts are sent through Resend.
- **AI features (optional):** when you use AI test writing, ForgeAI review, self-healing, the recorder's AI Buddy or the in-app assistant, the relevant test steps and the visible content of the page under test (text, labels and element selectors) are sent to OpenRouter and the model provider you selected. The page security scan sends short excerpts of newly seen third-party scripts. We don't send passwords or secret values.
- **Integrations (optional):** Slack, Jira Cloud or your webhook receive run results only after you connect them.

## Legal bases

We process data to provide the service you signed up for (Art. 6(1)(b) GDPR), to meet legal obligations such as tax record keeping (Art. 6(1)(c)), and for our legitimate interest in running a secure service and preventing abuse (Art. 6(1)(f)). The selfie comparison in the identity check needs your consent, which Stripe asks for (Art. 6(1)(a) and Art. 9(2)(a)).

## Service providers

Hetzner Online GmbH (hosting, Germany), Cloudflare (network protection and delivery), Stripe (payments and identity checks), Resend (email) and OpenRouter (AI requests). They process data for us under data processing terms. Cloudflare, Stripe, Resend and OpenRouter may process data in the USA; those transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses.

## Retention

We keep account, workspace, test and audit data while your account exists. When you ask us to close your account, we delete it together with its workspaces, tests and run history, except billing records we must keep for up to 10 years under German tax and commercial law (§ 147 AO, § 257 HGB).

## Your rights

You can request access, correction, deletion, restriction, portability, or object to processing (GDPR Articles 15–21), and withdraw consent at any time. Write to [hello@shoplab.cc](mailto:hello@shoplab.cc). You can also complain to a supervisory authority; ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

---

Source: https://forgeqa.io/privacy · Start a free trial: https://app.forgeqa.io/#signup

Summary: How Forge QA handles personal data.