Customer Privacy & Data Security Policy
Effective Date: January 1, 2026 • Compliant with global developer security benchmarks
1. Information We Collect
DevForge only collects information necessary to deliver code packages, fulfill orders, manage licensing entitlements, and prevent malicious distribution:
- Account Identity: Email address, customer name, and hashed passwords managed via bcrypt.
- Order Transactions: Authoritative order numbers, currency, line items, and statutory invoice requirements.
- Entitlement Records: Purchased software products, secure download timestamps, and active device session identifiers.
2. Payment Security & Razorpay Gateway
We do not store, process, or transmit raw credit card numbers or banking secrets on DevForge servers. All monetary transactions are processed through PCI-DSS Level 1 certified payment partners (Razorpay). All payment tokens, signatures, and webhook verifications use HMAC-SHA256 authoritative server-to-server validation.
3. Session Cookies & Single-Device Authentication
DevForge uses HttpOnly, SameSite=Strict cookies to maintain authenticated customer sessions and cart state across visits. A unique cryptographic session token ensures account isolation and terminates rogue concurrent logins across disparate devices.
4. Data Retention & Customer Rights
You maintain full ownership rights over your personal profile data. You may request data exports, update authentication details, or request account closure at any time through our customer support desk. In accordance with tax compliance requirements, order records are maintained for statutory accounting audits.