Privacy Policy

This Privacy Policy explains how HLDForge ("we", "us", or "our") collects, uses, discloses, and protects personal information when you access or use our web application, APIs, marketing website, and related services (collectively, the "Service").

By creating an account, accessing workspaces, or using HLDForge, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our data practices, please do not access or use the Service.

Account & Identity Information: When you register for an account or are invited to a workspace, we collect your name, email address, password hash, and optional profile details (such as company name, role, and avatar).

Customer Content & Architecture Data: We process and store the content you create, upload, or collaborate on within HLDForge. This includes architecture diagrams, node metadata, edge connections, documentation notes, comments, version histories, and workspace configurations.

Billing & Payment Information: For paid subscription plans, transactions are handled directly by our certified third-party payment processors (such as Stripe). HLDForge does not store full credit card numbers, CVVs, or bank account credentials on our servers. We receive only transaction confirmations, subscription statuses, billing identifiers, and the last four digits of the payment method.

Usage & Technical Telemetry: To maintain stability, secure accounts, and optimize performance, we automatically log standard technical data including IP addresses, browser types, operating systems, referring URLs, timestamps of actions, and aggregated feature interactions.

Cookies & Essential Local Storage: We use strictly necessary cookies and local storage tokens to maintain authenticated sessions, preserve user interface preferences (such as canvas layout and color theme), and defend against cross-site request forgery (CSRF). We do not deploy third-party advertising tracking cookies or data broker trackers.

To Provide and Maintain the Service: Delivering real-time architecture canvas editing, collaboration sync, document versioning, diagram exports, and workspace administration.

To Power AI Architecture Features: Processing diagram structure and prompts that you voluntarily submit to ArchitectAI to return architecture suggestions, component recommendations, and resilience analysis.

To Communicate with You: Sending essential account confirmations, security notices, administrative updates, and transactional receipts. We do not sell your contact details to third-party advertisers.

Security & Abuse Prevention: Monitoring for anomalous activities, unauthorized access attempts, system abuse, and verifying compliance with our Terms of Service.

Legal Compliance: Satisfying applicable statutory, regulatory, or legal process obligations.

When you choose to use our AI-assisted architecture features (ArchitectAI), the relevant diagram schema and prompt text are transmitted securely to our authorized enterprise AI API providers solely for the transient purpose of generating the requested output.

Strict No-Training Commitment: We do not use your proprietary customer content, system designs, private diagrams, or prompts to train, retrain, or improve public foundation models. Our agreements with AI infrastructure partners explicitly prohibit the use of customer API payloads for public model training.

AI outputs are generated algorithmically and are provided solely for conceptual and design assistance. You are responsible for reviewing and verifying all generated architecture designs prior to implementation.

No Sale of Personal Data: We never sell, rent, lease, or monetize your personal information or architectural designs to data brokers or third parties.

Trusted Subprocessors: We share data only with third-party service providers who assist us in operating the platform—such as enterprise cloud hosting, managed database infrastructure, transactional email delivery, and payment processing. All subprocessors are bound by written data protection and confidentiality agreements.

Legal & Safety Disclosures: We may disclose information if required to do so by law, valid subpoena, court order, or in the good-faith belief that disclosure is necessary to protect the security, integrity, or legal rights of HLDForge, our users, or the public.

Business Transfers: In the event of a merger, acquisition, reorganization, or sale of company assets, customer information may be transferred as a business asset, subject to the acquirer honoring the commitments of this policy.

We implement industry-standard technical and organizational security measures to protect customer data against unauthorized access, alteration, loss, or disclosure.

All communications between your browser and our servers are encrypted in transit using TLS 1.3. Customer data stored in databases and file caches is encrypted at rest using industry-standard AES-256 encryption.

Access to production systems is restricted according to the principle of least privilege and requires multi-factor authentication. While we implement robust security safeguards, no method of electronic storage or transmission over the Internet is 100% immune from compromise, and we cannot guarantee absolute security.

We retain customer content and workspace data for as long as your account remains active and in good standing.

You have the right to request deletion of your account and all associated workspace data at any time. When an account or workspace is closed, diagram data is queued for permanent purge, subject to a 30-day grace period during which you may export your data before irreversible deletion.

We may retain minimal anonymized transaction records or server audit logs where required to comply with statutory tax, accounting, or legal retention obligations.

Depending on your geographic location and applicable local laws, you may have specific rights regarding your personal information, including:

• The right to access and receive a copy of your personal data.

• The right to correct inaccurate or incomplete data.

• The right to request the deletion or erasure of your personal data ("right to be forgotten").

• The right to restrict or object to certain processing activities.

• The right to data portability (exporting your architecture diagrams in open formats such as JSON, SVG, or PNG).

To exercise any of these privacy rights, contact us directly at privacy@hldforge.com. We respond to verified requests within thirty (30) days without undue delay.

HLDForge operates digital cloud infrastructure. If you access the Service from outside our primary cloud server regions, your data may be transferred to, stored, and processed in jurisdictions where our servers and service providers reside.

Where required by applicable data protection laws, we utilize approved cross-border transfer mechanisms, such as standard contractual clauses (SCCs), to safeguard your personal data.

HLDForge is an enterprise engineering and software architecture tool designed for professional and educational use. The Service is not directed to individuals under sixteen (16) years of age, and we do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please notify us at privacy@hldforge.com so we can promptly delete it.

We may update this Privacy Policy from time to time to reflect modifications in our features, operational practices, or legal requirements. When updates occur, we will revise the "Last updated" date at the top of this page.

For material changes that significantly affect your rights, we will provide advance notice through the Service or via your registered account email.

If you have questions, feedback, or concerns regarding this Privacy Policy or our data handling practices, please contact our privacy team electronically at:

Email: privacy@hldforge.com

For general product and billing inquiries, our support team can also be reached at support@hldforge.com.