Privacy Policy

Last updated: October 26, 2026

The controller of your personal data is Mikołaj Mateusiak, Brzezie 30, 97-420 Szczerców, Poland. For privacy questions, contact help@roforgeui.com.

1. Data we process

Account data: email address, account name, password hash, verification status, sessions, and account settings.
Project content: GUI documents, imported files, images, feature usage history, and Roblox asset identifiers.
AI request data: prompts, selected layers, and attached images needed to fulfill a requested generation.
Billing data: Stripe customer and subscription identifiers, plan status, and payment events. RoForge UI does not store full payment card details.
Technical data: IP addresses, timestamps, session identifiers, and logs needed for security, diagnostics, and rate limits. When persistent abuse counters are enabled, they store an HMAC digest instead of a raw IP address.

2. Purposes and legal bases

We use data to create accounts, save projects, provide imports, generation and exports, and bill for Pro (performance of a contract, GDPR Article 6(1)(b)); to secure the service and handle claims (legitimate interests, Article 6(1)(f)); and to meet tax and accounting duties (legal obligation, Article 6(1)(c)). Transactional account and purchase emails are not a newsletter. Marketing email requires a separate legal basis. We also use aggregated public-page traffic statistics to understand site usage; we do not use them to identify individual users.

3. Recipients and international transfers

Depending on the feature you use, data may be processed by Vercel (hosting and public-page analytics), Supabase (database and files), Stripe (payments), Resend (email), Google Gemini or a configured AI provider (generation), Figma (connected imports), Roblox (exports and assets), and Google AdSense if ads are enabled for Free with the required consent. If optional network-risk checks are enabled, IPQualityScore receives the IP address, browser user agent, and request language during registration or a costly Free operation. Providers may process data outside the EEA; we use applicable transfer mechanisms and provider information. We do not sell user projects.

4. Analytics, advertising, and cookies

On public pages, Vercel Web Analytics provides aggregated information such as page views, referrers, approximate region, and device/browser type. We remove query strings and route fragments before events are sent and exclude the private workspace and editor. According to Vercel, Web Analytics does not use third-party cookies. Pro does not display ads. The public Figma guide can display Google AdSense ads to visitors and Free accounts. Google’s tag loads its published consent message; manual ad requests wait for a completed consent signal or confirmation that GDPR consent does not apply. Advertising partners may use cookies or similar identifiers according to your choices. If the consent service is unavailable, the site does not request a manual ad. See our Cookie Policy.

5. Retention

We keep account data and projects while you use the account. After a deletion request, we delete or anonymize them unless longer retention is required for legal duties, billing, security, or claims. We retain billing records for the period required by law. Verification codes and operational data have shorter retention periods depending on their purpose.

6. Your rights

You may request access, correction, deletion, restriction, or portability of your data, or object to processing where the GDPR provides those rights. Where processing is based on consent, you may withdraw it without affecting earlier lawful processing. Contact help@roforgeui.com. You may also lodge a complaint with Poland’s President of the Personal Data Protection Office (UODO).

7. Changes

We will announce material changes to this policy in the service or by email to the account address.