Privacy & Data Protection Policy

Effective Date: September 24, 2026 — Version 2.0 — GDPR, CCPA/CPRA & Global Compliance

CORE PRIVACY ARCHITECTURE & DISCLOSURE: ForgeVZ operates a client-side execution model for script testing and emulation. Your GPC script logic, bytecode parsing, and controller slot mappings run locally within your browser sandbox and are not harvested or stored on our central servers. However, to deliver authenticated digital services, enforce security, monitor network performance, prevent fraud, and maintain legally binding evidence for merchant dispute resolution, we collect, process, and retain specific technical telemetry, cookie interaction data, IP addresses, and traffic analytics as thoroughly detailed in this Policy.

1. Data Controller & Official Contact

ForgeVZ ("ForgeVZ", "we", "us", or "our") is the data controller responsible for personal information collected through the website (https://www.forgevz.com), the web application, helper applications, and administrative systems.

For all privacy inquiries, data subject access requests (DSARs), or verification notices, contact our dedicated support team at:
Official Support Email: Forgevzsupport@gmail.com

2. Specific Data Categories We Collect & Process

To accurately reflect the operational reality of our platform, the categories of personal data and technical telemetry we collect include:

Data Category	Specific Data Points Collected	Purpose & Legal Basis
Cookie Consent & Tracking Logs	Public IPv4/IPv6 address (via `CF-Connecting-IP`, `X-Forwarded-For`, `X-Real-IP`), User-Agent header string, exact ISO 8601 UTC timestamp, referrer URL, interaction choice (Accepted/Declined), consent version (e.g. `v4`), and session identifiers.	Fraud Prevention, Audit Trails & Dispute Rebuttal: Used to maintain immutable proof of policy acceptance, verify geographic origin, ensure compliance, and submit conclusive evidence to payment processors (Stripe) and banking networks to refute unauthorized transaction claims and fraudulent chargebacks. (Legitimate Interest & Legal Defense)
Site Traffic & Analytics Telemetry	Pageview events, route transitions, visitor traffic origin (referrer headers, search query parameters), country/region/city derived from network edge headers, device architecture, operating system, and browser engine version.	Platform Analytics & Infrastructure Defense: Wirelessly aggregated to real-time administrative dashboards to analyze user flows, monitor operational stability, detect bot traffic, and mitigate automated scraping or DDoS attacks. (Legitimate Interest)
Account & Identity	Email address, unique user UUID, cryptographically hashed passwords (handled via Supabase Auth), account registration date, and last authentication timestamp.	Authentication & Account Service: To authenticate your access, secure sessions, and deliver the software platform. (Contract Performance)
Billing & Transaction History	Stripe Customer ID, Stripe Checkout Session IDs, subscription status (active, past_due, canceled), billing cycle dates, currency, last 4 digits of payment card, and card brand. (We never store full card numbers, CVVs, or bank credentials; all card data is processed directly by Stripe PCI-DSS Level 1 certified systems).	Payment Processing & Entitlement: Managing subscriptions, activating application access, delivering invoices, and processing renewals. (Contract Performance & Legal Compliance)
Local Browser Storage (Client-Side Only)	GPC script code, slot configurations (`forgevz.slots.v1`), user display preferences (`forgevz.settings.v1`), gamepad overlay settings (`forgevz.showPad`), and client consent flag (`forgevz.cookie_consent_v4`).	Local Application Execution: Stored locally inside your personal browser storage sandbox. This data is not uploaded to our servers and remains strictly on your device. (User Controlled)
Helper Bridge & Controller Telemetry	Local WebSocket connection status (`127.0.0.1:8740`), local packet routing to your console IP (e.g. PS5 Remote Play via Chiaki), and gamepad input loop diagnostics.	Local Hardware Interoperability: Operates entirely on your local area network (LAN) between your browser and local Python bridge. Real-time controller inputs are not recorded or transmitted to ForgeVZ remote servers. (Operational Utility)

3. Purpose and Use of Collected Information

We process your personal information and technical logs strictly for the following operational and legal purposes:

Digital Service Delivery: Providing authentication, compiling and executing GPC scripts in your browser VM, granting access tokens, and providing helper bundle downloads.
Fraud Prevention & Merchant Dispute Defense: Maintaining comprehensive, timestamped audit logs of user IP addresses, cookie consent choices, login sessions, and download activity. In the event of an unjustified chargeback or fraudulent transaction claim ("unauthorized purchase", "friendly fraud", or "service not rendered"), these records are submitted directly to Stripe, card issuing banks, and credit card networks as forensic proof that the user accessed and utilized the Service.
Traffic Monitoring & Service Optimization: Aggregating traffic origin, geographic distribution, and page usage within our administrative portal to troubleshoot latency, optimize global edge caching, and identify technical errors.
Security & Abuse Prevention: Detecting automated credential stuffing, unauthorized API exploitation, abusive traffic spikes, and violations of our Terms of Service.
Legal Compliance: Complying with financial recordkeeping obligations, tax reporting, and lawful requests from regulatory authorities.

4. Cookie Notice & Technology Disclosure

When you access ForgeVZ, our cookie banner prompts you with the following notice:

"We use cookies and other technologies to analyze site traffic and improve our sites and services. For more information, refer to our updated Privacy Policy."

Our implementation utilizes:

Strictly Essential Technologies: Necessary for session authentication (Supabase tokens), security validation, and client-side application state. Without these, authenticated app functionality cannot operate.
Analytics & Consent Tracking: When you click "Accept & Continue" or navigate our web properties, we log your acceptance status alongside your IP address and User-Agent to preserve your consent preference and maintain an auditable compliance log.
Local Storage Keys: We use HTML5 LocalStorage keys (e.g., forgevz.cookie_consent_v4, forgevz.slots.v1, forgevz.settings.v1) solely to preserve your workspace configurations and prevent redundant banner prompts across sessions.

5. Third-Party Service Providers and Data Sharing

We do not sell, rent, monetize, or trade your personal information with data brokers or third-party advertising exchanges. We share data solely with trusted infrastructure service providers under binding confidentiality and data protection agreements:

Stripe, Inc. (USA/Global) — PCI-DSS Level 1 certified payment processor. Receives billing details and transactional tokens. In dispute scenarios, Stripe receives our collected access and consent evidence.
Supabase, Inc. (USA/EU) — Cloud database and authentication provider. Hosts encrypted user accounts, authentication tokens, and administrative audit logs.
Cloudflare / Vercel (USA/Global) — Edge hosting, DNS routing, DDoS protection, and CDN infrastructure. Processes inbound network traffic and IP headers.
Financial Institutions, Card Networks & Arbitrators: In the event of a disputed transaction or chargeback, we transmit detailed forensic evidence (including IP logs, User-Agent records, acceptance timestamps, and download records) to financial institutions to adjudicate the dispute.
Law Enforcement & Legal Process: We may disclose records if required by a valid subpoena, court order, or applicable law, or to protect the vital legal rights, property, and security of ForgeVZ, our users, or the public.

6. Data Retention Policy

Cookie Consent & IP Audit Logs: Maintained for thirty-six (36) months from the date of capture to satisfy financial chargeback dispute windows, audit defense requirements, and statutory limitation periods.
Site Traffic & Analytics Data: Aggregated, anonymized, or kept in rolling server logs for up to twenty-four (24) months for infrastructure analysis.
Account Data: Retained for the active duration of your account and up to twenty-four (24) months following termination, except where longer retention is mandated by financial, tax, or legal retention requirements.
Client-Side Storage: Retained on your personal device until manually cleared through your browser settings or local cache deletion.

7. International Data Transfers

ForgeVZ operates infrastructure located in the United States and globally distributed edge datacenters. If you access the Service from the European Economic Area (EEA), the United Kingdom, Switzerland, or other regions with comprehensive data protection laws, your information may be transferred to and processed in the United States. We implement Standard Contractual Clauses (SCCs) and robust security safeguards to ensure equivalent data protection across all international transfers.

8. Your Legal Rights & Data Subject Requests

Depending on your jurisdiction (such as under the GDPR, UK Data Protection Act, California Consumer Privacy Act (CCPA), or California Privacy Rights Act (CPRA)), you may hold certain rights regarding your personal information:

Right of Access & Portability: You may request a copy of the personal data we hold about you.
Right to Rectification: You may request correction of inaccurate or incomplete personal records.
Right to Erasure ("Right to be Forgotten"): You may request deletion of personal information, subject to mandatory legal exceptions (such as our right to retain transaction records, IP logs, and consent evidence necessary for legal compliance, fraud defense, or dispute resolution).
Right to Object or Restrict Processing: You may object to processing based on legitimate interests, unless we demonstrate compelling legitimate grounds that override your interests.
Non-Discrimination: We will never discriminate against you for exercising your lawful privacy rights.

To exercise any of these rights, send a written request to our official support team at Forgevzsupport@gmail.com. We will verify your identity and respond within the statutory timeframe (30 days for GDPR, 45 days for CCPA).

9. Data Security Safeguards

We maintain rigorous administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, destruction, loss, or disclosure. All web traffic is strictly encrypted using Transport Layer Security (TLS 1.3), database tables are protected by Row Level Security (RLS) policies, and administrative interfaces require authenticated credentials. However, no internet transmission or electronic system can be guaranteed 100% impenetrable; you remain responsible for maintaining the confidentiality of your account credentials.

10. Third-Party Trademarks & Independence

References on this site or in our software to Cronus Zen®, PlayStation®, DualSense®, Xbox®, or other third-party products are strictly for technical compatibility and interoperability reference under nominative fair use. ForgeVZ is an independent product and is not affiliated with, sponsored by, or endorsed by Sony Interactive Entertainment, Microsoft, Collective Minds Gaming Co. Ltd., or any other hardware manufacturer.

11. Policy Modifications

We may update this Privacy Policy from time to time to reflect operational modifications, regulatory changes, or enhanced tracking capabilities. When changes are made, we will revise the Effective Date at the top of this document. Your continued use of ForgeVZ after an update constitutes your acknowledgment and acceptance of the revised terms.

12. Contact Us

For questions, privacy requests, or dispute inquiries, contact our official team:
ForgeVZ Support & Privacy Team: Forgevzsupport@gmail.com