Your prompts are not stored.

Who we are

Two GDPR roles, one policy

AxForge is operated in the EU, with infrastructure in Sweden and Spain. Contact for privacy matters: hello@axforge.ai, subject PRIVACY.

AxForge acts in two GDPR roles, and this policy is structured around them: controller for the data we decide to process about you (this website, your account, billing, support, security) and processor for the content customers send through the API or run on rented machines. The two are kept apart: website analytics never touches customer AI data.

Controller

Website and account analytics

On axforge.ai

AxForge runs its own first-party analytics. When you visit, our servers receive the page path (without query parameters), the page title, the referring site, the first-touch acquisition channel (a bucket such as a Google Ads campaign, a UTM source, a referring domain or "direct"), any Google Ads click identifier and campaign parameters present on the landing URL, clicks on buttons and calls to action (recorded as conversion events such as "check availability" or "API access"), a random visitor identifier stored in the axf_vid cookie, a per-tab session identifier, and the country derived from your IP address. The IP address itself is not stored. This data stays on AxForge infrastructure and is not shared. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in understanding how the site is used and which channels bring customers. Every identifier and its lifetime is listed on the cookies page.

Google Ads and Google Analytics, with your consent only

Google's tag (Google Ads and Google Analytics 4) is loaded on every page with Consent Mode set to denied. If you accept the cookie banner, Google sets its advertising and analytics cookies and receives page views and conversion events for ad measurement and site analytics, under Google's own terms. If you reject, or make no choice, Google sets no cookies; Consent Mode may still send cookieless signals to Google. You can change your choice at any time by clearing this site's data in your browser.

Account activity

When you create an account, we keep the account data you give us (name, work email, company) and the records the service produces: sign-in events, console actions, bookings, balance and top-up records, usage measurements and API request metadata. After you sign in, the visitor identifier from this website is linked to your account so that we can see which pages led to a signup or booking. Legal basis: contract (Art. 6(1)(b)) for providing the service, legitimate interest (Art. 6(1)(f)) for security, abuse prevention and understanding acquisition, legal obligation (Art. 6(1)(c)) for accounting records.

Site Guide and support

Messages you type into the Site Guide chat on this website are sent to the AxForge API to be answered and are stored as conversation records; support email is stored as support records. Please do not enter personal data you would not want kept for the support-record period.

Operational logs

Security and access logs are kept for security and abuse prevention. Retention for every category is in the retention table.

Recipients

Controller-side data reaches only: Hetzner Online GmbH (EU edge hosting, Germany); Atom9 (console sign-in identity provider, Sweden: name, email and sign-in events only, never prompts or inference data); Stripe Payments Europe, Limited (payment processing, Ireland: card details are entered on Stripe-hosted pages and never reach AxForge); and, only with your consent, Google (Google Ads and Google Analytics). The processors are listed in the subprocessor register, which carries its change history and 30-day advance notice of any addition. No data is sold, and no customer lists are shared for marketing.

Your rights

Access, rectification, erasure, restriction, portability and objection: write to hello@axforge.ai. You may complain to your EU supervisory authority.

Processor

Customer AI data

For prompts, completions, uploaded context, API request metadata, everything a customer stores or runs on a rented machine, and any personal data inside that content, the customer is the controller and AxForge processes only on the customer's documented instructions. Each API request, and each rental the customer operates, is that instruction. The terms are in the Data Processing Agreement.

Customer data is not used to train models. Customer content is never used to train, fine-tune or evaluate any AxForge model. There is no exception to this.

Prompts and completions

Text you send to the serverless API, and the responses, are processed in memory in Stockholm, Sweden (eu-se-1) for the duration of the request and are not written to disk, not logged, and not retained.

Dedicated GPU rentals

Data on a rented machine in Málaga, Spain (eu-es-1) is under the customer's control for the rental period. When the rental ends, the machine and all data on it are deleted. AxForge does not access the contents of a rented machine except as necessary to provide the service, to address security or abuse, or as required by law.

API request metadata

Operational metadata: timestamps, token counts, model name, status codes (for billing, capacity and abuse prevention). This metadata contains no prompt or completion content.

Visitors who write to a customer's AI assistant

When you write to an AI assistant that a customer has put on their website, the conversation is the customer's data, as above. To keep the service safe, AxForge also checks what you write: a message that tries to override the assistant, is sexual, or asks for help with something illegal or dangerous is flagged, and you are told so. What was flagged is kept for a security review for 90 days, then deleted. After three flagged messages in a day, the assistant stops answering you for the rest of that day. You are recognised by your browser, or by a scrambled code made from your network address with a secret key (the address itself is never stored), and that code is deleted after 30 days. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in keeping the service safe and preventing its misuse.

Where

Where processing happens

eu-se-1 · Stockholm for serverless inference and RTX 3060 rentals, eu-es-1 · Málaga for dedicated DGX Spark workloads. Platform and control services run on EEA infrastructure; network traffic terminates on infrastructure operated for us by Hetzner Online GmbH (Germany).

Customer AI data: no international transfers. Nothing processed under the Data Processing Agreement leaves the EEA, and there is no failover outside the EEA: if all EEA capacity is unavailable, requests queue or fail; they are never routed outside the EEA.

Controller-side data: payment data is processed by Stripe Payments Europe, Limited (Ireland) under Stripe's own transfer safeguards for its intra-group processing; Google Ads and Google Analytics data, only with your consent, is processed by Google under Google's own terms and transfer safeguards.

Cookies and browser storage

Two first-party cookies on axforge.ai (axf_vid, axf_src), the console session cookie after sign-in, browser storage for your consent choice and the Site Guide chat, and, only with your consent, Google's advertising and analytics cookies. The complete list, with lifetimes, is on the cookies page.

Related

Where the details live

Questions: hello@axforge.ai · Version 1.0 · Effective 2026-09-04 · Last reviewed 2026-09-04 · Change log: 2026-09-04, version 1.0: website and account analytics described as implemented (first-party beacon, Google Ads/Analytics with consent, account linking, Site Guide); customer AI data section covers dedicated GPU rentals; recipients and transfer positions updated. 2026-08-26: restructured into controller and processor roles, added the transfers position and trust-page links.