Privacy Policy - FragonForge

Last updated: 2026-07-25

1. Controller

The controller responsible for data processing under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") is:

Fragon Studios e.U. Moosfelderstraße 45, 4030 Linz, Austria Email: office@fragonstudios.com Privacy contact: legal@fragonstudios.com

Full company details are in our Imprint.

We have not appointed a Data Protection Officer. Austrian law does not require one for an undertaking of this size and processing profile.

A note on roles. For the personal data of our own customers and website visitors (account data, billing data, server logs), Fragon Studios e.U. is the controller and this policy applies. For personal data that may be contained inside the repositories, issues, and code a customer connects to FragonForge, the customer is the controller and Fragon Studios e.U. acts as a processor on the customer's documented instructions. That relationship is governed by a separate Data Processing Agreement, not by this policy.

2. Scope

This policy explains how we process personal data when you:

visit the marketing website fragonforge.com;
create and use a FragonForge account;
connect a source-code forge and run the agent;
contact us by email.

3. Data we process, purposes, and legal bases

3.1 Website visit (server logs)

Data: IP address, date and time of the request, requested URL, referrer, user agent, and similar technical data automatically transmitted by your browser.
Purpose: delivering the website, ensuring stability and security, defending against abuse.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning website).

3.2 Account data

Data: name, email address, hashed password, TOTP two-factor secret and recovery codes, organization name, role (Owner, Admin, Member, Viewer), personal access tokens (stored as hashes), session and login metadata.
Purpose: creating and securing your account, authentication, access control, account administration.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract) for the account itself; Art. 6(1)(f) GDPR (legitimate interest in account security) for two-factor data, session management, and the audit log.

3.3 Forge access tokens

Data: the access token you provide for your source-code forge (GitLab, GitHub / GitHub Enterprise, Gitea, Forgejo, Bitbucket), encrypted at rest, plus webhook secrets.
Purpose: connecting to your forge to check out code, push branches, and open merge or pull requests on your instruction.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract).
Security: each organization has its own data encryption key; tokens, webhook secrets, and TOTP seeds are encrypted with it (AES-GCM). Forge tokens are never placed inside an agent sandbox; clone and push run on the control plane.

3.4 Repository metadata

Data: repository identifiers, connection settings, branch and merge- request metadata, issue and label metadata used to trigger and track runs.
Purpose: configuring connections and operating the issue-to-merge- request loop.
Legal basis: Art. 6(1)(b) GDPR.

3.5 Issue and code content processed during runs

Data: the content of issues and source code that the agent reads and modifies while a run executes. This can incidentally contain personal data if your code or issues contain it.
Processing model: each run executes in a dedicated, ephemeral Kubernetes sandbox that is destroyed after the run. The repository clone inside the sandbox lives on a pod-local volume that dies with the pod. The control plane's own working clone is deleted after every run. Where this content constitutes personal data, the customer is the controller and we act as a processor; see the DPA.
Legal basis: Art. 6(1)(b) GDPR in our relationship with the customer; as processor, we act only on documented instructions under Art. 28 GDPR.

3.6 Run logs

Data: the agent's own output for a run, passed through a secret- redaction filter and capped at 64 KiB per run. Run logs hold agent output, not a copy of your repository.
Purpose: letting you see what a run did; troubleshooting.
Legal basis: Art. 6(1)(b) GDPR.
Retention: run history is retained according to your plan: 30 days on Free, 90 days on Solo, 1 year on Team and Business.

3.7 Code search index (RAG), paid plans only

Data: on paid plans, an optional code index stores chunked source- code text (in the database) and vector embeddings (in the vector store), so the agent can search your codebase.
Purpose: giving the agent codebase context (retrieval-augmented generation).
Processing model: the index is tenant-isolated at both the database and the vector store, and is purged atomically together with everything else when you offboard.
Legal basis: Art. 6(1)(b) GDPR; processor role as above.

3.8 LLM egress on your own key or a ChatGPT seat

What happens: the agent's model calls leave through an egress proxy that forwards requests to the LLM provider whose key you configured, and streams responses back. The proxy does not log or persist request or response bodies. Your provider's own logs and bill are the complete record of what the agent sent to the model.
Which credential a run uses: a connected ChatGPT plan is a personal seat and covers the runs its holder starts. Runs started by a label, a webhook, or a schedule are not attributed to a person and use the organization's credential instead. Either way the recipient is the provider you configured.
Important: the LLM provider is engaged under your own contract with that provider, using your own API key. The LLM provider is therefore not our sub-processor; it is a recipient you have chosen and contracted with directly. See the Sub-processor list.
Legal basis: Art. 6(1)(b) GDPR for operating the proxy; responsibility for the provider relationship and its data terms rests with you as the account holder.

3.9 FragonForge AI (models we operate) and usage metadata

What happens: if a repository runs on FragonForge AI rather than your own key, the agent's model calls go to a curated catalog we operate, and the model provider processes that content on our instruction. The route runs through the gateway's EU endpoint, with zero data retention and denied data collection asserted per request, so the processing stays in the EU. Unlike the case above, the gateway is our sub-processor; see the Sub-processor list, which also sets out that its operator is incorporated in the US.
Data: the content of the run, in transit, plus usage metadata that we do store: token counts, the model used, the run, task, or step it belongs to, and the resulting cost. We do not log or persist prompt or response bodies for metering or for any other purpose.
Purpose: running the agent on models we provide, and metering the monthly budget your plan includes so that both sides can see what was used.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract).
Not applicable if your repositories run on your own key or a ChatGPT seat.

3.10 Billing data

Data: billing contact, plan, subscription status, and the identifiers needed to link your account to a payment. Card data is handled by our payment provider, Stripe, not stored by us.
Purpose: managing your subscription, invoicing, cancellation.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (compliance with tax and accounting obligations, including retention under the Bundesabgabenordnung and the Unternehmensgesetzbuch).
Retention: billing and invoice records are retained for the statutory period of seven years.

3.11 Telemetry

Data: traces and metrics that record identifiers, durations, and token counts. Telemetry carries no code and no prompts. Emails we send never contain repository content.
Purpose: operating, monitoring, and improving the service.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a reliable service).

3.12 Email contact

Data: your email address, message content, and any information you choose to include.
Purpose: answering your enquiry.
Legal basis: Art. 6(1)(b) GDPR where the enquiry relates to a contract or its initiation, otherwise Art. 6(1)(f) GDPR (legitimate interest in responding).

4. Recipients and sub-processors

We do not sell personal data. We share it only with service providers who process it on our behalf under Art. 28 GDPR, and only as necessary.

Our infrastructure sub-processor is Hetzner Online GmbH (Germany), which provides hosting. Payments are processed by Stripe. Account and notification emails are delivered through Microsoft 365 (Microsoft Ireland Operations Limited), with data at rest in the EU under the Microsoft EU Data Boundary.

Where a repository runs on FragonForge AI, the model gateway we operate that path through is a sub-processor too: OpenRouter, Inc., called on its EU endpoint. The full list, with data categories and locations, is in our Sub-processor list.

Where a repository runs on your own key or a connected ChatGPT plan, that LLM provider is not our sub-processor: you contract with it directly. See sections 3.8 and 3.9.

5. RAG, agent output, and automated processing

FragonForge runs an autonomous coding agent that reads and writes code. Its output (branches, merge or pull requests) is proposed, never merged automatically; a human reviews and decides. This processing does not produce a decision that has legal or similarly significant effects on a data subject within the meaning of Art. 22 GDPR.

6. Data residency and international transfers

The platform runs on dedicated servers in the EU (Hetzner, Germany). Data at rest stays in the EU. Database backups are point-in-time-recovery backups to EU object storage with a 30-day retention window.

We do not transfer personal data outside the EU/EEA in the course of operating the platform itself. One exception applies to billing: payment processing through Stripe may involve a transfer of billing data to Stripe, Inc. (USA) under the EU-US Data Privacy Framework or standard contractual clauses, as set out in Stripe's own data processing terms; see our sub-processor list.

Note on FragonForge AI: runs on the models we operate are called through the gateway's EU endpoint, eu.openrouter.ai, with zero data retention asserted per request and data collection denied per request, so the processing stays in the EU. The gateway operator, OpenRouter, Inc., is a US company, which means that EU guarantee is a contractual and technical control rather than a consequence of where the operator sits. Our sub-processor list sets out that distinction and what it means for a procurement rule that turns on jurisdiction.

Note on your own LLM provider: if you configure a provider that processes data outside the EU/EEA, that transfer occurs under your own contract with that provider, for which you are responsible as controller. This is the one place where the choice of path changes the jurisdiction your code is processed in.

7. Retention

We keep personal data only as long as necessary for the purposes above or as required by law. Summary:

Account data: for the life of the account, then deleted on offboarding.
Forge tokens, repository metadata, code index: for the life of the account, then purged on offboarding.
Run logs / run history: per plan (30 days Free, 90 days Solo, 1 year Team and Business).
Billing/invoice records: 7 years (statutory).

Offboarding is a real purge, not a soft delete: database rows, the code search index, stored keys and tokens, and billing links are removed. It is self-serve from the app. Statutory retention obligations (for example for invoices) are the documented exception and survive account deletion until they lapse.

8. Your rights

Under the GDPR you have the right to:

access your personal data (Art. 15);
rectification (Art. 16);
erasure (Art. 17);
restriction of processing (Art. 18);
data portability (Art. 20);
object to processing based on Art. 6(1)(f) (Art. 21);
withdraw consent at any time, where processing is based on consent (Art. 7(3)), without affecting prior processing.

To exercise these rights, contact legal@fragonstudios.com. Where we act as a processor for repository content, direct requests concerning that content to the customer who is the controller; we will assist them as required by the DPA.

Right to complain

You have the right to lodge a complaint with a supervisory authority. The authority for Austria is:

Österreichische Datenschutzbehörde (DSB) Barichgasse 40-42, 1030 Wien, Austria Web: https://www.dsb.gv.at

9. Is provision of data required?

Providing account and billing data is necessary to enter into and perform the contract; without it we cannot provide the service. Providing a forge token and repository access is necessary to use the agent. There is no statutory obligation to provide data, but the service cannot function without the data described above.

10. Security

We describe our security architecture in detail on our public security page, including per-run sandbox isolation, default-deny networking, per-organization encryption of secrets, role-based access control, a tenant-scoped audit log, and EU data residency.

11. Cookies

The website and the application use only strictly necessary cookies: a single HttpOnly session cookie keeps you signed in to the app. We use no advertising, analytics, or tracking cookies, so no cookie-consent banner is required. Your light or dark theme choice is stored locally in your browser and is never sent to us. Full detail is in our Cookie Notice.

12. Changes to this policy

We may update this policy as the service or the law changes. The current version is always available at fragonforge.com. Material changes affecting you will be communicated by an appropriate means.