Legal
Privacy Policy
Effective 6 July 2026 · Version 1.1
This Privacy Policy explains how [registered company name] (“we”, “Magwise”) collects and uses personal data when you use The Forge — AI Listing Builder for eMAG (the “Service”). We are the data controllerfor that data under Regulation (EU) 2016/679 (“GDPR”) and Romanian Law no. 190/2018. This policy should be read with our GDPR & Data Protection page, which sets out your rights and our subprocessors in detail.
Who we are
Controller: [registered company name], registered in Romania (reg. no. [trade register no. J../..], VAT [CUI / VAT ID]), [registered address, Romania]. Privacy contact: calin@magwise.ro. We have assessed that we are not required to appoint a Data Protection Officer under Article 37 GDPR; the address above is our contact point for all data-protection matters.
Data we collect
- Account data — your email address and authentication credentials (stored hashed by our auth provider).
- Billing data — your plan, credit balance, invoicing details (name or company, address, VAT number) and transaction history. Card details are entered directly into Stripe's hosted fields and never reach our servers; we never see or store full card numbers. VAT numbers you enter are sent to the European Commission's VIES service to confirm they are valid, and the outcome is stored as evidence for the tax treatment applied to your invoice. Your billing details and VAT number are also passed to Stripe, from which our accounting provider Oblio issues the fiscal invoice.
- Content you submit — product identifiers, product data, uploaded images, brand assets, and prompts, together with the images and copy generated from them.
- Usage & technical data — generation logs, credit transactions, timestamps, IP address, browser/device information, and error diagnostics.
- Cookies — strictly necessary cookies used to keep you signed in (see “Cookies” below).
How and why we use your data
We process personal data only where we have a legal basis under the GDPR:
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the Service — accounts, generating listings, storing your results | Performance of a contract (6(1)(b)) |
| Processing payments and preventing fraud | Contract (6(1)(b)) & legal obligation (6(1)(c)) |
| Securing, maintaining, and improving the Service | Legitimate interests (6(1)(f)) |
| Complying with tax, accounting, and legal duties | Legal obligation (6(1)(c)) |
| Sending service and transactional emails | Contract (6(1)(b)) |
| Optional product updates or marketing, where sent | Consent (6(1)(a)) — withdrawable anytime |
AI processing of your content
To generate listings, the content you submit (product data and images) is sent to our AI provider, Google, via the Gemini API, which returns generated images and text. We instruct our providers to process this content only to deliver results to you. We do not sell your content, and we do not use your content to train our own models. The Service does not carry out solely automated decision-making producing legal or similarly significant effects about you within the meaning of Article 22 GDPR. Where the content you submit contains personal data of third parties (for example, a person shown in an image), you are responsible for having a lawful basis to provide it to us.
Sharing & subprocessors
We do not sell personal data. We share it only with service providers (“subprocessors”) that help us run the Service, each bound by a data-processing agreement:
| Provider | Purpose | Location |
|---|---|---|
| PlanetScale | Database hosting (accounts, listings, credits, orders) | European Union |
| Cloudflare R2 | File/image storage (generated images and uploaded product photos) | European Union |
| Google (Gemini API) | AI generation of listing images and copy from your inputs | United States |
| Stripe | Payment processing for credit packs (card, Apple Pay, Google Pay, Link) | EU / United States |
| Oblio Software SRL | Issuing fiscal invoices from completed Stripe payments | European Union (Romania) |
| European Commission (VIES / TEDB) | Validating EU VAT numbers and retrieving official VAT rates for invoicing | European Union |
| Vercel | Application hosting and content delivery | United States |
| Meta Platforms Ireland | Advertising measurement (Meta Pixel): page views, sign-ups, first use and purchases, to measure which adverts work | European Union / United States |
| Google (Analytics & Ads) | Website analytics and advertising measurement: page views, sign-ups, first use and purchases | European Union / United States |
We may also disclose data where required by law, or to protect our rights, safety, or property.
Cookies
We use only strictly necessary cookies to keep your session authenticated. Under the ePrivacy Directive (2002/58/EC) and Romanian Law no. 506/2004, such cookies are exempt from the consent requirement because they are essential to a service you have requested. We do not currently use advertising or non-essential analytics cookies; if that changes, we will ask for your consent first.
International transfers
Some of our subprocessors are located outside the European Economic Area, including in the United States. Where data is transferred outside the EEA, we rely on appropriate safeguards under Chapter V GDPR, such as the European Commission’s Standard Contractual Clauses. See the GDPR page for details.
Data retention
We keep account and content data for as long as your account is active. After you close your account, we delete or anonymise your content within a reasonable period, except where we must retain certain records (for example, invoices for tax purposes, retained for the period required by Romania law).
Security
We use encryption in transit, access controls, and reputable infrastructure providers to protect your data, as required by Article 32 GDPR. No system is perfectly secure, but we take technical and organisational measures appropriate to the risk.
Your rights
Under the GDPR you have rights to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to withdraw consent. Our GDPR & Data Protection page explains each right and how to exercise it, and how to complain to a supervisory authority.
Children
The Service is not directed to children and is intended for business use. We do not knowingly collect data from anyone under 18.
Changes
We may update this policy; we will post the new effective date and, for material changes, notify you by email or in-app.
Contact
Privacy questions: calin@magwise.ro.