Privacy Policy

MageForge ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website at courses.mageforge.io and use our online learning platform.

We are registered in the United Kingdom. Our registered address is:

MageForge
128 City Road
London, EC1V 2NX
United Kingdom

Phone: +44 7441 422447
Email: support@mageforge.io

This policy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

MageForge is the data controller responsible for your personal data. If you have any questions about this Privacy Policy or our data practices, please contact us at support@mageforge.io or write to us at our registered address above.

Information you provide directly:

• Account registration details: name, email address, and password
• Profile information: avatar, bio, and preferences
• Payment information: processed securely by Stripe (we do not store your full card details)
• Communications: messages sent through our contact form or support tickets
• Course interactions: reviews, comments, quiz responses, and assignment submissions

Information collected automatically:

• Device and browser information (type, version, operating system)
• IP address and approximate geographic location
• Pages visited, time spent, and navigation patterns
• Learning progress, course completion, and video watch history
• Cookies and similar tracking technologies (see Section 9)

Information from third parties:

• Social login providers (Google, GitHub, etc.) if you choose to sign in using a social account
• Stripe: payment confirmation and transaction status

Under UK GDPR, we process your personal data on the following legal bases:

• Contract: Processing necessary to perform our contract with you (e.g., providing course access after purchase, managing your account)
• Legitimate interests: Processing necessary for our legitimate business interests (e.g., improving our platform, fraud prevention, analytics), provided these do not override your rights
• Consent: Where you have given specific consent (e.g., marketing communications, optional cookies)
• Legal obligation: Processing necessary to comply with UK law (e.g., tax records, fraud prevention)

• Provide, maintain, and improve our online learning platform
• Process course purchases and manage your subscriptions
• Track your learning progress and issue certificates of completion
• Personalise your experience and recommend relevant courses
• Send transactional emails (purchase confirmations, password resets, course updates)
• Send marketing communications (only with your consent; you can unsubscribe at any time)
• Respond to your enquiries and provide customer support
• Detect, prevent, and address fraud, abuse, or security issues
• Analyse usage patterns to improve our content and platform
• Comply with legal obligations and enforce our Terms of Service

All payment transactions are processed by Stripe, a PCI DSS Level 1 certified payment processor. When you make a purchase:

• Your card details are sent directly to Stripe's secure servers and are never stored on our systems
• We receive only a confirmation of the transaction, the last four digits of your card, and the card type
• Stripe processes your data in accordance with their own privacy policy

For more information, please review Stripe's Privacy Policy.

We do not sell your personal data to any third party. We may share your data with:

• Stripe: For payment processing
• Amazon Web Services (AWS): For hosting and content delivery
• Google Analytics: For website analytics (anonymised data)
• Email service providers: For sending transactional and marketing emails
• Course instructors: Limited learner information (name, progress) to enable course delivery
• Legal authorities: When required by law, court order, or to protect our legal rights

All third-party processors are bound by data processing agreements and are required to process your data in accordance with UK GDPR.

Some of our service providers (such as AWS and Stripe) may process data outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO), or reliance on the provider's adequacy decisions.

We use the following types of cookies:

• Strictly necessary cookies: Required for the website to function (e.g., session management, CSRF protection, authentication). These cannot be disabled.
• Functional cookies: Remember your preferences (e.g., language, theme, video playback position).
• Analytics cookies: Help us understand how visitors interact with our website (Google Analytics). These are loaded only with your consent.

You can manage your cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of our platform.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Account data: Retained while your account is active and for 30 days after account deletion
• Purchase and financial records: Retained for 7 years to comply with UK tax and accounting regulations
• Certificates and course completions: Retained indefinitely for verification purposes, unless you request deletion
• Support tickets: Retained for 2 years after resolution
• Analytics data: Retained in anonymised form

Under UK data protection law, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data ("right to be forgotten")
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Receive your data in a structured, commonly used, and machine-readable format
• Right to object: Object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, please contact us at support@mageforge.io. We will respond within one month of receiving your request, as required by law.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk
Phone: 0303 123 1113

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure password hashing (bcrypt)
• Regular security audits and vulnerability assessments
• Access controls limiting employee access to personal data
• PCI DSS compliant payment processing via Stripe

While we strive to protect your data, no method of transmission over the Internet is 100% secure. We encourage you to use a strong, unique password for your account.

Our platform is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have inadvertently collected personal data from a child under 16, we will take steps to delete it promptly. If you believe a child has provided us with their personal data, please contact us at support@mageforge.io.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. For significant changes, we may also notify you by email. We encourage you to review this policy periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

MageForge
128 City Road
London, EC1V 2NX
United Kingdom

Email: support@mageforge.io
Phone: +44 7441 422447