LEGAL1. Scope and responsible party
This policy explains how Astra Forge Limited ("we", "us", or "our") handles personal information when you browse this website, submit its contact form, or email us. Data supplied separately for client projects is handled under the relevant service agreement and applicable data handling arrangements. If you follow a third-party link away from this website, review that party's own privacy policy.
2. Information we collect
The contact form requires your name, email address, and enquiry, and sends the selected page language and a security verification token with your submission. When you email us, we also receive information you choose to provide, such as your company name and message. You may choose not to submit an enquiry, but the form cannot send without the required information and security verification.
To deliver the website, limit abusive submissions, and verify requests, Cloudflare may process your IP address, browser and device information, request time, and pages visited. The root URL also reads your browser language preference to select Simplified Chinese, Traditional Chinese, or English. Please omit unnecessary passwords, identity-document numbers, payment details, health information, and other sensitive personal information from forms and emails.
3. Purposes and processing grounds
We use this information to respond to enquiries, assess possible engagements, keep the website secure, troubleshoot technical issues, understand basic usage, and improve our content. We process information when needed to respond to your request, arrange or perform services, operate our business legitimately, or comply with law. Where consent is required, we will ask for it when appropriate.
4. Providers, disclosure, and international processing
Cloudflare provides website hosting, content delivery, and security. When the contact form is enabled, Cloudflare Turnstile also verifies submissions. On submission, we send the verification token and IP address to Cloudflare for validation, and use Resend to deliver your name, email address, enquiry, and page language to our contact mailbox. Relevant mailbox providers may also process the email.
We do not sell personal information. Beyond processing needed to provide these services, any other disclosure must be permitted by applicable law, such as to meet legal obligations, protect rights and safety, or act with necessary consent. Providers may process information outside your location; processing locations and provider practices depend on the relevant service arrangements and privacy notices.
The website may be hosted and delivered by Cloudflare or Vercel. Vercel may also process IP addresses, device information, and request logs. On Vercel, the contact form uses Upstash Redis for rate limiting: it stores an IP-address hash and request counter, which expires after 60 seconds, not the enquiry body. These hashes may remain linkable to individuals and are not anonymous data. Turnstile verification and Resend email delivery operate as described in this section.
5. Cookies and third-party technology
Hosting and security verification technologies deliver resources, prevent abuse, and verify form submissions. Pages may also load fonts or other resources from third parties, causing your browser to send network requests to those providers. The use of necessary cookies or similar technologies depends on how those services operate. We currently have no advertising tracking integration. If analytics or marketing tools materially change personal information handling, we will update this policy and seek consent where applicable law requires it.
On the Vercel-hosted version, we use Vercel cookie-free Web Analytics and Speed Insights. Web Analytics measures aggregate page views, referrals, and browser and device categories. Speed Insights collects page loading and interaction performance metrics, such as loading time, visual stability, and responsiveness, so we can find and improve performance problems. We do not send form contents to these services or use them for advertising tracking. Vercel processes these requests under its applicable privacy documentation.
6. Retention, security, and data requests
We determine retention periods from enquiry follow-up, business records, security, and legal obligations, and delete or anonymise information once it is no longer needed and need not legally be retained. Email records and provider logs may have different retention arrangements. Internet transmission and electronic storage cannot be guaranteed completely secure; please avoid sending unnecessary sensitive information.
Email mail@astraforge.app to request access, correction, or deletion, or to request withdrawal of consent or an end to relevant processing where applicable law permits. Describe the request, the email address used to contact us, and details that help locate the record. Do not attach identity documents or other sensitive material unless requested. We may ask for further information necessary to verify your identity and clarify the request so that we do not disclose your information to someone else.
We will respond within the period required by applicable law. Rights are subject to applicable law and retention obligations; if we cannot fully fulfil a request, we will explain why and the available next steps. Withdrawing consent does not affect processing that was lawful before withdrawal.
7. Updates and contact
We may update this policy when needed and will show the latest date on this page. We will provide an appropriate notice for material changes. Privacy questions, data requests, or questions about this policy may be sent to mail@astraforge.app.