Privacy Policy

Quick read: WebForger is a hosting and site-building service operated on top of Cloudflare. We collect the information we need to run your account and to operate the platform, and we do not sell it. For visitors, leads and buyers on your WebForger-hosted site or store, you are the data controller and we are your processor under our Data Processing Addendum; for your own WebForger account, we are the controller. We comply with the New Zealand Privacy Act 2020. If you operate in Australia, the Australian Privacy Principles also apply to you on your own site.

1. Who is responsible for what data

WebForger plays two different privacy roles depending on whose data is in question:

• Your WebForger account. When you sign up, log in, complete the wizard, pay invoices, or contact support, WebForger (operated by Always Digital Limited, New Zealand, trading as HornTech) is the data controller. This policy describes how we handle that data.
• Visitors, leads and buyers on your hosted site. When someone visits a site we host for you, fills in your lead form, browses your blog, places an order in your store, creates a customer account, subscribes, buys or redeems a gift card, leaves a product review, saves a wishlist, or joins your loyalty or membership programme, you are the data controller for that information. This includes order details, names, email addresses, phone numbers, billing and shipping addresses and order history, which we store for you on Cloudflare infrastructure. We are a hosting and processing provider acting under our agreement with you and our Data Processing Addendum. You should publish your own privacy notice on your site that tells your visitors and buyers what you collect and why.

This double-layer arrangement is the same model used by hosting and e-commerce platforms generally. It matters because rights requests from your visitors and buyers go to you first, and we support you in answering them.

2. What we collect about you (the customer)

To operate your account we collect:

• Account information. Name, email, business name, phone (optional), country, the password hash for your login, and any profile details you add.
• Wizard and brief inputs. The information you provide while we generate your site (industry, service area, tone, target audience, content prompts, uploaded brand assets). These inputs are stored against your account so that you can iterate, regenerate and edit.
• Billing information. Invoice details, plan, currency, billing address, and the last four digits of your card or PayPal account identifier as returned to us by Stripe or PayPal. We do not store full card numbers; those stay with Stripe.
• Store and payout status. If you sell through your site, the identifier of your Stripe account, its verification and payout status as reported to us by Stripe, any Stripe API keys you give us (stored encrypted), and your store settings. Your bank details and identity documents for payouts are collected by Stripe directly, not by us.
• Support and communication records. Emails to hello@webforger.ai, dashboard chats, and notes from calls or onboarding sessions.
• Service logs. Login timestamps, IP addresses for the dashboard, dashboard actions (publishing, regenerating, domain connect), and platform errors. Used for security, debugging, abuse prevention and capacity planning.
• Cookies and analytics on webforger.ai. Strictly-necessary cookies for login, plus first-party analytics to understand how prospects find and use the marketing site. We discuss this in section 8.

3. Why we collect it (lawful basis)

We collect the information above to:

• provide the service you signed up for (build, host, edit, publish your site) and to invoice you for it; this is necessary for the contract between us;
• keep the platform secure, prevent fraud and abuse, comply with our hosting and payment partners, and improve the product; this is our legitimate interest as a hosting provider, balanced against your rights;
• respond when you contact us, send service announcements, and (only if you opt in) send product updates and tips.

We do not sell your personal information, we do not rent your contact list, and we do not use your wizard inputs or content to train external AI models for unrelated parties.

4. AI-assisted drafting

WebForger uses large language models and image models to help you draft pages, blog posts, brand copy and imagery. The customer directs the prompts and decides what to publish; the customer is the publisher of the resulting site. Inputs and outputs pass through third-party AI providers operating under commercial agreements with us; those providers process the data on our behalf and do not own or train on the output. Specific vendor names are confirmed to account holders on written request, under confidentiality, as described in our Data Processing Addendum. Treat AI assistance the way you would treat a copywriter: useful, fast, and your responsibility before it goes live.

5. Cloudflare and our infrastructure

Your site is hosted on the Cloudflare network. When a visitor opens your site, Cloudflare receives the request, applies caching, security and performance rules, and serves the response. Cloudflare necessarily processes the visitor's IP address, request headers, geolocation derived from IP, and similar technical metadata to deliver the page and to defend against attacks. This processing is governed by Cloudflare's privacy policy; we do not see, and do not retain, raw visitor IP addresses for hosted sites beyond what is needed for security incidents.

Static content for your site (HTML pages, images, configuration) is stored in Cloudflare R2 object storage, and store records (products, orders, buyer accounts, balances and reviews, including buyers' names, contact details and addresses) are stored in Cloudflare D1 databases. Our primary R2 storage and D1 databases are currently located in Cloudflare's Oceania region. Cloudflare's network is global and your data may be cached at edge locations worldwide; for personal data, we rely on Cloudflare's standard contractual safeguards for cross-border transfer.

6. Other subprocessors

Beyond Cloudflare, we use a small set of vendors to operate the service:

• Third-party AI providers. Text and image generation for the wizard and editor, and screening of lead-form submissions for spam where spam filtering is enabled for a site.
• Payment processors. Card and PayPal billing for your WebForger plan, and Stripe for payments your buyers make in your store. Store payments are processed on your own Stripe account; card details go directly to Stripe and never pass through WebForger.
• Email delivery providers. Account, login and lead-form notifications, order and store emails, and the marketing emails you send to your buyers through the platform (such as abandoned checkout reminders, campaigns and membership notices).
• Analytics. Google Analytics on webforger.ai, and on hosted sites where it has been set up for the site, as described in section 8.

Our infrastructure, payment, email and analytics vendors are named at /subprocessors/. AI providers are listed there by category and are identified to account holders on written request under our Data Processing Addendum. We will give 14 days' notice in the dashboard before adding a new subprocessor that materially affects how we process your data.

7. Your rights and choices

Under the New Zealand Privacy Act 2020 you have the right to ask us for a copy of the personal information we hold about you (IPP 6) and to ask us to correct anything that is wrong (IPP 7). If you operate in Australia, the equivalent rights under APP 12 and APP 13 apply. If you are based in the EEA or the UK, GDPR rights to access, rectify, erase, restrict, port and object also apply where they are not displaced by our legitimate interest in operating and securing the service.

You can:

• Update most account fields directly in the dashboard.
• Request a copy of your account record by emailing privacy@webforger.ai; we aim to respond within 20 working days.
• Close your account at any time. We retain billing records as required by tax law and may keep abuse-related records for security.
• Unsubscribe from marketing emails using the link at the foot of every marketing message; transactional emails (login, billing, security) cannot be turned off while you have an active account.

8. Cookies and analytics

On the webforger.ai marketing site and dashboard we use:

• Strictly-necessary cookies for login, CSRF protection and session continuity. The service does not work without them.
• Analytics cookies set by our first-party analytics on webforger.ai. We use them to understand which content and channels work; we do not use them to build cross-site advertising profiles.
• Conversion cookies set when you arrive from one of our paid campaigns, so we can tell whether a campaign worked. They do not identify you and are not used to build cross-site advertising profiles.

On your hosted site. Your site runs WebForger's own first-party analytics by default. It counts page views and sessions using random identifiers kept in the visitor's browser storage, not cookies, and the results are stored on Cloudflare for your reports. When a visitor arrives from a Google Ads click, your site also keeps the ad click identifier in a first-party cookie for up to 90 days, so that a later enquiry or order can be attributed to that click. Your site records standard conversion events (for example, form submissions, add to cart, checkout started and purchase) in a data layer that the analytics and advertising tags connected to your site can read.

Google Analytics 4 is added to a hosted site when it is set up from the Marketing settings in your dashboard, by you or by our team as part of a managed build; we can create the property under a WebForger-managed Google Analytics account. Advertising and tag manager tags are added only when you, or our team at your request, enter them in your Marketing settings. You can remove Google Analytics or any advertising tag yourself in Marketing settings, and we do not add it back automatically. To switch off WebForger's first-party analytics for your site, contact us. We process this data as your processor, for your reporting and advertising measurement. As the operator of the site, you are responsible for telling your visitors about these technologies in your own privacy notice, for any consent your visitors are entitled to under their local law, and for any additional tags you add yourself.

9. Retention, breaches and contact

Retention. Account and content records are kept for as long as your account is active and for up to 24 months after closure to support reactivation, dispute resolution and tax compliance. Service and security logs are kept for up to 12 months. Billing records are kept for the period New Zealand tax law requires (currently seven years). Records we hold for you about your visitors, leads and buyers are covered by our Data Processing Addendum and are not kept beyond these periods unless the law requires it.

Security incidents. If a notifiable privacy breach occurs (one likely to cause serious harm), we will notify the New Zealand Office of the Privacy Commissioner and affected customers without undue delay, in line with the Privacy Act 2020. If you are an EEA or UK data subject, we will also follow GDPR notification timelines where they apply.

Contact. Privacy questions, access requests, breach notifications: privacy@webforger.ai. General contact: hello@webforger.ai. Postal: Always Digital Limited (trading as HornTech / WebForger), Auckland, New Zealand. If you are not satisfied with our response, you can complain to the New Zealand Office of the Privacy Commissioner (privacy.org.nz).

Document version: 1.1, 22 October 2026 (processor role extended to store, order and buyer data; hosted-site analytics, conversion events and ad click attribution described; payment, email, AI and analytics vendor descriptions updated). Previous version: 1.0, 29 April 2026.