Privacy Policy

CopyForge AI is responsible for the account, content and support information described in this policy. For privacy questions or requests, email support@copy-forge-ai.com or use /contact and mark your message “Privacy request.”

We use the information you provide to run your account, generate product copy, check wording and provide support. Saved work stays scoped to your account. You can export or delete your account data from the dashboard, subject to the retention exceptions explained below.

This policy covers CopyForge AI. It does not control how Amazon, Shopify, Meta, Google, Gumroad or another destination handles information after you publish or send content there.

We collect the data needed to operate accounts, generate copy, apply limits, provide support and maintain the Service.

• Account data: email address, optional full name, authentication identifiers and saved defaults.
• Content data: product facts, verified-claim notes, generated copy, compliance matches and scores, brand profiles, uploaded logos and bulk-job records.
• Compliance-workflow records: structured product records (name, SKU, ASIN/GTIN, category and similar listing fields), claim-registry wording with version, approval history and the use limits you set (scope, channels, markets), and claim-evidence links that tie a claim to its supporting record.
• Evidence documents: files you upload to the private evidence vault (PDF, TXT, CSV, Markdown, PNG, JPEG, DOCX or XLSX), URL-reference records, their metadata (title, type, issuer, dates, checksum) and any extracted or manually entered excerpt. Files are stored privately and downloads use short-lived signed URLs.
• Catalogue and monitoring data: imported catalogue listings, listing scan results and scan history, and monitoring alerts generated from content, rule or evidence changes.
• Developer-access data: API key records (only a SHA-256 hash is stored, never the plaintext key), webhook endpoint configurations you register, and webhook delivery logs.
• Plan and payment records: plan, status, expiry, provider, provider transaction reference, amount and currency. Card numbers stay with the payment provider.
• Usage and reliability data: hashed rate-limit identifiers, quota counters, provider/model name, provider-reported token counts, latency, application errors and deployment diagnostics.
• Website analytics: Google Analytics 4 can receive page URL, referrer, browser/device information, approximate location and interaction events such as page views, scrolls, tool starts and completions, account signup, generation/compliance completion, pricing or checkout steps and paid-plan activation. Funnel events use coarse metadata such as tool/channel, plan, billing period, score/risk level or flag count; CopyForge does not intentionally send email addresses, product facts, generated copy, pasted checker text or evidence-vault contents as analytics parameters.
• Optional first-party funnel data: after Allow analytics, CopyForge records coarse signup, scan, rewrite-click, generation and checkout-start events with an optional account id and a random cf_session cookie. The cookie can last up to 400 days. It contains no pasted listing text or email address. Reject analytics stops these optional events and clears that tracking cookie. A separate cf_analytics_consent cookie communicates your privacy choice to the server; it is not an authentication credential.
• Cookieless website statistics: Vercel Web Analytics and Speed Insights receive page URL, referrer, browser/device type, approximate location and page-performance measurements, without any third-party cookies. Vercel Web Analytics identifies a visit with a hash of the incoming request that it discards after 24 hours.
• Growth-operation data: advertising search-query reports imported by the operator, aggregate channel metrics, and pseudonymous experiment participation and outcome records. These are separate from serving AdSense ads.
• Communications: contact or security reports, newsletter requests and Pro/Agency launch-waitlist entries, including the email and message you submit.

Contract or steps requested before a contract: create and secure your account, generate and save copy, enforce plan allowances, export data, process a deliberate purchase and provide support.

Legitimate interests: prevent abuse, diagnose failures, protect accounts, measure aggregate service reliability and, where lawful without prior consent, understand aggregate website usage. We use the minimum data reasonably needed and do not use this basis for behavioural advertising.

Consent: send an optional newsletter or paid-plan launch notification. You can withdraw by using the unsubscribe instruction in the message or contacting us.

Legal obligation and legal claims: retain or disclose records when required for tax, accounting, fraud prevention, disputes or a valid legal process.

Product facts and prompt instructions are sent over HTTPS to whichever configured API provider completes a generation. The available providers are OpenAI, Google Gemini and Groq; fallback attempts may contact more than one configured provider when an earlier attempt fails. When you explicitly run Commerce Assurance Agent Audit (the optional comparison of AI answers with your stored product facts), a bounded set of stored published product fields and buyer questions can also be sent to the configured AI providers so CopyForge can compare their answers with your canonical product truth.

CopyForge AI does not use your generations to train a CopyForge model. We do not claim that every provider offers zero retention in every account or region. Provider API retention, abuse-monitoring and training terms depend on the provider and the account configuration; CopyForge therefore does not make a blanket zero-retention promise for third-party AI APIs.

Do not submit secrets, payment-card data, private health records or other information unnecessary for product copy.

The Service can use Supabase for authentication/database/storage, Upstash for rate limiting and queues, Resend for transactional email, Sentry for error reporting, Google Analytics 4 for website measurement, and PostHog after you choose Allow analytics and only from copy-forge-ai.com or www.copy-forge-ai.com. PostHog receives only these events: scan_completed with flags_count and checker set to a checker page slug; scan_cta_click with target set to gumroad, claim_fix or signup; signup_completed with no other fields; and claim_fix_gumroad_click with source_page set to scan_result or claim-fix and, when the click comes from a checker, checker set to that same slug. Every event also includes a random local identifier and $geoip_disable set to true, which asks PostHog not to record location from the IP address. Listing text, URLs, ASINs, email addresses and product facts are not sent. The Service can also use configured AI API providers for generation and optional Agent Audit, Vercel for application hosting, Web Analytics and Speed Insights, Shopify when you explicitly connect a store for read-only product sync, and Gumroad for paid checkout. The browser also contacts Have I Been Pwned’s Pwned Passwords API for password breach checks.

Each provider receives only the data needed for its role. Infrastructure regions and international-transfer safeguards depend on the active provider projects, contracts and account settings, so CopyForge does not make a blanket data-residency or transfer-mechanism promise here. Privacy requests can ask for the current operational details relevant to the requester.

Supabase authentication uses essential session cookies. Theme preference is stored locally in your browser. CopyForge also uses small first-party local/session-storage markers to suppress owner/admin traffic from all analytics, and preview traffic from Google Analytics; recognise a returning browser; hand off Google signup attribution; and avoid repeatedly emitting the same paid-conversion event. These markers are used for measurement controls, not behavioural advertising.

Google Analytics 4 is configured for aggregate website measurement with Google Signals and ad-personalization signals disabled. Advertising consent types are denied by default. Vercel Web Analytics and Speed Insights use no third-party cookies and run unless you choose Reject analytics; rejecting also stops these cookieless stats. A page view counted before you choose Reject is not removed. Google Analytics, PostHog, first-touch attribution and optional first-party funnel tracking are off by default and run only after you choose Allow analytics. PostHog is not loaded as a script and sends no requests before Allow or after Reject. Preview hosts and any host other than copy-forge-ai.com or www.copy-forge-ai.com do not send PostHog events. Each PostHog event sets $geoip_disable to true, which asks PostHog not to record location from the IP address. The events are scan_completed (flags_count and checker), scan_cta_click (target), signup_completed, and claim_fix_gumroad_click (source_page and optional checker). Use the Privacy choices button to change your choice at any time; Reject analytics stops this optional measurement and clears CopyForge measurement markers, the local PostHog identifier, the first-party funnel tracking cookie and accessible Google Analytics cookies. Your choice is stored locally and in a first-party preference cookie. Account and payment records needed to operate the service, including a confirmed-purchase completion event with no anonymous browser identifier, remain; choosing Reject does not delete those records or earlier events. Advertising storage remains denied everywhere.

Password breach checks hash the entered password in the browser and send only the first five hexadecimal characters of its SHA-1 hash to the Pwned Passwords API over HTTPS. The full password and full hash are not sent to that API; matching is completed locally. As with other HTTPS requests, the API receives the connection IP address. This check runs on signup and password changes, not while you type.

Sentry is optional and configured not to attach default user PII. Google AdSense is disabled: CopyForge AI does not currently serve AdSense advertisements, and public pages do not load an AdSense script.

Account content remains until you delete individual content or the account, subject to technical and legal exceptions. Fixed-window rate-limit keys expire automatically after their window. Bulk export files expire according to the job expiry shown in the dashboard.

Evidence files remain until you delete the evidence record or the account; expired evidence is flagged by date but files are not auto-deleted, so removal stays an explicit choice. Catalogue listings, Assurance snapshots and observations, scan history, monitoring alerts, claim versions and approval records remain until deleted or until account deletion removes them through database cascades. A connected Shopify store is represented by connection metadata plus encrypted OAuth token material; disconnecting clears the stored token material, and account deletion removes the remaining connection row by cascade. Revoked API key hashes are retained only as inert audit rows.

Operator-imported advertising search-query reports (separate from AdSense advertising) are retained for up to 90 days, and first-party website measurement events for up to 400 days. Pseudonymous experiment participation and outcome records are deleted after the experiment has ended and the records are older than 400 days; active experiments retain their records until completion. Aggregate marketing metrics, completed experiment results and business recommendations may be retained longer. Account-linked records remain subject to account deletion and applicable legal duties.

Unconfirmed newsletter and paid-plan launch-list requests are deleted after 30 days. Unsubscribed rows are retained as suppression and consent-audit records for one year, then deleted by the authenticated daily maintenance job. Contact, security, payment and other operational records are kept only as long as needed for their purpose, disputes, security and legal duties. Backup retention follows the configuration of the infrastructure provider rather than a fixed number of days, so this policy states a practice instead of a number it cannot verify.

After primary deletion, encrypted disaster-recovery backups may retain residual copies until they age out under the infrastructure provider’s configured schedule. Backups are not used for ordinary processing and deleted data is not restored except as part of disaster recovery.

Every plan can download an account-data export from Dashboard > Settings. The JSON Lines export includes profile, plan, payment, brand-profile, generation, bulk-job and launch-list rows linked to the immutable account id, plus structured products, claims and their history, evidence metadata and excerpts, catalogue listings and scans, scan feedback, monitoring alerts, Assurance surfaces, snapshots, conflicts, observations, repair proposals and commerce outcomes. It also includes API key metadata with revoked status, webhook endpoint metadata and delivery records, and Shopify connection metadata. API key hashes, webhook signing secrets and Shopify token material are excluded. Documents themselves stay downloadable from the vault until deletion. Pro/Agency copy-library CSV is a separate convenience feature; account privacy access is not paywalled.

You can delete your account from Dashboard > Settings after confirming the account email. Primary account content is removed through database cascades — including products, facts, claims, claim versions, approvals, evidence records and their links, catalogue listings, scan history, monitoring alerts, API keys and webhook configurations — and stored user folders (including evidence files) are removed. The deletion trigger removes waitlist rows linked to the Auth user id. Email-only contact/newsletter records are not exposed or deleted solely on a typed-email match; request those separately so we can verify ownership. Records subject to a legal retention duty may be retained only to satisfy that duty.

Depending on your location, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent. We verify requests to protect the account. You may also complain to your local data-protection authority.

CopyForge AI does not sell personal information or share it for cross-context behavioural advertising. California residents may still contact us to exercise applicable access, correction or deletion rights.

If CopyForge AI, the Service or substantially all related business assets are sold, acquired, reorganised or transferred, account, product-workflow, support and other records described in this policy may be transferred to the successor operator as part of that transaction, but only as permitted by applicable law.

Any successor that receives personal data must use it consistently with the notices, rights and legal obligations that apply at the time of transfer. Where applicable law requires notice, consent or another choice before a transfer, that requirement must be satisfied before the affected data is transferred. You may use the export, deletion and privacy-request options described above before closing where they apply.

Businesses can request a Data Processing Agreement review draft and processing/provider schedule at support@copy-forge-ai.com. The draft is unsigned and is not an agreement in force. Before submitting third-party personal data under a controller/processor arrangement, contact us to establish the contracting parties, authorised processing, eligible providers and any required transfer safeguards. A subscription alone does not put a DPA in place.

Product-copy guidance for an EU or UK marketplace is not a statement that every data-protection obligation for your business has been assessed. Representative requirements depend on the processing and applicable territorial rules; our support inbox is not advertised as an Article 27 representative.

We use authentication, row-level security, explicit ownership filters, private export storage, signed download URLs, rate limits and restricted service credentials. No system is perfectly secure; report concerns through /security.

The Service is not directed to children under 13, and we do not knowingly collect their personal data. Where local law requires a higher age for valid consent or parental authorisation, that higher requirement applies. If you believe a child submitted data without the required authorisation, contact us for deletion.

We update the date above when this policy changes. Material changes affecting active users will be communicated through the Service or account email where reasonably possible.

Submit privacy questions or rights requests through /contact and write “Privacy request” in the message. We aim to respond within 30 days, subject to identity verification and any lawful extension.