GDPR Compliance
Last updated 16 October 2026
1. Data controller
For the purposes of the GDPR, the data controller for personal data processed through avakode.com and the Forge Suite plugins is:
Tigran Avakov, a self-employed individual, Mirzo-Ulugbek 45A, 100007 Tashkent, Uzbekistan
Contact for privacy matters: [email protected]
2. Who this page is for
This page is aimed at:
- End customers who purchase Forge Suite licenses from inside the EU/EEA, the UK, or Switzerland
- Website visitors located in those regions
If you operate a WordPress site that uses Forge Suite plugins and that site collects data from EU residents, you are the data controller for that visitor data — not Avakode. The plugins store that data in your own WordPress database. You are responsible for your own site’s GDPR compliance. What our API receives from the plugins on your site is described in sections 2 and 3 of our Privacy Policy.
3. Your rights under GDPR
As a data subject under the GDPR, you have the following rights in relation to personal data we hold about you:
3.1 Right of access (Article 15)
You can request access to the personal data we hold about you.
3.2 Right to rectification (Article 16)
If any of the data we hold about you is inaccurate or incomplete, you can ask us to correct it.
3.3 Right to erasure / “right to be forgotten” (Article 17)
You can ask us to delete your personal data, subject to legal retention requirements (see section 7 of our Privacy Policy).
3.4 Right to restrict processing (Article 18)
You can ask us to limit how we use your data in certain circumstances — for example, while a dispute about accuracy is being resolved.
3.5 Right to data portability (Article 20)
You can request your personal data in a machine-readable format to transfer it to another service.
3.6 Right to object (Article 21)
You can object to processing based on legitimate interest.
3.7 Right not to be subject to automated decision-making (Article 22)
We do not make any decisions that have legal or similarly significant effects on you based only on automated processing. A few fixed rules run on their own to limit abuse; they are described in section 9 of our Privacy Policy.
3.8 Right to withdraw consent (Article 7(3))
Where we rely on consent to process your data (for example, optional product announcements), you can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
3.9 Right to lodge a complaint (Article 77)
You have the right to lodge a complaint with a supervisory authority — typically the data protection authority in the EU/EEA country where you live or work. A list is maintained by the European Data Protection Board at edpb.europa.eu.
4. How to exercise your rights
To exercise any of these rights, email [email protected]. We respond within 30 days, free of charge. If a request is complex, or you send us many, we may take up to two more months; we tell you so, with the reason, within the first 30 days.
The rights are listed in section 9 of our Privacy Policy.
5. Legal bases for processing
We process personal data under the following legal bases:
| Activity | Legal basis | Article |
|---|---|---|
| Creating and managing your Avakode account | Performance of a contract | Art. 6(1)(b) |
| Processing payments and issuing invoices | Performance of a contract, legal obligation | Art. 6(1)(b), 6(1)(c) |
| License verification | Performance of a contract | Art. 6(1)(b) |
| Routing AI requests to providers | Performance of a contract | Art. 6(1)(b) |
| Responding to support requests | Performance of a contract | Art. 6(1)(b) |
| Security and abuse detection | Legitimate interest | Art. 6(1)(f) |
| Tax records and accounting retention | Legal obligation | Art. 6(1)(c) |
| Optional product announcements, newsletters | Consent | Art. 6(1)(a) |
| Advertising measurement (Meta Pixel and Conversions API) | Consent — if your browser reports a European time zone, or one we cannot place, such as UTC, the Meta Pixel loads only after you accept | Art. 6(1)(a) |
| Answering the questions you put to the site assistant, and protecting it from bots (Cloudflare Turnstile) | Legitimate interest | Art. 6(1)(f) |
| Counting page views and measuring page load speed (Cloudflare Web Analytics: no cookies, no visitor profiles, your IP address is not used to identify you) | Legitimate interest | Art. 6(1)(f) |
6. International transfers
Where your personal data may be transferred outside your country, and what we rely on for those transfers, is described in section 6 of our Privacy Policy.
7. Sub-processors
The following third parties may process personal data on our behalf. Paddle is listed as well, but it acts as an independent controller, not on our behalf:
| Sub-processor | Role | Jurisdiction |
|---|---|---|
| Paddle (Paddle.com Market Limited; Paddle.com Inc. in the United States; Paddle.com (Canada) Ltd. in Canada) | Merchant of record and independent controller under its own privacy notice: payment processing, tax invoicing, refunds | United Kingdom / United States / Canada |
| Freemius Inc. | Payment processing and license management for purchases made before September 2026 | United States / EU |
| Cloudflare, Inc. | API hosting (Workers, D1, KV, CDN); AI Gateway (passes requests to OpenAI); Web Analytics on our websites (page views and page load speed, no cookies) | Global |
| Hostinger International Ltd. | Marketing-site hosting | European Union |
| OpenAI, L.L.C. | AI text generation for the AI features of the Forge Suite plugins (for example translations, SEO suggestions, form generation and the explanation of Guard Forge security events) and answers in the site assistant | United States |
| Google LLC | OAuth for Sheets / Calendar integrations | United States / EU |
| Meta Platforms Ireland Ltd. / Meta Platforms, Inc. | Meta Pixel and Conversions API: advertising measurement and plugin-download events (subject to your cookie choice) | Ireland / United States |
| Meta (WhatsApp Cloud API) | Delivering form notifications to your WhatsApp number (Fillin Forge Pro), only if you turn on this integration | Ireland / United States |
| Telegram Messenger Inc. | Delivering form notifications to your Telegram chat (Fillin Forge Pro), only if you turn on this integration | Several countries |
| Mailchimp (Intuit Inc.) | Adding the person who submitted a form to your Mailchimp audience (Fillin Forge Pro), only if you turn on this integration | United States |
| HubSpot, Inc. | Creating a contact, and a deal if you choose, in your HubSpot account (Fillin Forge Pro), only if you turn on this integration | United States |
| Resend, Inc. | Sending our transactional email | United States |
| Functional Software, Inc. (Sentry) | Error monitoring of our API (error records and performance traces) | United States |
Services you connect yourself (Mailchimp, HubSpot, Google Sheets and Google Calendar) handle the data under their own terms. Telegram notifications are sent through our own bot, and Telegram handles them under its own terms. The recipients of personal data are listed in section 5 of our Privacy Policy.
8. Data retention
Specific retention periods are detailed in Section 7 of our Privacy Policy.
9. Children
Forge Suite is a professional product intended for users aged 16 and older. We do not knowingly process personal data of children under 16. If you believe we have done so inadvertently, contact us and we will delete the data.
10. EU representative
Avakode currently does not have an appointed EU representative under Article 27 GDPR. EU and EEA residents can reach us directly by email at [email protected] for any privacy-related request. We treat inquiries from EU residents with the same priority as requests from any other jurisdiction.
11. Data breach notification
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected individuals, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by Article 33 GDPR, and will notify affected users without undue delay where required by Article 34.
12. Cookies
We use strictly-necessary first-party cookies for sign-in and security, and advertising cookies (Meta). If your browser reports a European time zone, or one we cannot place, such as UTC, the Meta Pixel is not loaded and no analytics or advertising cookie is set until you choose “Accept all” in the cookie banner; if you choose “Reject”, it stays unloaded. Elsewhere the Meta Pixel loads when a page opens, and you can switch it off at any time with “Cookie settings” in the footer of every page. Cloudflare Web Analytics does not wait for your choice: it sets no cookie and builds no profile of you. Details are in section 3.8 of our Privacy Policy.
13. Contact for privacy matters
All privacy-related questions, requests, and concerns should be directed to:
Email: [email protected]
Postal: Tigran Avakov, a self-employed individual, Mirzo-Ulugbek 45A, 100007 Tashkent, Uzbekistan
14. Changes to this page
We may update this GDPR compliance page from time to time. When we make material changes, we will notify active customers by email and post a notice on avakode.com at least 30 days in advance. The “Last updated” date at the top always reflects the most recent revision.