This policy explains what Agent Forja collects, why, and what happens to it. We keep it short because we keep little.
What we collect
- Your account: email address, a hashed password (never the password itself), your name if you give it, and when you confirmed your email.
- What you build: the instructions, files, website content and product data you give your agents, and the settings you choose.
- Conversations: messages between your agents and their visitors, and between you and the builder. Visitors are not asked for personal details; if they type some into a chat, it is stored with the conversation and is under your control.
- Billing: your plan, subscription status and Paddle's identifiers for your subscription. Card numbers go to Paddle and never reach us.
- Technical: IP address and browser details in server logs, used for security and rate limiting, kept briefly.
- Instagram and Facebook: only if you connect an account or Page — see below.
Instagram and Facebook
You can connect an Instagram professional account or a Facebook Page to an agent, so the agent answers its direct messages. When you do, Meta asks you to allow Agent Forja access, and we receive only what that needs:
- The account or Page: its id, username or Page name, and profile picture; for Instagram also the name, follower, following and post counts and your latest posts, which we show you on the Share page and do not keep.
- An access token from Meta, stored encrypted, used only to read and send the messages below.
- Messages: the text of direct messages people send to the connected account or Page, the id Meta gives each sender for your account (not their name or profile), and the replies sent by your agent or by you from the dashboard.
We use this only to answer those messages with your agent and to show you the conversations. We do not post, comment, read other inboxes, use the data for advertising, or share it with anyone except the AI model providers below, who receive the message text needed to write a reply.
How we use it
To run the Service: to sign you in, to generate your agents' answers, to show you your conversations, to email you a handoff when a visitor asks for a person, to charge for paid plans, and to send account emails (verification codes, password resets, one notice a month if a plan's allowance runs out). We do not send marketing email and we do not sell data.
Who else sees it
- AI model providers (Anthropic, OpenAI): receive the text needed to generate an answer or a search embedding. They process it under their API terms and do not train on it.
- Paddle (paddle.com): our merchant of record, handles payment, tax and invoices and sees your email and billing details.
- Cloudflare: hosts the Service and delivers our email; data is stored encrypted at rest.
- Hostinger: the mailbox our emails are sent from.
- Meta (Instagram, Facebook): delivers the direct messages between your connected account or Page and the people who message it.
Otherwise we disclose data only if the law requires it.
Cookies
One cookie keeps you signed in. The widget on your site stores a random visitor id in the visitor's browser so their conversation continues; it identifies nobody. No advertising or tracking cookies.
Keeping and deleting
Your data stays as long as your account does. Deleting an agent deletes its data and conversations; closing your account (email us) deletes everything. Backups are overwritten within 30 days. Email us and we will delete or export your data on request.
Deleting Instagram and Facebook data
- To stop access: open your agent → Share → Instagram & Facebook and press Disconnect. The access token is deleted at once and no more messages are received. You can also remove Agent Forja in Instagram (Settings → Apps and websites) or Facebook (Settings → Business integrations); Meta tells us, and we delete the access token at once.
- To delete the conversations: delete them under Conversations, or delete the agent. If you remove Agent Forja in Instagram or Facebook and ask there for your data to be deleted, we delete the connection and every conversation that came through it as soon as Meta tells us, and Meta gives you a confirmation code and a link to its status. Or email support@agentforja.com from your account's address and we will delete all Instagram and Facebook data for your account within 30 days.
- If you messaged a business that uses Agent Forja and want your messages deleted, ask that business, or email us with the account you messaged and we will delete them.
Your rights
Depending on where you live you may have the right to access, correct, export or delete your data, or to object to how it is used. Write to us and we will help. If you are in the EU or UK you may also complain to your data-protection authority.
Changes
If this policy changes in a way that matters, we will email account holders before it takes effect.
Contact
support@agentforja.com. See also our terms.