Version 1.0 · Effective 5 October 2026
This policy explains how HMT Engineering SARL ("SFXForge AI", "we", "us") handles personal data when you use SFXForge AI. It applies to our website, the dashboard and sign-in pages (the "Web App"), our Unity Editor plugin (the "Plugin"), and our application programming interface and MCP server, which you use with a personal API key from your own scripts, tools and AI agents (the "API"). Together they are the "Service", as in our Terms of Service. Words such as "Prompts", "Outputs", "Credits", "Library" and "Account" have the same meaning here as there.
In short:
- We collect what we need to run your Account and generate your sounds: your email address, your Prompts and the sounds made from them, your Credits, and basic technical data.
- Your Prompts are processed by a GPU platform that runs our AI model for us. We send them without your name, email address or any ID, and they are not sent to the company that made the model.
- We count website visits with a cookie-free analytics tool. Our fonts are hosted on our own servers.
- We don't sell your data, show ads or track you across other sites.
- If you connect an AI agent or another tool to your Account with an API key, the tool and its provider receive what the API returns to it.
- You can ask us to access, correct or delete your data at privacy@sfxforgeai.com.
This summary doesn't replace the full policy below.
1. Who is responsible
HMT Engineering SARL, a société à responsabilité limitée registered in the Luxembourg Trade and Companies Register (RCS) under number B229278, with its registered office at 10, rue Jean-Pierre Ries, L-6143 Junglinster, Luxembourg, is the controller of your personal data in the Service. You can reach us at privacy@sfxforgeai.com. We have not appointed a data protection officer.
2. The personal data we process
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Your email address (which is also your username), a hashed password, whether you have confirmed your email, whether your Account is blocked, and when it was created | You, when you sign up |
| Duplicate-sign-up check | A normalized form of your email address (for example with dots and "+tags" removed), used to spot duplicate sign-ups and repeat free-trial claims, and a record of whether you have claimed the free trial | Derived from your email address |
| Prompts, Outputs and Library | Your Prompts, the audio generated from them, its length and waveform, the names of your sounds and folders, and dates | You, and generated for you |
| Credits and purchases | A ledger of the Credits you received (free trial, purchases) and spent, with dates and amounts. For purchases: the pack, price, date, a payment reference from Stripe, your billing country and postcode (and, for businesses, the company name and VAT number you enter), which work out the VAT and appear on your invoice, when you gave the consent at checkout about your right of withdrawal, and, if you withdraw, when you did and the status of the refund. We never receive your full card number | You, the Service and Stripe |
| Sign-in and device data | For each sign-in: a random device ID, whether it was the Web App or the Plugin, a coarse browser and operating-system label such as "Chrome on macOS" (Web App only), and sign-in and expiry times. For Plugin sign-in, a one-time code, stored only as a hash and valid for 2 minutes | Your browser or the Plugin |
| API keys | For each key: the name you give it, a hash of the key (we never store the key itself), its last four characters, when it was created, when it expires, when it was last used, and the Credit limit you set. Your Credit ledger also records which key each generation was charged to | You, and the Service |
| Emails we send you | Your address, the kind of email (such as an email confirmation or a purchase confirmation), the details used to build it (such as the confirmation link or the pack name), and whether it was delivered | Us |
| Messages to us | What you send us, and our replies | You |
| Website usage data | The pages you visit, the site that referred you, your browser, operating system and device type, and your approximate location (country, region, city) worked out from your IP address. We don't store your IP address or use cookies for this | Your browser |
| Technical connection data | Your IP address and browser details, which your device sends to our servers and our providers' servers whenever you use the Service. We use them to deliver pages, limit abuse and keep the Service secure, and keep server logs for 30 days. We also look up the country of your IP address in a database on our own server, to show prices in euros or US dollars; we don't store the result | Your device |
What we don't collect. We don't collect your full payment card details, and we don't intentionally collect sensitive categories of data such as health data or data about your political opinions. Please don't put personal or confidential information in your Prompts: they are saved with your sounds and used as the sound's name and file name. We don't use advertising trackers or follow you across other sites.
The AI marks. The marks in every Output, a watermark with a fixed code that identifies SFXForge AI and metadata tags saying the audio is AI-generated, contain no personal data.
3. Why we use your data, and our legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your Account, confirm your email, sign you in and keep you signed in | Account data; sign-in and device data; emails we send you | Contract (Art. 6(1)(b) GDPR) |
| Authenticate requests made with your API keys, and apply the expiry and Credit limit you set on each key | API keys; account data | Contract |
| Generate your sounds, save them to your Library, and let you play, download, organize and delete them | Prompts, Outputs and Library | Contract |
| Run Credits, the free trial and purchases, and take payment | Credits and purchases; account data | Contract; legal obligation for accounting and tax records (Art. 6(1)(c)) |
| Send emails needed to run the Service, such as email confirmation and purchase confirmations | Account data; emails we send you | Contract |
| Keep the Service secure and prevent abuse and fraud: limit request rates, spot duplicate sign-ups and repeat free-trial claims, block abusive Accounts, review Prompts and Outputs where we suspect a breach of the Terms, and investigate incidents | Account data; duplicate-sign-up check; sign-in and device data; technical connection data; Prompts and Outputs where abuse is suspected | Legitimate interests (Art. 6(1)(f)): protecting the Service, our users and ourselves |
| Show prices in your currency, from the country of your IP address | Technical connection data | Legitimate interests: showing the right prices |
| See how the website is used and improve it | Website usage data | Legitimate interests: improving our website with a cookie-free tool |
| Improve the Service, including how sounds are generated, using Prompts without your email address or Account details | Prompts and Outputs | Legitimate interests: making the Service better |
| Answer your questions and requests | Messages to us; account data | Contract; legitimate interests |
| Meet legal obligations, such as accounting, tax and requests from authorities | Credits and purchases; account data | Legal obligation (Art. 6(1)(c)) |
| Establish, exercise or defend legal claims | Any data relevant to the claim | Legitimate interests |
We don't use your Outputs to train AI models. We don't sell personal data or use it for advertising or profiling. We don't send marketing emails. If that changes, we will ask for your consent where the law requires it. Where we rely on legitimate interests, you can object (Section 8).
4. Who receives your data
We share personal data only with providers that process it for us on our instructions, and where the law requires it. Our main providers are:
| Provider | What it does for us | Data it handles | Where |
|---|---|---|---|
| Inference Shell Inc. ("inference.sh") | Runs the AI model that generates your sounds on GPU servers | Your Prompts and the generated audio, sent without your name, email address or any ID | United States. Its own infrastructure providers are in Germany (Hetzner, Leaseweb) and the United States (Google Cloud), plus Cloudflare |
| MackNet | Hosts our servers and database | Account data, Prompts, Library details, Credits, sign-in and device data, email log | Luxembourg |
| MackNet | Stores your audio files in a private bucket; files are named after your Prompts | Outputs and Prompts (in file names) | Luxembourg |
| Cloudflare, Inc. | Runs our own email-sending service, which delivers the emails we send you. We don't track whether you open them or click their links | Your email address and the content of each email | United States, and Cloudflare's global network |
| Stripe Payments Europe, Limited (Ireland), and other Stripe group companies | Process payments | Payment and purchase details, your billing country and postcode, and, on the checkout page, device and connection data that Stripe uses to prevent fraud. We never see your full card number | EU and United States |
| Hetzner Online GmbH | Hosts the server on which we run Plausible Analytics ourselves (plausible.hmt.engineering), which counts website visits | Website usage data | Germany |
We send inference.sh only the Prompt and the generation settings, never your name, email address, Account or IP address, so in normal use it doesn't receive personal data. Prompts are free text, though, so please don't put personal information in them: if you do, it is processed there like the rest of the Prompt. We download the AI model files from Hugging Face onto the GPU platform, which involves no personal data. Our technology licensors, Stability AI and Google, don't receive personal data from the Service. We also share data with professional advisers (such as lawyers and accountants), with authorities when the law requires it, and with a buyer or successor if we sell or reorganize our business, who must respect this policy. We don't sell your personal data.
AI agents and other tools you connect. When you connect an AI agent, assistant or other tool to the Service with an API key, the tool, and the company that provides it (for example the maker of your coding assistant or of the AI model behind it), receive what the tool sends us, such as your Prompts, and what the API returns to it, such as the names and Prompts of your sounds, your folders, download links for your audio and your Credit balance. You choose to share this data with them: they are not our providers, and they handle it under their own terms and privacy policies, which you should check before you connect a tool.
5. Transfers outside the EU and EEA
Some of our providers are based in the United States or move data there, including Stripe and Cloudflare, and inference.sh for any personal data that ends up in a Prompt. When they do, we rely on the EU-US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses otherwise, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards at privacy@sfxforgeai.com.
6. How long we keep your data
| Data | How long |
|---|---|
| Account data | While your Account is open. After you close it, we delete or anonymize it within 30 days, except what we must keep (below) |
| Prompts, Outputs and Library | Until you delete the sound or close your Account. We then remove them, including from our providers' systems, within 30 days |
| Copies held by the GPU platform | We delete the audio files of each generation as soon as we have retrieved them. inference.sh keeps its own API logs, which can include the Prompt, for up to 90 days |
| Credits and purchase records | 10 years from the end of the financial year of the transaction, as accounting law requires. If your Account is closed, we keep these records without your Library or Prompts |
| Duplicate-sign-up check | While your Account is open and for 12 months after it closes, to stop repeat free-trial claims |
| API keys | Until you revoke the key, reset your password or close your Account. An expired key can no longer be used but stays in your list in the Web App until you revoke it. When a key is deleted, so is the record of which generations were charged to it |
| Emails we send you (log) | 12 months |
| Sign-in and device data | Until the session ends or you sign out, which is at most 30 days after you sign in. Expired records can no longer be used and are cleaned up automatically |
| Website usage data | Aggregated statistics without personal identifiers, kept for 24 months |
| Server and security logs | 30 days |
| Backups | Rolling backups kept for 7 days |
| Messages to us | 3 years after we resolve the request |
7. Cookies, local storage and similar technologies
Web App. We use only what is needed to run the Service and to remember your choices:
| Name | Type | What it does | How long |
|---|---|---|---|
strapi_up_refresh |
Cookie (httpOnly, SameSite Lax, Secure on the live site) | Keeps you signed in by holding a sign-in token | Up to 30 days from sign-in; removed when you sign out |
HotTotem.SFXForgeAI.deviceId |
Local storage | A random ID for this browser, so your sign-in on it can be recognized and revoked | Until you clear your browser data |
HotTotem.SFXForgeAI.generateFolder |
Local storage | Remembers the folder you last chose to save sounds in | Until you clear your browser data |
HotTotem.SFXForgeAI.generateFormat |
Local storage | Remembers whether you chose MP3 or WAV | Until you clear your browser data |
HotTotem.SFXForgeAI.expandedFolders |
Local storage | Remembers which Library folders are open | Until you clear your browser data |
The short-lived access token that your browser uses while you work is kept in memory only. We don't use advertising or tracking cookies.
Analytics. We use Plausible, a cookie-free analytics tool that we run on our own server. It doesn't store cookies or anything else on your device, doesn't store your IP address, and counts visitors with a daily-changing code that can't be traced back to you. It records the page, referrer, browser, operating system, device type and approximate location (country, region, city).
Payments. The payment form on the checkout page is provided by Stripe and loaded from Stripe's servers, only when you open the checkout. Stripe sets cookies such as __stripe_mid (kept for 1 year) and __stripe_sid (30 minutes) to prevent fraud, which is necessary to accept your payment. See Stripe's cookie policy at https://stripe.com/cookies-policy/legal.
Plugin. The Plugin stores the following on your computer:
- In Unity's editor preferences, which are shared by all your Unity projects on that computer: your sign-in tokens, the server address, your Account's username, email address and IDs, a random device ID (it stays after you sign out), and your chosen output folder. Signing out removes the tokens and your Account details.
- In each project's
UserSettingsfolder: the server folder you last selected. - In your project: the sounds you generate or download (by default in
Assets/SFXForgeAI), and a hidden preview cache in thePackagesfolder that is cleared once per editor session.
The Plugin makes network requests only while its window is open, when the window regains focus and when you act. When you sign in, it opens your browser and listens briefly on a local address (127.0.0.1) to receive the result. It doesn't collect your Unity version, project name or other information about your computer.
8. Your rights
You have the right to:
- access your personal data and get a copy of it;
- have inaccurate data corrected;
- have your data erased, in the cases the law provides;
- restrict how we use your data, in the cases the law provides;
- receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another service where we process it under contract (portability);
- object at any time to processing based on our legitimate interests;
- withdraw consent where we rely on it (we currently don't);
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (Section 11).
How to use your rights. Email privacy@sfxforgeai.com. There is no self-service export or Account deletion in the Web App yet: you can delete individual sounds in your Library, and everything else goes through email. We will answer within one month. If your request is complex or we receive many, we can extend that by up to two more months, and we will tell you why. We may ask you to prove who you are. It is free, unless a request is clearly unfounded or excessive.
Complaints. You can complain to a data protection authority, in particular in the country where you live or work, or where you think the law was broken. In Luxembourg, that is the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg, https://cnpd.lu, telephone +352 26 10 60-1. Its complaint form is at https://cnpd.public.lu/fr/particuliers/faire-valoir/formulaire-plainte.html.
9. Security
We protect your data with measures that fit the risk, including:
- encrypted connections (TLS) between your browser or the Plugin and our servers;
- passwords stored only in hashed form;
- short-lived access tokens (10 minutes) and sign-in tokens that are replaced every time they are used, with a sign-in that ends after 14 days without use, or 30 days in total;
- for the Plugin, a browser-based sign-in using a one-time code that expires after 2 minutes and is stored only as a hash;
- API keys stored only as a hash and shown to you only once, when you create them, with an optional expiry and Credit limit; they stop working if your Account is blocked, and are deleted when you reset your password;
- private file storage, with each download link valid for 15 minutes;
- limits on who can access personal data: only people who need it for support, security or legal reasons.
No system is perfectly secure. If a personal-data breach is likely to put you at risk, we will tell you and the authorities as the law requires.
10. Children
The Service is for people who are at least 18 years old. We don't knowingly collect personal data from anyone younger. If you think a child has given us personal data, email privacy@sfxforgeai.com and we will delete it.
11. Automated processing and AI
- Generating sounds. An AI model turns your Prompt into audio. That is not profiling, and it doesn't produce any decision about you.
- Duplicate sign-ups. We compare a normalized form of your email address with those of other Accounts, and we limit how often certain requests can be made. If the check finds a match, we may refuse a sign-up or a free-trial claim. This has no legal effect on you, and you can email privacy@sfxforgeai.com to have a person look at it.
- No other automated decisions. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
- No training on your Outputs. We don't use your Outputs to train AI models.
12. Changes to this policy
We may update this policy, for example when we add a provider or a feature. Each version has a version number and a date. If a change is material, we will tell you by email or in the Web App at least 30 days before it takes effect.
13. Contact
HMT Engineering SARL, 10, rue Jean-Pierre Ries, L-6143 Junglinster, Luxembourg. Privacy: privacy@sfxforgeai.com. General support: support@sfxforgeai.com.