Privacy Policy
Last updated:
This page is part of the FORGE Terms of Use and Privacy Policy. See also the Terms of Use.
These Terms of Use and Privacy Policy apply to the FORGE website, waitlist, early-access program, software, and related services.
FORGE is operated by Khurafi for Information Technology LLC, trading as Fahy, based in Riyadh, Saudi Arabia. The operator's details appear in Section 22. References to “Fahy,” “we,” “us,” and “our” mean this legal entity.
By creating an account or using FORGE, you agree to the Terms of Use, including the project-training and published-game showcase permissions below. The Privacy Policy explains our processing of personal data; accepting these terms does not replace separate consent where required by law.
10Information We Collect
Depending on how you use FORGE, we may collect:
- Name, email address, role, studio, and company information.
- Account and authentication information.
- Waitlist and onboarding submissions.
- Messages, feedback, and support requests.
- Project Content, including prompts, code, assets, uploaded files, generated outputs, and project interactions.
- Device, browser, IP address, usage, operational logs, and error information.
- Billing, payment, and usage-cost records where applicable.
- Information made available through services you authorize FORGE to connect to.
We collect information through your submissions and uploads, automatically through platform operation and cookies, and through authorized connected services or providers.
Account authentication and contact information are required to create and administer an account. Additional information needed for a requested feature or onboarding arrangement will be identified when collected; other requested information is optional. Without required information, we may be unable to provide the relevant service.
11Purposes and Legal Bases
We process personal data only where an applicable legal basis permits it:
| Purpose | Legal basis |
|---|---|
| Provide requested services, manage accounts and onboarding, process project instructions, and provide support | Performance of an agreement with you, or another applicable lawful basis where you act for an organization |
| Billing, accounting, and compliance | Performance of an agreement and applicable legal obligations |
| Platform security, fraud prevention, diagnostics, and service improvement | Legitimate interests where permitted, necessary, and supported by the required assessment; otherwise consent or another applicable lawful basis |
| If personal data is included in Project Content: use that data to train, fine-tune, evaluate, and improve FORGE's AI models and systems | Separate consent where required, or another lawful basis only where its specific legal conditions have been met; the Project Content license alone is insufficient |
| Marketing communications | Consent where required, with a means to unsubscribe |
The project license in Section 5 permits use of Project Content for training. It does not, by itself, constitute blanket consent to process personal data or authorize use of personal data contrary to law.
Where consent is the legal basis, we obtain it separately for the relevant purpose and allow withdrawal. We do not make consent to unrelated processing a condition of receiving the service. We do not rely on legitimate interests to process sensitive personal data.
Where a customer instructs FORGE to process personal data on its behalf, the customer determines its lawful instructions and appropriate notices. Fahy's processing on that customer's behalf is subject to applicable data-processing arrangements. Using that data for Fahy's own training requires a separate lawful basis and any necessary customer authorization.
12Service Providers and International Processing
Our providers include Google, Anthropic, OpenAI, Moonshot AI (Kimi), and DeepSeek, depending on the services and models used. They may provide AI processing, cloud and virtual-machine infrastructure, databases, authentication, and related services. Other operational providers, where used, may support analytics, communications, payments, and technical support.
Depending on the service, these providers may receive prompts, relevant project files and outputs, account or usage information, or other data needed to perform the relevant work. Disclosures may occur regularly during use or occasionally for support, security, or billing.
Providers acting on our behalf are subject to appropriate processing, confidentiality, and security arrangements. We may engage them to support the training uses described in Section 5. These terms do not grant providers an unrestricted right to use private Project Content for unrelated purposes.
Storage and processing locations: The table below summarizes the geographic scope disclosed in providers' public documentation. Actual FORGE processing locations depend on the service, endpoint, routing, and regional settings used; this table does not mean that every project is sent to every provider or location.
| Provider | Publicly disclosed geographic scope |
|---|---|
| Google / Google Cloud | Customer data may be processed in countries where Google or its subprocessors maintain facilities, subject to service-specific and configured regional commitments. See Google’s processing terms and region and location list. |
| Anthropic | Its commercial-services disclosure states that data is stored in the United States by default and traffic may be processed in selected countries in the United States, Europe, Asia, and Australia, subject to agreed or configured routing. Internal support and security processing may involve additional affiliate locations. See Anthropic’s location disclosure. |
| OpenAI | Processing may be global or subject to supported regional controls, depending on the API project, endpoint, model, and feature. Official documentation describes regional processing in the United States, eligible European locations, and the United Arab Emirates for supported services; regional storage does not necessarily mean all processing remains in that region. See OpenAI’s API data controls. |
| Moonshot AI / Kimi | The international Kimi OpenPlatform privacy policy states that its servers are in Singapore and personal data may be processed and stored there. Other Moonshot products or mainland-China services may have different arrangements. See Kimi OpenPlatform’s privacy policy. |
| DeepSeek | Its direct-services privacy policy states that personal data is collected, processed, and stored in the People’s Republic of China. See DeepSeek’s privacy policy. |
When a model is accessed through another provider's infrastructure, the deployed service and hosting route determine the relevant recipients and locations. A model developer's location does not by itself establish where a particular request is processed.
Provider disclosures may change. We keep the information relevant to our services under review and communicate material changes where required. Any agreed restriction on processing locations must be reflected in the service configuration and applicable written arrangements.
Where personal data is transferred or processed outside Saudi Arabia, we use the applicable lawful transfer mechanism and safeguards required by law.
We may also disclose information where required by law or a valid legal process, or as lawfully necessary to protect rights and address security incidents.
13Cookies and Communications
We may use essential cookies to operate FORGE and optional analytics or marketing technologies where applicable.
Where consent is required, optional technologies are enabled only after consent. You may manage cookies through available website controls and browser settings. Blocking essential cookies may affect functionality.
You may unsubscribe from marketing messages without closing your account. Necessary account, security, billing, and service communications may still be sent.
14Retention Deletion and Training Data
We retain personal data only as long as needed for the stated purpose, unless a legal obligation requires longer retention. There is no indefinite retention merely because a user has not requested deletion. Retention is determined by the relevant account or project relationship, support and security needs, the duration of training or evaluation activities where lawfully applicable, and statutory recordkeeping or dispute requirements. We delete or irreversibly anonymize personal data without undue delay when it is no longer needed and no lawful retention exception applies.
Waitlist data is retained while needed to administer the waitlist, or until a valid deletion or withdrawal request, subject to legal requirements. Account and project data is retained while needed for the service and any other lawfully continuing purpose. Billing and compliance records follow applicable statutory periods. Logs and backups are retained only for their operational, recovery, security, or legal purpose.
You may request account or project deletion by email at info@fahy.gg or by WhatsApp at +966579897309. We act on valid personal-data deletion requests within the deadlines in Section 15, subject to lawful exceptions. We communicate any applicable retention exception and retain only what the continuing lawful purpose requires. Backup copies remain protected, are restricted from ordinary operational use pending removal, and are removed through the applicable backup lifecycle in accordance with legal requirements. A provider’s backup cycle does not override an applicable statutory obligation.
Deleting a project or account does not automatically undo completed model training or remove non-personal training material licensed under Section 5. We will nevertheless comply with applicable personal-data deletion, consent-withdrawal, and other statutory obligations, including in relation to datasets or models where required.
15Your Privacy Rights
Subject to applicable law and its permitted exceptions, you may request information about our processing, access to your personal data, a readable copy, correction, or deletion, and withdraw consent where processing relies on it. You may also raise an objection or request restriction where applicable.
Send privacy requests by email to info@fahy.gg or by WhatsApp to +966579897309. We may verify your identity. We act on requests without undue delay and within 30 days of receipt. Where implementation requires disproportionate effort or we receive multiple requests from the same individual, we may extend that period by no more than a further 30 days, only as permitted by law. We notify you of the extension and its reasons before the initial period expires. The extension is not automatic, and any obligation to act sooner under applicable law remains unaffected.
Withdrawal does not affect processing already lawfully completed or processing lawfully based on another ground. You may complain to us or to the Saudi Data and Artificial Intelligence Authority (SDAIA) through its personal-data complaint channels.
16Security and FORGE's Operating Environment
We use reasonable technical and organizational safeguards to protect personal data and Project Content, including appropriate restrictions on personnel and provider access.
FORGE agents operate within FORGE-managed virtual machines and authorized connected services. FORGE does not directly access or control your personal computer.
By instructing an agent or authorizing a connected service, you authorize relevant actions within the permissions granted, which may include creating, reading, editing, running, or deleting project files and working with connected infrastructure. This does not authorize actions outside those permissions.
You are responsible for the access you grant, lawful instructions, and review of important project changes. No online service can guarantee complete security; protect your credentials and maintain independent backups.
We handle personal-data incidents and provide notifications where required by applicable law.
17Children
FORGE accounts are not intended for anyone under 18. We do not knowingly collect personal data from children for account registration.
Contact us if you believe a child has submitted personal data. A customer publishing a game is responsible for the age-appropriate notices and permissions required for its own players.
18Third Party Services and Published Games
Third-party AI, cloud, database, game-engine, payment, analytics, and distribution services may have their own terms and privacy policies.
You are responsible for your published games, player-facing notices, permissions, content, and compliance with applicable laws, third-party licenses, and distribution requirements.
Where FORGE processes player data on your behalf, appropriate data-processing terms will apply. Your use of FORGE does not automatically make Fahy the publisher of your game or remove Fahy's own legal obligations.
General Provisions
Sections 19–22 apply to the FORGE Terms of Use and Privacy Policy as a whole, and are repeated on both pages.
19Termination
You may stop using FORGE at any time, subject to payment and other obligations already agreed.
We may suspend or terminate access for breach of these terms, security or legal risks, nonpayment of agreed charges, or misuse. Where reasonably practicable and lawful, we will provide notice and an opportunity to address the issue.
You should export important project data before closing your account. Retention and deletion follow Section 14. Provisions intended to continue after termination, including ownership, applicable training and showcase licenses, accrued payment obligations, and liability terms, continue subject to law.
20Governing Law
These terms are governed by the laws of the Kingdom of Saudi Arabia.
Disputes will be handled by the competent courts in Riyadh, Saudi Arabia, unless mandatory applicable law requires otherwise.
21Changes and Separate Agreements
We may update this document as FORGE develops or legal requirements change. The latest version will be published with an updated date, and we will give notice of material changes through appropriate channels.
New training or other permissions do not apply retroactively to previously submitted content unless validly agreed or otherwise lawfully authorized. We obtain new consent where required.
A specific written agreement with you prevails over conflicting general terms to the extent of that conflict, subject to mandatory law. If any provision is unenforceable, the remaining provisions continue to apply to the extent permitted by law.
22Contact and Operator Details
- Brand
- Fahy
- Registered legal entity
- Khurafi for Information Technology LLC
- Company ID
- 7025145496
- Address
- Riyadh, Saudi Arabia
- info@fahy.gg
- +966579897309
- Website
- https://forge.fahy.gg
Email and WhatsApp are our primary contact methods for questions, support, privacy and deletion requests, and data-processing arrangements.