Privacy Policy

Debut Forge is a NexelStack product, run by Alexis Nardiello, an individual based in France. For the data of people who use Debut Forge to build pages ("customers"), Alexis Nardiello is the data controller. Contact for anything in this policy: alexisnardiello@gmail.com.

• Account: your name, email address and profile picture, from Google sign-in or the email you give for a sign-in link.
• Billing: your Stripe customer reference, plan, subscription status and credit balance. Stripe holds the card details; we never see them.
• Your content: the prompts you write, the pages generated for you, their versions, your chat history with the assistant, images you upload, and your published pages and custom domains.
• Technical data: a session cookie that keeps you signed in, your IP address (used briefly for rate limiting, see below) and standard server logs. We use no advertising or tracking cookies.

Pages our customers publish on debutforge.com or on their own domain are theirs. When you fill in a form on one of those pages, what you type is stored in the page owner's Leads inbox and emailed to them. The page owner is the controller of that data and decides what happens to it; we process it on their behalf, only to deliver it to them. To access or delete a submission, contact the page owner. If you cannot reach them, write to alexisnardiello@gmail.com and we will help.

We count page views without cookies: your IP address is used for a short time to limit repeated counts and abusive traffic, and only a daily total per page is stored. Published pages load their fonts from Google Fonts and may show stock photos served by Pexels, so those services receive your IP address when the page loads.

• Running the service you signed up for — your account, pages, publishing, forms, credits and billing: performance of our contract with you.
• Security and abuse prevention — rate limits, spam filtering, server logs: our legitimate interest in keeping the service available and safe.
• Anonymous site statistics on this website: our legitimate interest in knowing which pages are read. No cookie is set for it.
• Invoices and accounting records: legal obligation.

We do not sell your data. These providers process it for us, each only to provide their service:

• Stripe — payments and invoices: your email, name, billing details and payment method.
• Anthropic (our AI provider) — your prompts and the parts of your page being generated or edited. Never your name, email or payment details. Do not put sensitive personal information in prompts.
• MongoDB Atlas — our database, hosted in the EU (Frankfurt): your account, content, and form submissions.
• Vercel — hosting and cookieless website analytics: every request, including IP addresses, passes through it.
• Upstash — rate limiting: short-lived counters keyed by IP address.
• Resend — email delivery: your address, sign-in links, billing and lead notification emails (which contain the submitted form data).
• Google — sign-in, if you choose Continue with Google; and fonts on published pages.
• Pexels — stock photo search: the search terms you type. Photos you pick are served from Pexels.

Several of these providers are based in the United States. Transfers to them rely on the EU–US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses otherwise.

• Your account and content: for as long as the account exists. Deleting a project removes its page, versions and chat history straight away.
• Form submissions: until the page owner deletes them or deletes their account.
• Published pages go offline 7 days after a subscription ends; the project itself stays in your account until you delete it.
• Rate-limit counters: minutes to a day. Server logs: a few days to weeks, per Vercel's retention.
• Invoices and payment records: as long as French accounting law requires (up to 10 years), held by Stripe and by us.

Go to Dashboard → Settings → Delete Account. It cancels your Debut Forge subscription and immediately deletes your account, sessions, projects, published pages, custom domains, form submissions and view counts. Records we must keep by law (invoices) are the only exception.

Under the GDPR you can ask to access, correct, delete or export your data, to restrict or object to its processing, and to withdraw any consent you gave. Most of this you can do yourself in the app; for the rest, email alexisnardiello@gmail.com. We answer within one month.

You also have the right to complain to a data protection authority — in France, the CNIL (cnil.fr).

Debut Forge is not meant for anyone under 16, and we do not knowingly collect their data.

If this policy changes in a way that matters, we will say so by email or on this site before it takes effect. The date at the top is the current version.