Privacy Policy

Last updated 6 October 2026

1. Who we are

Renew Forge is a product of Tigran Avakov, a self-employed individual, Mirzo-Ulugbek 45A, 100007 Tashkent, Uzbekistan. In this policy “we” and “Avakode” mean that entity.

2. What this policy covers

Personal data we handle when you visit renewforgewp.com, when you install the free plugin, when you buy and activate a Pro licence, and when you contact support. It does not govern the data your own store collects, which stays under your control and your own privacy policy — you are the controller of your customers’ data.

3. What never reaches us, and what this website loads

• Your customers’ data stays in your store. Subscriptions, orders, customers, the evidence journal and the reminder log are stored in your WordPress database. The free plugin makes no request to any other server.
• SMS goes from your store to your provider. If you switch on SMS reminders, your store sends the customer’s billing phone number and the message to your own Twilio or Vonage account, with your credentials. It does not pass through us. Your provider’s secret is stored encrypted in your WordPress options, with a key you keep in wp-config.php.

This website itself is not free of third parties. It uses:

• Fonts. The typefaces are served from this website itself, so loading a page makes no request to Google.
• The Meta Pixel. When it loads, it takes its script from Meta (connect.facebook.net), reports your page views to Meta and sets the _fbp cookie (90 days). If your browser reports a European time zone, or one we cannot place, such as UTC, the Meta Pixel is not loaded and no analytics or advertising cookie is set until you choose “Accept all” in the cookie banner; if you choose “Reject”, it stays unloaded. Elsewhere the Meta Pixel loads when a page opens, and you can switch it off at any time with “Cookie settings” in the footer of every page. Your choice is kept in the forge_consent cookie for six months.
• Cloudflare Web Analytics. Cloudflare adds this script to our pages itself. It counts page views and measures how fast our pages load; Cloudflare does not use your IP address or browser details to identify you for this. Cloudflare Web Analytics does not wait for your choice: it sets no cookie and builds no profile of you.
• Cloudflare Turnstile. The site assistant and our forms (Report a bug, and reporting an issue on a documentation page) are protected from bots by Turnstile (challenges.cloudflare.com). It loads on every page and gives Cloudflare your IP address and technical details of your browser for that check.
• A check for an Avakode account. Each page asks api.avakode.com whether this browser is signed in to an Avakode account — your browser sends the Avakode sign-in cookie with the request if it has one — so that the menu can show your dashboard instead of “Log in”. The answer is used for nothing else.

What you type is sent only when you send it. A report about a documentation page brings us the page address, the text you selected, your note and, if you give it, your email address. Report a bug brings us your email address, your subject and message, and the page’s address and title. Your light or dark theme and the assistant’s conversation on screen are kept in your browser’s local storage.

The site assistant. When you use the site assistant (“Ask AI”), the question you type goes to our API with the name of the website you are on and a reference to the earlier part of the conversation. Our API passes it on, through Cloudflare’s AI Gateway, to OpenAI, L.L.C. in the United States, whose model writes the answer from our documentation. OpenAI keeps the conversation (your questions and its answers) for 30 days, as it does by default, so that the next question can build on it, and keeps its abuse-monitoring logs for up to 30 days, longer only where the law requires it or where OpenAI needs it to protect its services. Our API does not keep your questions or the answers: it counts the requests from your IP address for about a minute, to limit abuse, and keeps a count of all questions per day for two days. Our API’s own code writes neither your question nor the answer to its logs: it writes, for an error from OpenAI, its status, type and code and, for another failure, a technical error text of up to 200 characters, from which we remove your question if the text repeats it; your IP address is written there only if the check that you are not a bot fails. These logs are kept for 7 days in Cloudflare’s dashboard and 30 days in a copy in our own storage (Cloudflare R2). The conversation is also kept in your browser, in the local storage of the website you are on: it is deleted when you open a page of that website more than an hour after your last message, and you can delete it at any time by clearing that website’s data in your browser. Please do not write personal or sensitive data in the assistant. On every page that has the assistant, whether or not you open it and whatever you chose in the cookie banner, Cloudflare Turnstile runs invisibly when the page loads and receives your IP address and technical details of your browser to check that you are not a bot. We offer the assistant, and protect it with that check, on the basis of our legitimate interest in answering questions about our products.

4. What we do receive

4.1 Licence checks. When you activate or release a Pro licence, once a day while a key is saved, and when the add-on is deactivated or deleted, it sends the licence key, the product name and your site’s address to api.avakode.com, to confirm the licence and release the site. Nothing about your customers is sent.

4.1a Update checks. Only while the licence is active, when WordPress checks for plugin updates (about twice a day), the add-on sends its own version, the version of the free plugin, the licence key and your site’s address to api.avakode.com — the key and the address in request headers, not in the address — and downloads an update from there when you install it. Nothing about your customers is sent.

4.2 Purchase data. Payments are processed by Paddle, our Merchant of Record, under the Paddle Buyer Terms; Paddle handles your payment details as its privacy policy describes. We receive your name, email, billing country and the transaction record. We never receive card numbers.

4.3 Support. If you write to us, we keep the message, your email address and anything you choose to attach. We do not ask for exports of your customers’ data.

4.4 Technical data. Our hosting provider records the usual request data: IP address, user agent, requested path and time. The notification form on this website (4.5) sends your request to our API, which runs on Cloudflare. The logs of our API hold the lines our own code writes about events in the API and the exceptions of its Worker; Cloudflare’s own log of each request to our API is switched off. Each line has a time, a level, an event name, a request identifier and a few facts, such as an HTTP status or a product name. Some lines hold personal data: a line about a failed bot check (Turnstile, section 3), which holds your IP address; a line about a licence email that could not be sent, which holds your email address; and a line about an error answer from an outside service such as our email or payment provider, which holds up to a few hundred characters of that answer. The logs are kept for 7 days in Cloudflare’s dashboard and 30 days in a copy in our own storage (Cloudflare R2).

Error monitoring (Sentry). We use Sentry, a service of Functional Software, Inc. in the United States, where our Sentry data is stored, to find and fix faults in our API. An error record is sent when a scheduled job fails or a request fails in a way our own error handling does not catch; it holds the error message and its technical stack trace, and either the name and schedule of the job or the method, the address and four headers (Content-Type, Content-Length, Accept and Origin) of the request. A performance trace is sent for about one request or scheduled job in ten; it holds the method (or the schedule), the address, the response status, the timing, the outside services called and the same four headers. Before anything is sent, our API removes the query string from every address and replaces with “[redacted]” any part of an address that looks like a UUID, an IP address, an email address or a long random token, the identifier of a purchase session, and the identifiers of customers’ calendars, sites and spreadsheets in the addresses of the outside services it calls; it does the same with web addresses, email addresses, IP addresses, UUIDs, bot tokens and product keys found in an error message. Our API does not send Sentry query strings, request bodies, cookies, credentials, your IP address, your browser identification (User-Agent), your country, time zone or language, user accounts or the lines of our API’s logs. Sentry itself may add an approximate place to a record, derived from the address of the Cloudflare server that ran our API, not from yours; Sentry is set not to store that address.

4.5 The notification list. If you ask, with the form on this website, to be told when the UK government publishes the regulations for its subscription rules, we keep your email address, the time you asked, the time you confirmed it and the times we sent you our emails, and two random codes: one in the link that confirms the address and one for the unsubscribe link. The list itself does not store your IP address or browser details; the logs of our API are covered in section 4.4. To stop abuse, the server counts the tries from one network for an hour, using a keyed hash of the IP address that cannot be turned back into it. We use the address to send the email that asks you to confirm it (again, if you ask again) and, once you have confirmed, one email when the regulations are published. Nothing else, and we pass it on only to the providers in section 6. The legal basis is your consent, which you can withdraw at any time. We delete a confirmed address 30 days after we send that one email; if the regulations are not published and that email is never sent, we delete the address on 31 December 2027. We delete an address you do not confirm 7 days after our last confirmation email. When you unsubscribe, we delete the address from our own systems at once. Copies in our backups are erased within 90 days. Every email we send you has an unsubscribe link: use it and we stop, with no need to write to anyone. You can also write to [email protected] and we will remove the address.

5. Why we handle it

To perform the contract with you (licences, updates, support), on the basis of legitimate interest (keeping the service secure and working), and to meet legal obligations (tax and accounting records). The Meta Pixel measures our advertising: if your browser reports a European time zone, or one we cannot place, such as UTC, on your consent; elsewhere on our legitimate interest in knowing which advertising works — Cookie settings switches it off either way. Cloudflare Web Analytics (section 3) rests on our legitimate interest in knowing how many people visit this website and how fast its pages load: it counts page views and measures page load speed, sets no cookie and builds no profile of you. The notification list (4.5) rests on your consent, which you withdraw by unsubscribing.

6. Who we share it with

• Paddle, for payments.
• Hostinger International Ltd., which hosts this website.
• Cloudflare, Inc., whose network sits in front of this website (DNS and CDN), which runs api.avakode.com and the licence server, which counts page views and measures page load speed with Web Analytics (section 3), which passes the site assistant’s requests on to OpenAI (AI Gateway), and which provides Turnstile.
• Meta, which receives what its pixel reports (section 3).
• OpenAI, L.L.C., which writes the answers in the site assistant and keeps the conversation for 30 days (section 3).
• Resend, which sends the emails we send you (4.5).
• Functional Software, Inc. (Sentry), which monitors our API for errors (section 4.4).

We do not sell personal data. Meta, through its pixel, is the only advertising network that receives anything from this website.

7. International transfers

Because the providers in section 6 operate globally, your data may be transferred to and processed in countries outside your own, including the United States and the European Union. For transfers from the EEA and the UK we rely on Standard Contractual Clauses (with the UK Addendum) or an equivalent lawful transfer mechanism.

8. How long we keep it

• Purchase and tax records: 7 years, as required by law.
• Licence records: 2 years after the licence lapses.
• Support correspondence: 3 years.
• Server logs of this website (our hosting provider): 90 days.
• Logs of our API: 7 days in Cloudflare’s dashboard and 30 days in a copy in our own storage (Cloudflare R2). They hold the lines our API writes about its own events (for example a message sent, a failed check or an error) and the exceptions of its Worker; some of these lines hold personal data, such as an IP address. Cloudflare’s own log of each request to our API is switched off.
• Error monitoring (Sentry): 30 days, for error records and for performance traces alike.
• The site assistant: The conversation stays in your browser, in the local storage of the website you are on, for an hour after your last message; it is deleted when you open a page of that website after that hour, and you can delete it sooner by clearing that website’s data in your browser. Our API does not keep your questions or the answers: it counts the requests from your IP address for about a minute, and keeps a count of all questions per day, without IP addresses, for two days. OpenAI keeps the conversation (your questions and its answers) for 30 days, as it does by default, and keeps its abuse-monitoring logs for up to 30 days, longer only where the law requires it or where OpenAI needs it to protect its services.
• Notification list (4.5): a confirmed address, 30 days after the one email is sent, or on 31 December 2027 if it is never sent; an address not confirmed, 7 days after our last confirmation email; an address that unsubscribes, at once. Copies in our backups are erased within 90 days.

9. Your rights

You may ask us for a copy of your data, to correct or delete it, to restrict processing, or for it in a portable format. Write to [email protected] and we will answer within 30 days. If you are in the EEA or the UK you may also complain to your supervisory authority.

10. Changes

If we make a material change we will announce it here and, for licence holders, by email at least 30 days before it takes effect.

11. Contact

Email [email protected], or write to Tigran Avakov, a self-employed individual, Mirzo-Ulugbek 45A, 100007 Tashkent, Uzbekistan.