Privacy policy

Last updated 6 October 2026

The short version: we read the public pages of a storefront you own, and we never touch your customers.

What we never collect

This comes first because it is the point of the design.

• We do not read your orders, your customers or your database.
• We do not sign in as one of your customers. The account page is scanned signed out.
• We do not place anything on your storefront that watches your visitors. Our companion plugin adds no script at all.

What we do collect

• Your email address, to sign you in and to send you the report.
• The storefront addresses you added and the proof that you own them.
• The rendered structure of your public pages, screenshots of the elements a rule fired on, and the findings themselves.
• Billing records, held by the merchant of record. We never see your card.

The site assistant

When you use the site assistant (“Ask AI”), the question you type goes to our API with the name of the website you are on and a reference to the earlier part of the conversation. Our API passes it on, through Cloudflare’s AI Gateway, to OpenAI, L.L.C. in the United States, whose model writes the answer from our documentation. OpenAI keeps the conversation (your questions and its answers) for 30 days, as it does by default, so that the next question can build on it, and keeps its abuse-monitoring logs for up to 30 days, longer only where the law requires it or where OpenAI needs it to protect its services. Our API does not keep your questions or the answers: it counts the requests from your IP address for about a minute, to limit abuse, and keeps a count of all questions per day for two days. Our API’s own code writes neither your question nor the answer to its logs: it writes, for an error from OpenAI, its status, type and code and, for another failure, a technical error text of up to 200 characters, from which we remove your question if the text repeats it; your IP address is written there only if the check that you are not a bot fails. These logs are kept for 7 days in Cloudflare’s dashboard and 30 days in a copy in our own storage (Cloudflare R2). The conversation is also kept in your browser, in the local storage of the website you are on: it is deleted when you open a page of that website more than an hour after your last message, and you can delete it at any time by clearing that website’s data in your browser. Please do not write personal or sensitive data in the assistant. On every page that has the assistant, whether or not you open it and whatever you chose in the cookie banner, Cloudflare Turnstile runs invisibly when the page loads and receives your IP address and technical details of your browser to check that you are not a bot. We offer the assistant, and protect it with that check, on the basis of our legitimate interest in answering questions about our products.

Cookies and tags

This site sets the cookies it needs to sign you in, and one called forge_consent that remembers your cookie choice for about six months. It also loads these third-party tags and scripts:

• Meta Pixel: records page views and, when you click a link to download a free plugin, a PluginDownload event that names the plugin and the page you were on. Meta receives your IP address, browser details and its own cookies (_fbp, _fbc).
• Cloudflare Web Analytics (inclusiveforge.com): counts page views and measures how fast our pages load, without cookies and without building a profile of you; Cloudflare does not use your IP address or browser details to identify you for this. Cloudflare adds this script to our pages itself.

When they load. If your browser reports a European time zone, or one we cannot place, such as UTC, the Meta Pixel is not loaded and no analytics or advertising cookie is set until you choose “Accept all” in the cookie banner; if you choose “Reject”, it stays unloaded. Elsewhere the Meta Pixel loads when a page opens, and you can switch it off at any time with “Cookie settings” in the footer of every page. Cloudflare Web Analytics does not wait for your choice: it sets no cookie and builds no profile of you.

Meta Conversions API. When marketing cookies are allowed and you download a free plugin, our servers also send that same download event to Meta directly (server to server), with your IP address, browser user-agent, the page address and Meta’s cookie identifiers, so the event still counts if your browser blocks the pixel. Meta receives the browser event and the server event with the same event ID and counts them once. We send no name, email address or anything you typed.

Who processes it with us

Error monitoring (Sentry). We use Sentry, a service of Functional Software, Inc. in the United States, where our Sentry data is stored, to find and fix faults in our API. An error record is sent when a scheduled job fails or a request fails in a way our own error handling does not catch; it holds the error message and its technical stack trace, and either the name and schedule of the job or the method, the address and four headers (Content-Type, Content-Length, Accept and Origin) of the request. A performance trace is sent for about one request or scheduled job in ten; it holds the method (or the schedule), the address, the response status, the timing, the outside services called and the same four headers. Before anything is sent, our API removes the query string from every address and replaces with “[redacted]” any part of an address that looks like a UUID, an IP address, an email address or a long random token, the identifier of a purchase session, and the identifiers of customers’ calendars, sites and spreadsheets in the addresses of the outside services it calls; it does the same with web addresses, email addresses, IP addresses, UUIDs, bot tokens and product keys found in an error message. Our API does not send Sentry query strings, request bodies, cookies, credentials, your IP address, your browser identification (User-Agent), your country, time zone or language, user accounts or the lines of our API’s logs. Sentry itself may add an approximate place to a record, derived from the address of the Cloudflare server that ran our API, not from yours; Sentry is set not to store that address.

How long we keep it

Your rights

Ask us for a copy of what we hold, ask us to correct it, or ask us to delete it, by writing to [email protected]. We answer within thirty days, usually the same week.

Changes

If this policy changes in a way that affects what we do with your data, we email you before it takes effect rather than quietly re-dating the page.

Seller