PersonaForge ("we," "us," or "our"), operated by M3T Labs, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at persona-forge.ai and related services.
1. Information We Collect
Account Information
When you create an account, we collect your name, email address, and authentication credentials. If you sign in with a third-party provider (e.g., Google), we receive your name and email from that provider.
Persona Data
To create your AI persona, you may provide photos, voice recordings, and written content. Photos and voice recordings are used to generate biometric data (facial geometry and voiceprints). See our Biometric Data Policy for details on how biometric data is handled.
Usage Data
We automatically collect information about how you interact with our platform, including IP address, browser type, pages visited, and timestamps.
1a. Waitlist Signups (Closed Beta)
When you join the PersonaForge beta waitlist we process the following categories of data so we can notify you when an invite is ready and so we can prove your consent was freely given:
- Email address, your selected use case, and an explicit consent flag, processed on the lawful basis of consent (GDPR Art 6(1)(a)). You can withdraw consent at any time via the one-click unsubscribe link in every email or by emailing us.
- HMAC-hashed IP address and user agent, processed on the lawful basis of legitimate interest (GDPR Art 6(1)(f)) for abuse prevention and rate limiting. We do not retain the raw values.
- A timestamped snapshot of the consent text you ticked, retained for seven years to demonstrate the consent chain (GDPR Art 7(1)). PII fields (email and IP/UA hashes) are erased immediately when you unsubscribe; the timestamped evidentiary record remains.
Anonymous usage measurement. We also record a small number of usage events for this form: that a signup was submitted, that it succeeded, or that it failed and the general reason why; which option you picked from the use-case list (never anything you type); which version of the consent text you were shown; and how long the submission took. Anonymous here means what it sounds like — these events carry no email address and no free text, and we do not link them to your waitlist entry, to your name, or to any account. They set no cookie and store nothing on your device. We use them only to measure whether the signup form works. The categories of provider that help us do this are listed in section 3a.
Recipients: PersonaForge staff (M3T Labs) and our cloud hosting provider under a Data Processing Agreement. The anonymous usage events described above — and only those — also go to our product-analytics provider; section 3a lists the categories of every provider we use. We do not share waitlist data with advertisers or sell it.
Data subject rights (30-day SLA): you can request access, correction, deletion, or portability of your waitlist data by emailing privacy@persona-forge.ai. We will respond within 30 days as required by GDPR Art 12(3). The one-click unsubscribe link in every waitlist email also acts as a deletion request and is honored within 24 hours per CAN-SPAM §5.
2. How We Use Your Information
- To create, operate, and maintain your AI persona
- To provide, maintain, and improve our platform
- To authenticate your identity and secure your account
- To communicate with you about your account and our services
- To comply with legal obligations
- To detect, prevent, and address fraud or technical issues
3. Data Sharing
We do not sell your personal information. We may share your information with:
- Service providers who assist in operating our platform (cloud hosting, AI model providers), under strict data processing agreements.
- Law enforcement, courts or regulators when valid legal process or applicable law requires it. We release biometric data only under a valid warrant or a subpoena issued by a court of competent jurisdiction, or when a law requires us to report it.
- Business transfers in connection with a merger, acquisition, or sale of assets.
3a. Service providers
Categories list last updated: September 20, 2026
To operate PersonaForge we share limited personal data with carefully selected service providers ("subprocessors") who process it only on our instructions, under a Data Processing Agreement, and never to train their own models on your data. We do not sell your personal information, and we do not sell, lease, trade, or otherwise profit from your biometric data. We use the following categories of service provider:
| Category of service provider | Purpose | Data shared with them | Region |
|---|---|---|---|
| Cloud hosting, database and authentication | Running the platform and storing your records | Account data, persona data, consent records, and — as a storage fallback — uploaded photos and audio | United States |
| Object storage | Storing the files you upload | Your photos and voice recordings (the raw biometric source files) | United States |
| 3D avatar generation | Building your persona's avatar | Your photos and the facial geometry derived from them | United States |
| Voice cloning and speech synthesis | Creating and playing your persona's voice | Your voice recordings and the derived voiceprint | United States |
| Large-language-model inference | Generating your persona's conversational responses | Your persona's personality data and conversation content (not raw biometric files) | United States |
| Transactional email | Sending account and service emails | Your email address | United States |
| Payment processing | Processing subscriptions and billing | Billing contact and payment metadata; card details go directly to the payment processor and we never hold them | United States |
| Error monitoring | Monitoring reliability and debugging | Technical diagnostic data with personal identifiers removed | United States |
| Product analytics | Measuring how the product is used | Usage and event data. For signed-in users this is tied to your account identifier. On our public pages, including the waitlist form, it is limited to events we do not link to an account, an email address or a name. Never biometric data and never biometric source files | United States |
| Background job orchestration | Running the jobs that build your persona | Job and run metadata that can include persona and asset IDs; not raw biometric files | United States |
| Speech recognition and transcription | Turning what you say out loud into text so your persona can respond | The audio you speak during a voice conversation and the text transcript of it | United States |
| Text embeddings for persona knowledge | Indexing the material you give your persona so it can find the right answer | The writing samples, documents and notes you add as persona knowledge; no biometric data and no biometric source files | United States |
| Rate limiting and session storage | Protecting the service from abuse and keeping your sessions valid | Short-lived session and request tokens, a one-way hash of your IP address, and temporary copies of API responses used to make retries safe; no biometric data and no biometric source files | United States |
Each service provider is contractually required to (i) process your data only to provide its service to us, (ii) delete your data on our instruction, (iii) maintain appropriate security, and (iv) notify us promptly of any data breach. Where data is transferred outside your country, we rely on Standard Contractual Clauses or an equivalent safeguard.
Asking who they are. We publish categories rather than a standing vendor list. If you want the identity of the specific service providers we use — including the ones that have received your own personal data — email legal@persona-forge.ai and we will tell you. We aim to answer within 10 business days and will always answer within 30 days. Business customers receive the named list, and advance notice of changes to it, under their Data Processing Agreement.
Changes. We may change service providers as the product evolves. We will update this page when the categories change, and if you have an account we will give notice of changes to the providers that handle your data where the law requires it, so that you have the opportunity to object. For biometric data specifically, except where a valid warrant, a subpoena issued by a court of competent jurisdiction, or a law requires disclosure, we will notify you and obtain your renewed consent before disclosing your biometric data to any new recipient.
Changes to this list
- September 20, 2026: Re-scoped the product-analytics category: as well as usage data tied to an account identifier, it now also receives anonymous usage events from our public pages, including the waitlist form. Those events carry no email address, no free text and no biometric data, are not linked to an account, and set no cookie. No provider was added, removed or changed, and no other category, purpose, data type, region or promise changed.
- September 19, 2026: Added three service-provider categories — speech recognition and transcription, text embeddings for persona knowledge, and rate limiting and session storage — so this table lists every category of recipient we use and is complete. These providers were already in service; no new data sharing was created, and no existing category, purpose, data type, region or promise changed.
- September 19, 2026: Replaced the named service-provider table with the categories table above. No category, purpose, data type, region, or promise changed — only the identity-level disclosure moved from this public page to the on-request channel (email legal@persona-forge.ai) and, for business customers, to the Data Processing Agreement.
We share your personal information with no affiliated companies other than M3T Labs, which operates PersonaForge.
For biometric data specifically, please also see our Biometric Data Policy and BIPA Disclosure.
4. Data Retention
We retain your account information for as long as your account is active. Persona data (photos, voice recordings, generated assets) is retained for the lifetime of your persona. After you delete a persona (restorable for 7 days) or your account (cancellable for 14 days), we complete destruction of biometric data within 30 days of your request unless we must preserve it. Records of your biometric consents are kept for six years after the biometric data they cover is destroyed. They show which account consented, when, to what, under which notice version and how, and record that the data was destroyed; they never contain the biometric data itself. These records do not include your account email address, so after your account is deleted we may not be able to link them to you unless you give us details that let us do so. When a persona is deleted, its name, description and personality data are removed, but its conversation transcripts are kept with the remaining record, for billing, safety and legal purposes, for as long as your account exists. When your account is deleted, those transcripts are deleted with it, unless we must keep them to meet a legal obligation, to preserve evidence for a report or investigation, or to establish or defend legal claims. Billing and usage records are kept for as long as tax, accounting or other legal obligations require. We keep some records longer where the law requires or allows it — for example to comply with a legal obligation, to preserve evidence for a report or investigation, or to establish or defend legal claims. You may request deletion of your account and associated data at any time; the records described above are kept only as stated.
5. Security
We implement industry-standard security measures including encryption at rest and in transit, multi-factor authentication, access controls, and regular security audits. However, no method of transmission or storage is 100% secure.
6. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access your personal data
- Correct inaccurate data
- Request deletion of your data
- Object to or restrict processing
- Data portability
- Withdraw consent at any time
To exercise these rights, contact us at privacy@persona-forge.ai.
7. Cookies
We use essential cookies for authentication and session management. We do not use advertising cookies, and we do not let anyone track you across other websites. Our product analytics is cookieless: it stores nothing on your device — no cookie and no local storage — and we do not use session recording, screen replay, or automatic capture of everything you click.
8. Children's Privacy
PersonaForge is not intended for users under the age of 18. We do not knowingly collect information from children. If we learn that we have collected data from a child under 18, we will delete it promptly.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date.
10. Contact Us
If you have questions about this Privacy Policy, please contact us at: privacy@persona-forge.ai
M3T Labs
PersonaForge