PersonaForge ("we," "us," or "our"), operated by M3T Labs, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at persona-forge.ai and related services.
1. Information We Collect
Account Information
When you create an account, we collect your name, email address, and authentication credentials. If you sign in with a third-party provider (e.g., Google), we receive your name and email from that provider.
Persona Data
To create your AI persona, you may provide photos, voice recordings, and written content. Photos and voice recordings are used to generate biometric data (facial geometry and voiceprints). See our Biometric Data Policy for details on how biometric data is handled.
Usage Data
We automatically collect information about how you interact with our platform, including IP address, browser type, pages visited, and timestamps.
1a. Waitlist Signups (Closed Beta)
When you join the PersonaForge beta waitlist we process the following categories of data so we can notify you when an invite is ready and so we can prove your consent was freely given:
- Email address, your selected use case, and an explicit consent flag, processed on the lawful basis of consent (GDPR Art 6(1)(a)). You can withdraw consent at any time via the one-click unsubscribe link in every email or by emailing us.
- HMAC-hashed IP address and user agent, processed on the lawful basis of legitimate interest (GDPR Art 6(1)(f)) for abuse prevention and rate limiting. We do not retain the raw values.
- A timestamped snapshot of the consent text you ticked, retained for seven years to demonstrate the consent chain (GDPR Art 7(1)). PII fields (email and IP/UA hashes) are erased immediately when you unsubscribe; the timestamped evidentiary record remains.
Recipients: PersonaForge staff (M3T Labs) and our hosting provider (Supabase) under a Data Processing Agreement. We do not share waitlist data with advertisers or sell it.
Data subject rights (30-day SLA): you can request access, correction, deletion, or portability of your waitlist data by emailing privacy@persona-forge.ai. We will respond within 30 days as required by GDPR Art 12(3). The one-click unsubscribe link in every waitlist email also acts as a deletion request and is honored within 24 hours per CAN-SPAM §5.
2. How We Use Your Information
- To create, operate, and maintain your AI persona
- To provide, maintain, and improve our platform
- To authenticate your identity and secure your account
- To communicate with you about your account and our services
- To comply with legal obligations
- To detect, prevent, and address fraud or technical issues
3. Data Sharing
We do not sell your personal information. We may share your information with:
- Service providers who assist in operating our platform (cloud hosting, AI model providers), under strict data processing agreements
- Law enforcement or regulators when required by applicable law
- Business transfers in connection with a merger, acquisition, or sale of assets
3a. Subprocessors
Subprocessor list last updated: May 30, 2026
To operate PersonaForge we share limited personal data with carefully selected service providers ("subprocessors") who process it only on our instructions, under a Data Processing Agreement, and never to train their own models on your data. We do not sell your personal information, and we do not sell, lease, trade, or otherwise profit from your biometric data. Our current subprocessors are:
| Subprocessor | Purpose | Data shared | Location |
|---|---|---|---|
| ElevenLabs | Voice cloning and speech synthesis | Voice recordings and the derived voiceprint | United States |
| Avatar provider (Avatar SDK / MetaPerson) | 3D avatar generation | Photos and derived facial-geometry used to build your avatar | United States |
| LLM provider | Generating your persona's conversational responses | Your persona's personality data and conversation content | United States |
| Supabase | Database, authentication, and fallback file storage | Account data, persona data, consent records, and (as a storage fallback) uploaded photos and audio | United States |
| Cloudflare R2 | Object storage for uploaded biometric files | Your uploaded photos and voice recordings (the raw biometric source files) | United States |
| Resend | Sending transactional and account emails | Your email address | United States |
| Sentry | Error monitoring and reliability | Technical diagnostic data with personal identifiers removed | United States |
| PostHog | Product analytics and usage measurement | Usage and event data tied to your account identifier; no raw biometric data and no biometric source files | United States |
| Trigger.dev | Background job orchestration for persona generation | Job and run metadata that can include biometric-derived identifiers (e.g. persona and asset IDs); not raw biometric files | United States |
Each subprocessor is contractually required to (i) process your data only to provide its service to us, (ii) delete your data on our instruction, (iii) maintain appropriate security, and (iv) notify us promptly of any data breach. Where data is transferred outside your country, we rely on Standard Contractual Clauses or an equivalent safeguard.
We may update this list as our service evolves. Material changes to our subprocessors will be reflected here; if you have an active account we will provide notice of new subprocessors as required by law, giving you the opportunity to object. For biometric data specifically, we will notify you and obtain your renewed consent before disclosing your biometric data to any new recipient.
For biometric data specifically, please also see our Biometric Data Policy and BIPA Disclosure.
4. Data Retention
We retain your account information for as long as your account is active. Persona data (photos, voice recordings, generated assets) is retained for the lifetime of your persona plus 30 days after deletion. You may request deletion of your account and all associated data at any time.
5. Security
We implement industry-standard security measures including encryption at rest and in transit, multi-factor authentication, access controls, and regular security audits. However, no method of transmission or storage is 100% secure.
6. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access your personal data
- Correct inaccurate data
- Request deletion of your data
- Object to or restrict processing
- Data portability
- Withdraw consent at any time
To exercise these rights, contact us at privacy@persona-forge.ai.
7. Cookies
We use essential cookies for authentication and session management. We do not use third-party advertising cookies. Analytics cookies, if used, are anonymized.
8. Children's Privacy
PersonaForge is not intended for users under the age of 18. We do not knowingly collect information from children. If we learn that we have collected data from a child under 18, we will delete it promptly.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date.
10. Contact Us
If you have questions about this Privacy Policy, please contact us at: privacy@persona-forge.ai
M3T Labs
PersonaForge