Privacy Policy
Updated
How Forward Engineer handles personal data: what we collect, why, for how long, and the rights you can exercise.
Who we are
Forward Engineer ("we") is an education initiative built and operated by the team behind the DevOpsify infrastructure platform (devopsify.net). Contact: support@forwardengineer.net. The registered legal entity name and address are added here at incorporation.
What we collect and why
| Data | Purpose | Basis | Retention |
|---|---|---|---|
| Email address | Account creation and login | Contract / legitimate use | Until account deletion |
| Learning progress, readiness quiz results | Providing the free member features | Contract | Until account deletion |
| Authentication and abuse events | Account security and abuse prevention | Legitimate interest | 30 days |
| Payment metadata (not card data) | Exam orders in SQLite: order id, email, item, amount, currency, status, provider reference and timestamps. | Contract | Kept while the purchase relationship stands; deletion workflow pending |
| Technical logs (IP, user agent) | Security, abuse prevention | Legitimate interest | 30 days |
| Support messages | Handling your requests | Contract | 12 months |
| One-time email codes | Proving email ownership at signup and the admin second factor | Contract / legitimate interest | Code valid 10 minutes; hashes pruned after 7 days |
Card data is never collected by us. Exam payments run through Paddle (merchant of record) hosted checkout; card numbers and security codes go to Paddle only.
Third-party processors
Hosting and media (Pexels: public images only, no personal data). Resend delivers one-time sign-in codes (recipient address and code only). Paddle processes exam payments as merchant of record (buyer email, item and amount; card data stays with Paddle).
Your rights
Our privacy compliance baseline is the EU General Data Protection Regulation (GDPR): access, correction, deletion, portability, objection, and restriction of processing. Exercise any of them via account settings or support@forwardengineer.net; we aim to respond within 30 days. For users in Türkiye, the local supervisory authority is the KVKK.
International transfers
Hosting and processors are selected to meet GDPR transfer rules: EU adequacy or standard contractual clauses. Transfers involving Türkiye follow the same safeguards, with local requirements applied where they exist. The current processor list is in the section above.
Changes
We version this policy; material changes are posted on this page before taking effect.