Privacy Policy
Last updated: 24 April 2026
1. Who We Are
PromoForge is operated by Funstar Digital (ABN 30 577 818 671), based in Australia. In this policy, "we", "us", and "our" refer to Funstar Digital trading as PromoForge.
2. Information We Collect
Account Information
When you create an account, we collect your email address, username, and password (stored securely hashed). You may optionally provide your name.
Brand & Content Data
We store the brand profiles, promotional content, storyboards, and media assets you create within the platform. This data belongs to you.
Connected Platform Data
When you connect social media accounts (Instagram, Facebook, TikTok, YouTube, LinkedIn), we receive and store OAuth access tokens and basic profile information (account name, profile ID). We access only the permissions you explicitly grant.
Usage & Analytics
We collect usage data including pages visited, features used, content generation counts, and platform interactions to improve the service and track subscription usage.
Payment Information
Payments are processed by Stripe. We do not store your credit card details. Stripe's privacy policy governs payment data handling.
Technical Data
We automatically collect IP addresses, browser type, device information, and access timestamps for security and service reliability.
3. How We Use Your Information
- To provide and operate the PromoForge service
- To generate and distribute promotional content on your behalf
- To process payments and manage your subscription
- To send transactional emails (account confirmations, billing receipts, service alerts)
- To improve and develop new features
- To prevent fraud and maintain security
- To comply with legal obligations
We do not sell your personal information to third parties.
4. Third-Party Services
We use the following third-party services to operate PromoForge:
- Stripe — payment processing
- Meta (Facebook/Instagram) — content distribution via their Graph API
- Google (YouTube) — video distribution via YouTube Data API
- TikTok — content distribution via TikTok API
- LinkedIn — content distribution via LinkedIn API
- Anthropic (Claude) — AI content generation (text, scripting, strategy)
- Replicate — AI visual generation (images, backgrounds)
- ElevenLabs — AI voice generation and voice cloning
- HeyGen — AI actor / custom avatar generation
- Fal.ai — alternate AI image / video generation (when configured)
- Cloudflare — content delivery and asset storage (Cloudflare R2)
- Fly.io — application hosting
Each service operates under its own privacy policy. We share only the minimum data required for each service to function.
4A. AI Training — Our Position
PromoForge does not train AI models on your content. We do not operate any AI models of our own. Your prompts, generated outputs, uploaded assets, brand profiles, and voice samples are never used to train a PromoForge-owned model, because no such model exists.
However, some of the AI vendors we route requests to have their own training policies. Below is our current understanding of each vendor's default training stance as of the "Last updated" date above. We configure our vendor accounts to opt out of training data collection wherever the vendor provides that option. Vendor policies can change — we re-review these quarterly and update this page when we find drift.
| Vendor | Default training on your content? | Our configuration |
|---|---|---|
| Anthropic (Claude) | No — API inputs are not used for training by default | Standard API access (no training) |
| Replicate | No — inputs/outputs retained for operational purposes only | Standard API access (no training) |
| ElevenLabs | Vendor may use customer data for service improvement on some plans | Training opt-out requested on our account where the option is available |
| HeyGen | Vendor may use customer content for service improvement outside Enterprise tier | Training opt-out requested on our account where the option is available |
| Fal.ai (when used) | No — API inputs not used for training by default | Standard API access (no training) |
Opting your content out. If you want to exclude your prompts and uploaded content from any vendor's service-improvement pipeline beyond our default configuration, email support@promoforge.com.au with the subject "AI training opt-out". We will log your request and stop sending your content to any vendor whose no-training configuration we cannot verify.
Voice & likeness data. Cloned voices and custom avatars are generated from audio/image samples you upload. Both ElevenLabs (voice) and HeyGen (avatar) process these samples. We require your explicit consent attestation at upload time for both categories and log that attestation in our audit trail. You remain the sole rights holder; we act as a technical intermediary.
Synthetic content labelling. AI-generated outputs are labelled as AI-generated in the PromoForge UI. We are working toward embedded cryptographic provenance (the C2PA Content Credentials standard) in a future release — that work is not yet live, and we do not claim compliance with C2PA in any output we produce today.
5. Data Retention
We keep your data only as long as needed to provide the service or meet legal obligations. Specific windows:
- Account data (profile, brands, connected platforms): retained while your account is active. Deleted within 30 days of account closure.
- Generated content and media assets (images, videos, audio, carousels): retained while your account is active. Deleted immediately on removal, or within 30 days of account closure.
- Audit logs (ownership attestations, permission events, security events): retained for up to 7 years to support compliance and dispute resolution, even after account closure. Personally identifying fields are anonymised on account deletion.
- Billing and usage records: retained for up to 7 years to meet Australian Taxation Office and GST record-keeping obligations.
- Support correspondence: retained for up to 3 years for quality and legal-defence purposes.
We may retain specific data longer if we are required by law (e.g. a legal hold served on us for litigation preservation).
6. Data Security
We protect your data using industry-standard measures including encrypted connections (TLS), hashed passwords, secure token storage, and access controls. No system is 100% secure, but we take reasonable steps to protect your information.
7. Your Rights
Under the Australian Privacy Act 1988 and applicable laws, you have the right to:
- Access your personal data
- Correct inaccurate data
- Request deletion of your data
- Export your data
- Withdraw consent for optional processing
To exercise any of these rights, contact us at support@promoforge.com.au.
8. Facebook & Instagram Data
If you connect your Facebook or Instagram account, we access data in accordance with Meta's Platform Terms. You can revoke access at any time through your PromoForge account settings or through Facebook's app settings. Upon disconnection or account deletion, we delete all stored Meta platform data within 30 days.
To request deletion of your data obtained through Facebook, visit our data deletion page or contact support@promoforge.com.au.
10. Children
PromoForge is not intended for use by anyone under 18 years of age. We do not knowingly collect data from minors.
11. Changes to This Policy
We may update this policy from time to time. We will notify you of material changes via email or an in-app notice. Continued use of PromoForge after changes constitutes acceptance.
12. Contact
For privacy enquiries, contact:
Funstar Digital
Email: support@promoforge.com.au