Privacy notice

Who we are

The controller of your personal data is DarkHorseOne Limited, a company registered in England and Wales under company number 15002342, at Suite 3.2, 27 Castle Street, Canterbury, Kent, CT1 2PX, England. Our ICO registration number is ZB913022. You can reach us through the contact form or at privacy@darkhorseone.co.uk.

On this website

What you type into a form, and nothing else about you.

Like most web servers, ours keep a technical access log of each request — the IP address it came from, the time, the address requested and the browser’s description of itself — to keep the service secure and to diagnose faults. We do not use it to build a profile of you. See the cookie policy for the complete list of what is stored in your browser.

Your PrimeForge account

You need an account to buy from the store and to sign PrimeForge Desktop in. You sign in with your email address: we email you a one-time code and link. Where we offer it, you can instead sign in with Google, LinkedIn or Microsoft.

• Account — your email address, and a name if a sign-in provider gave us one.
• Sign-in providers — if you use one, the identifier it gives us for you, and the email address, name and profile picture address it shares. We ask it for nothing else, and never for your contacts or posts.
• Signed-in sessions — for each browser you are signed in on, when it signed in and was last used, its IP address and its browser description, so that you and we can spot a sign-in that was not you.
• Security limits — short-lived counters, keyed by IP address and by email address, that stop sign-in codes from being guessed.

Sign-in codes, links and session keys are stored only as one-way hashes. The lawful basis is contract — we need these to give you the account you asked for — and, for the security records, our legitimate interest in keeping accounts safe.

Orders and payments

When you buy from the store, we keep:

• each order — which app, the price, its status, when it was placed and paid, and when a free trial ends;
• the references Stripe gives us for the payment, the customer and the subscription, and the events that changed the order (paid, renewed, refunded, cancelled);
• your library — which apps your account holds, since when, and until when;
• any free time we give your account, with the reason and the member of our team who gave it.

Payments are taken by Stripe. You type your card details into Stripe’s own checkout page, not ours, and we never see or store your card number. We give Stripe your email address and an internal account reference so that it can attach your subscription, invoices and receipts to you. Stripe processes payments on our behalf, and for some purposes — such as preventing fraud and meeting its own legal duties — under its own privacy policy.

The lawful basis is contract, and legal obligation for the records that tax and accounting law requires us to keep.

PrimeForge Desktop

Each time PrimeForge Desktop starts, it sends this computer’s basic setup to our server, so that if something goes wrong our support already knows what you are running. A new installation sends nothing until you have passed the notice that says so in the first-run setup. The Privacy page inside PrimeForge Desktop lists exactly what is sent:

• A code that stands for the computer — a one-way hash worked out from hardware identifiers. It stays the same across reinstalls and cannot be turned back into them; the identifiers themselves, such as the serial number, are never sent.
• System — Mac, Windows or Linux, its version, and the kind of processor.
• Hardware — the model (never the serial number), the processor’s name and core count, the memory, and the size and free space of the disk holding PrimeForge’s data.
• Versions — of PrimeForge and of its AI engine.
• AI agents — whether Claude and Codex are installed, and whether each is signed in: yes or no only, never which account.
• Language — the one PrimeForge uses.
• The start — when PrimeForge started, with a random number so a resend is not counted twice.
• Your account — if you are signed in, which PrimeForge account the computer belongs to.

It is encrypted on the way and encrypted while stored, and only our authorised support staff can read it. It never includes your user name, files, the apps you run or anything you write. The lawful basis is our legitimate interest in supporting the software you use; there is no switch to turn it off, so if you object, contact us.

PrimeForge Desktop also contacts our servers to sign you in, to read your library and the store’s catalogue, and to download the apps you install.

The AI work in PrimeForge apps runs on your computer through your own Claude account. What an app sends to Claude goes between your computer and Anthropic, under Anthropic’s terms and privacy policy; it does not pass through our servers. Apps that work with other services, such as LinkedBot with LinkedIn, do so from your own browser, under those services’ terms.

Emails we send

Account and store emails — your sign-in code and link, a confirmation when you link a sign-in provider, and notices about free time given to your account — are sent through Brevo, our email provider. They are part of running your account and are not marketing. The update emails you subscribe to on this website are separate, and only sent with your consent.

Analytics, only with your consent

If — and only if — you allow the analytics category, we use Google Analytics 4 to understand which pages of this website are read and how people arrive. Decline and the Google script is never requested, so nothing about your visit reaches Google.

When it is on, Google receives the pages you view and a small number of events: that a contact message was sent, that someone subscribed, and which product page was opened. It never receives your name, your email address or anything you typed into a form. Google processes this on our behalf, and does collect your IP address in order to do so, which it uses to derive an approximate location before discarding it. Advertising signals are switched off permanently, so the data is not used for ad personalisation.

The lawful basis is your consent, and you can withdraw it at any time from the cookie settings link in the footer. Withdrawing stops collection immediately and deletes the Google cookies from your browser.

Who sees it

The DarkHorseOne team, and these providers, each only for its own part:

• Amazon Web Services — hosts the servers and database behind accounts and the store, and stores app packages, in its London region.
• Stripe — takes payments and runs subscriptions.
• Brevo — sends account and store emails.
• Google, LinkedIn or Microsoft — only if you choose to sign in with one of them.
• Google Analytics — only if you have consented to analytics on this website.

We do not sell, rent or share your data for anyone else’s marketing. Contact messages and subscriber addresses are held on our own server in the United Kingdom rather than in a third-party marketing platform. We may disclose data where the law requires it.

Some of these providers process data outside the UK. Where they do, they rely on UK adequacy regulations, the UK extension to the EU–US Data Privacy Framework, or standard contractual clauses.

How long we keep it

• Contact messages — kept while the conversation is live and for up to 24 months afterwards, then deleted.
• Subscribers — kept until you unsubscribe. After that we keep only the record that you unsubscribed, so we do not accidentally add you again.
• Your account — until you delete it. Deleting it removes the account, its signed-in sessions, its sign-in provider links and any unused sign-in links straight away.
• Orders and payment records — six years, then deleted. They are not removed when you delete your account, because tax and accounting law requires us to keep them.
• Desktop setup records — two years after the computer last contacted us, then deleted. When you delete your account, the link between it and your computers is removed straight away; the setup record itself remains until then, no longer tied to anyone we can name.
• Server access logs — 30 days, then deleted.

Your rights

Under UK GDPR you can ask for a copy of what we hold about you, ask us to correct or delete it, object to how we use it, ask us to restrict it, ask for a copy in a portable form, or withdraw consent. Withdrawing consent is immediate and costs nothing: every update email has an unsubscribe link, and you can also ask us directly.

You can delete your PrimeForge account yourself from its security settings; cancel any subscription first, from your store account. For anything else, use the contact form or email privacy@darkhorseone.co.uk. If you are not satisfied with our response you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes

If this notice changes materially, we will update the date at the top, and tell account holders by email before the change applies.