Privacy Policy

Data We Collect

Information You Provide

• Contact forms: Name, email, company name, and message content
• Account registration (SilexBrain, Pubnode): Username, hashed password, billing info, and profile details
• Communications: Emails and support tickets you send us

Information Collected Automatically

• Google Analytics 4: Pages visited, traffic sources, device type, approximate location — only when analytics cookies are accepted
• Technical data: Anonymized IP, browser type, OS, language
• Cookies: Session identifiers and preferences — see our Cookie Policy

How We Use Your Data

• Service Delivery (Contract): Provide and maintain our hosting, SaaS, and digital services
• Communications (Legitimate Interest / Consent): Respond to inquiries and send service notifications
• Analytics (Consent): Google Analytics 4 for performance insights — only with your consent
• Marketing (Consent): Personalized ads and campaign measurement — only with explicit consent
• Legal Compliance (Legal Obligation): Comply with applicable laws and governmental requests
• Security (Legitimate Interest): Detect and prevent fraud, abuse, and security incidents

Google Analytics 4 & Consent Mode

Our websites use Google Analytics 4 (G-41RW4WTQW4) implemented with Google Consent Mode v2:

• Analytics tracking is disabled by default until you accept analytics cookies
• IP addresses are anonymized before Google processes them
• You can opt out anytime via our cookie preferences panel or the Google Analytics Opt-out Add-on
• We also use Google Tag Manager (GTM-W5XHC9SG) which itself does not collect personal data

Data collected via GA4 is subject to Google's Privacy Policy.

Data Sharing & Third-Party Processors

We do not sell, rent, or lease your personal data. We may share data only with:

• Service Providers: Vendors processing data on our behalf under strict data processing agreements (cloud hosting, payment processors, email providers)
• Analytics Partners: Google LLC — only with your consent
• Legal Requirements: When required by law, judicial order, or governmental authority
• Business Transfers: In a merger or acquisition, with prior notice to you

Third-Party Data Processors (Article 28 GDPR)

In accordance with Article 28 of the GDPR, we disclose the following sub-processors who may access or process personal data on our behalf. All sub-processors are bound by Data Processing Agreements (DPAs) and are obligated to implement appropriate technical and organizational security measures.

• Google LLC — Analytics and tag management (Google Analytics 4, Google Tag Manager). Processes anonymized usage data subject to your cookie consent. Data may be transferred to the United States under Standard Contractual Clauses. Privacy policy: policies.google.com/privacy.
• Stripe, Inc. — Payment processing for customers in the United States and globally. Stripe processes payment card data, billing address, and transaction details. Stripe is PCI DSS Level 1 certified and does not share payment data with us beyond what is necessary for settlement. Headquartered in San Francisco, CA, USA. Privacy policy: stripe.com/privacy.
• Stripe Payments Europe, Ltd. — Payment processing for customers in the European Economic Area (EEA). Regulated by the Central Bank of Ireland. Processes payment data under the same PCI DSS standards as Stripe, Inc. Data stays within the EEA where required by applicable law. Privacy policy: stripe.com/privacy.
• Lemon Squeezy LLC — Acts as Merchant of Record for eligible digital products and SaaS subscriptions. When Lemon Squeezy processes a transaction, they assume the role of data controller for payment data under applicable consumer protection laws, including GDPR and CCPA. Headquartered in the United States. Privacy policy: lemonsqueezy.com/privacy.
• Mercury Financial LLC (Mercury Bank) — Primary banking partner for corporate and wire transfer transactions with business clients. Processes business account and transaction data. Headquartered in San Francisco, CA, USA. Privacy policy: mercury.com/legal/privacy-policy.

We review and update this list whenever we engage a new sub-processor. You may request an up-to-date list of all sub-processors by contacting us at info@magforgecorp.com.

International Data Transfers

MAG FORGE HOLDINGS LLC is based in the United States. Transfers from the EEA are governed by Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, the EU-U.S. Data Privacy Framework.

Your Rights

GDPR Rights (EU/EEA/UK Residents)

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data
• Portability: Receive your data in a machine-readable format
• Restrict Processing: Limit processing under certain circumstances
• Object: Object to processing based on legitimate interests or for direct marketing
• Withdraw Consent: Withdraw at any time where processing is consent-based

CCPA Rights (California Residents)

• Right to Know: Categories and specific pieces of personal information collected
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: We do not sell personal information
• Non-Discrimination: We will not discriminate for exercising your rights

To exercise any right: info@magforgecorp.com. We respond within 30 days.

Data Retention

• Contact form submissions: 2 years from last interaction
• Account data: Duration of account plus 12 months after closure
• Analytics data: 14 months (GA4 default)
• Transaction records: 7 years (tax/accounting requirements)

Data Security

We implement industry-standard security measures including TLS/SSL encryption in transit, encrypted storage at rest, role-based access controls, and regular security audits. No method of transmission over the Internet is 100% secure, but we take every reasonable precaution.

Children's Privacy

Our Services are not directed to individuals under 16. We do not knowingly collect data from children. If you believe we have such information, please contact us immediately at info@magforgecorp.com.

Contact & Privacy Requests

EU residents may also lodge a complaint with their local data protection supervisory authority.