Privacy Policy

Controller and how to contact us

ArchForge is made available at https://archforge.nl. The party responsible for personal-data processing is Jeffrey Vels, at De Steeg, The Netherlands. Contact info@jeffrey-services.nl for privacy matters. Where a data protection officer is required, that officer's contact details will be supplied here: N/A. “Jeffrey Services” is a brand attribution and must not be assumed to identify a registered legal entity without verification.

Categories of personal data

We may process the account name, email, password hash, display name, avatar, biography, profile links and communication preferences you provide. Account security features generate email-verification events, one-time-code events, hashed or encrypted access-token material, session identifiers, TOTP enrollment metadata, SSH public keys, sign-in timestamps, IP addresses or security records where technically logged. Never submit a password, private SSH key or authentication secret in public content.

Git hosting contains the names, email addresses, timestamps, commit messages and other metadata written by Git authors, which may concern contributors who have no ArchForge account. Repositories, issues, pull requests, release assets, uploaded files, discussions, forum posts, groups, chat messages and reports may contain personal information. A user choosing browser notifications may register a push subscription endpoint. HTTPS webhooks and Discord integration necessarily disclose the events and selected payload data to the endpoints configured by repository maintainers.

Purposes and legal bases

Activity	Purpose	Candidate legal basis (must be verified)
Account, authentication and permissions	Deliver account and Git services	Performance of contract (Art. 6(1)(b) GDPR)
Git repository, issue and collaboration features	Store and distribute content as directed by users	Contract and, where appropriate, legitimate interests; assess controller roles case by case
Fraud prevention, abuse handling and security	Defend accounts and infrastructure	Legitimate interests (Art. 6(1)(f)); document a balancing assessment
Legal demands and statutory records	Fulfil applicable requirements	Legal obligation (Art. 6(1)(c)), only where it applies
Optional marketing or non-essential tracking	Optional features	Valid consent where required, with an equally accessible withdrawal mechanism

Verify each processing activity against the actual implementation and record the appropriate legal basis; this table is not a substitute for that assessment. ArchForge is generally a controller for its own account operation, but may have different roles for particular hosted content depending on context.

Visibility, sharing and recipients

Anyone may read, copy, clone, index or mirror a repository marked public, including public Git author names and email addresses. Deleting content from this server cannot remove external clones, caches or forks. Private repositories are subject to server access controls and may be handled by authorized operational personnel as needed; they are not end-to-end encrypted. Group members, collaborators and other users see content according to the product's visibility rules. Staff may access necessary records for support, security and legally required moderation, subject to role-based controls.

Third-party infrastructure providers and processors must be described accurately: Germany (EU) – Our platform is hosted on servers located in Germany, within the European Union., Netherlands (EU) – Self-hosted email server located in the Netherlands., **Our platform uses third-party service providers where necessary to operate, maintain, and secure our services.

Our platform is hosted on servers located in Germany, while email communications are handled through our self-hosted email server located in the Netherlands.

Donation payments are processed through SumUp for secure payment processing and transaction management.

Any additional third-party data processors will only be engaged where necessary for legitimate operational purposes and in compliance with applicable GDPR requirements.

Where required, appropriate data processing agreements and security safeguards are maintained.

We do not share personal data with third parties for their independent marketing purposes without an appropriate legal basis.**. Where services involve transfers outside the EEA, describe the actual transfer mechanism, assessment and supplementary protections: **Our platform primarily processes and stores personal data within the European Economic Area (EEA).

Our hosting servers are located in Germany, and our self-hosted email server is located in the Netherlands.

Donation payments are processed through SumUp, a third-party payment service provider. Payment-related personal data may be transferred or processed outside the EEA, depending on SumUp's operations and service providers.

Where personal data is transferred outside the EEA, appropriate safeguards will be applied in accordance with the General Data Protection Regulation (GDPR), including European Commission adequacy decisions or Standard Contractual Clauses (SCCs), where applicable.

Additional technical and organizational security measures will be implemented where necessary to protect personal data.

Users may contact us for further information regarding international data transfers and applicable safeguards.**. Notifications, webhooks and Discord URLs are configured by users; their external recipients may operate under separate terms and policies.

Donations and payment processing

ArchForge offers an optional donation feature using SumUp Hosted Checkout when enabled. Explain the actual personal data exchanged with SumUp, who controls the checkout and donation records, confirmation emails, security checks and any international transfers: **All donations made through our platform are processed by SumUp, our third-party payment service provider.

SumUp processes payment information in accordance with its applicable privacy policy, security standards, and legal obligations.

Our platform retains donation transaction records, including payment amounts, transaction dates, and transaction references, for accounting, financial reporting, fraud prevention, and legal compliance purposes.

Where Dutch statutory accounting retention requirements apply, relevant financial records are retained for seven years. Other personal data is retained only for as long as necessary for the purposes for which it was collected or as required by law.

SumUp may retain payment-related information according to its own data retention policies and applicable legal requirements.

Donations are non-refundable, except where refunds are required by applicable law.**. ArchForge does not need to receive or store full payment-card numbers when checkout is hosted by the payment provider. Validate these statements against the production integration and SumUp account settings.

Retention and deletion

Real deletion periods must be drawn from technical settings and operations, not estimated. Account records: User accounts and associated personal data are retained for as long as the account remains active. Upon account deletion, personal data will be deleted or anonymized within 30 days, unless a longer retention period is required by applicable law or necessary for legitimate legal obligations.. Security/access logs: **Security logs, including login attempts, IP addresses, authentication events, system access records, and suspicious activities, are retained only for as long as necessary to protect our platform, prevent fraud, investigate security incidents, and comply with applicable legal obligations.

Security logs are periodically reviewed and automatically deleted or anonymized according to our data retention policies.

Certain security records may be retained for longer periods where necessary for ongoing security investigations, fraud prevention, legal claims, or compliance with applicable laws.

Access to security logs is restricted to authorized personnel, and appropriate technical and organizational measures are implemented to protect this information.

All security log data is processed in accordance with the General Data Protection Regulation (GDPR) and our Privacy Policy.**. Direct messages and community content: Community posts, comments, discussions, and other user-generated content are retained for as long as they remain active on the platform. When content is deleted by a user or removed by the platform, associated personal data will be deleted or anonymized within 30 days, unless a longer retention period is required by applicable law. Backup copies are handled according to our backup retention policy.. Abuse reports and related evidence: **Our platform retains moderation records, user reports, content removal decisions, warnings, account restrictions, and related information only for as long as reasonably necessary to maintain platform safety, enforce our community guidelines, resolve disputes, and comply with applicable legal obligations.

Moderation records are periodically reviewed and deleted or anonymized when they are no longer necessary.

Certain records may be retained for longer periods where required by law or necessary for ongoing investigations, legal claims, fraud prevention, or the protection of users.

Access to moderation records is restricted to authorized personnel.

All moderation-related personal data is processed in accordance with the General Data Protection Regulation (GDPR) and our Privacy Policy.**. Backup copies and their rotation: Backup copies of user data are retained for a maximum of 30 days and are automatically deleted or overwritten after this period. Backups are securely stored and accessible only to authorized personnel. Deleted user data may remain in backups until the applicable retention period expires.. Statutory preservation and litigation holds may require limited exceptions; document who approves them.

Where feasible and legally required, ArchForge will erase eligible account-related data. Published Git history, references in other users' repositories, archived moderation evidence and material cloned by third parties present limits that will be evaluated and explained with each request. Do not assume an account deletion means removal from all copies of Git history.

Your rights

Subject to applicable law, you can ask for information, access, correction, erasure, restriction, portability or object to processing based on legitimate interests. You can withdraw consent at any time where consent is relied on; withdrawal does not retroactively invalidate earlier processing. Contact info@jeffrey-services.nl, or use the privacy request form when logged in. We will verify requests proportionately, respond within applicable time limits and explain any limitation. You can lodge a complaint with the Dutch Autoriteit Persoonsgegevens or another competent data protection authority.

Security, cookies, children and updates

ArchForge uses HTTPS, session cookies and account-security controls as configured; no service is guaranteed perfectly secure. Details of actual local storage and cookies are explained in the Cookie Policy. The platform's minimum age and any required parental-consent process must be verified and documented: **Our platform is intended for users aged 16 years and older.

Users must be at least 16 years old to create an account and use our services.

Individuals under the age of 16 are not permitted to register or use the platform without authorization expressly provided under our applicable policies and legal requirements.

We do not knowingly collect personal data from children under the minimum permitted age. If we become aware that an account has been created in violation of this policy, we may suspend or delete the account and take appropriate steps to remove associated personal data, unless retention is legally required.

We are committed to protecting the privacy and safety of younger users in accordance with applicable Dutch and European Union data protection laws.**. Do not submit sensitive personal data in repositories or messages unless appropriate. We notify people of material policy updates in an appropriate way.

Changes and version history

This policy applies from its stated effective date once published. Material changes are dated and versioned. Earlier versions remain available to administrators for audit, and any notice or renewed agreement required by applicable law is handled separately. Questions and legally valid notices may be sent using the contact details in the Legal Notice.