K1FORGE Privacy Policy Effective date: 13 October 2026. Version: 2026-10-13.1. This policy explains how personal data is processed when you visit k1forge.com, create an account, build workspaces with AI, connect financial data sources or purchase K1FORGE services. The data involved depends on the features and connections you choose. 1. Who is responsible VikingSoft OÜ is the controller responsible for the processing described here. Registration number: 14840880. Address: Vesivärava tn 50-201, Tallinn 10152, Estonia. For privacy questions, requests or concerns, contact info@k1forge.com. Please identify the account or transaction concerned without sending passwords, API secrets or complete authentication tokens. Other services you connect, including Google, exchanges, brokers and payment providers, also process data under their own privacy notices. 2. Account and sign-in information We process your account identifier, email address, display name, registration information and authentication/session information. When you sign in with Google, we receive the account identifier and basic profile information supplied for sign-in, including your email address and, if provided, your name and profile image. The available information depends on your Google account and the sign-in permissions. Email/password registration and password recovery use our authentication infrastructure. Account emails support verification, access recovery and identification of purchases. Account information is necessary to provide authenticated features; without it, we cannot establish or maintain your personal workspace account. 3. Your workspaces and AI interactions We store workspace names and descriptions, prompts, chat messages and responses, generated or edited code, drafts, applied versions, settings and publication choices. Content may contain personal data that you include yourself. To answer a question or generate a workspace, relevant prompts, recent conversation history, current workspace code and selected context are sent through Lovable's AI gateway to the selected AI model provider. The current integration uses an OpenAI model. In dialogue mode, context can include balances, positions, orders, portfolios, quotes and results read from your connected sources. Credential-shaped fields are filtered from source context before submission. Only include information appropriate for this processing. Avoid putting passwords, API secrets or unnecessary personal information about yourself or others into prompts or code. 4. Connected sources and trading features Connections can involve exchange or broker account identifiers, connection labels, access permissions, API credentials, OAuth tokens and data returned by the selected provider. Depending on your provider and permissions, this can include balances, assets, positions, orders, transaction information and portfolio snapshots. Stored source credentials are encrypted on the server. They are used to authenticate authorised source requests. Requests may run through the browser or a regional connection server you select. Connection, routing and trading journals record identifiers, times, action status and results to enforce permissions and reconcile uncertain operations. You choose sources and access permissions. Pausing a connection can preserve its settings and credentials. Removing a connection does not necessarily revoke a key at the external provider or cancel an existing exchange order. 5. Purchases and communications For paid services, we process the buyer's name, country, individual/business status, optional business VAT identifier and verified account email. We retain order and product information, accepted terms, consent records, contract documents, payment status, token credits and refund requests. Cryptocurrency payments use Plisio. Invoice creation sends the order identifier, product description, amount, currency and payment-routing information. Payment handling also processes invoice identifiers, payment addresses, amounts and transaction evidence. Blockchain records can remain publicly accessible independently of K1FORGE. If you contact us, we process your contact details, message and relevant account or transaction information to respond, investigate problems and keep a record of the request. 6. Purposes and legal bases We process account information, workspace content, requested AI interactions, selected connections and purchases to provide the services you request and perform our agreement with you, including steps taken at your request before purchase (GDPR Article 6(1)(b)). Security, access controls, technical diagnostics, preventing duplicate commands or payments, and resolving service issues serve our legitimate interests in a reliable and secure service (Article 6(1)(f)), balanced against your rights. Relevant records may also be needed to establish, exercise or defend legal claims. Accounting, tax and other legally required records are processed to meet applicable legal obligations (Article 6(1)(c)). Where a particular activity relies on consent, that consent can be withdrawn for future processing (Article 6(1)(a)). A feature permission or acceptance of commercial terms is not automatically consent for every use of personal data. 7. Browser storage and technical information The application uses browser storage for authentication sessions, language and theme preferences, interface settings, local code recovery copies and connection coordination. Clearing site storage can sign you out and remove local preferences or unsaved recovery copies. It does not delete records already stored on our servers. Some authorisation flows use security cookies, including a short-lived cookie that binds an InteractiveBrokers authorisation request to your browser. Requests to hosting infrastructure and external resources involve technical information such as IP address and browser/request details. Google Fonts supplies fonts used by the application. Error handling can process the affected page, error message and stack information through the hosting platform's logging and error-reporting facilities, including Lovable. 8. Who receives information Recipients depend on the features used. They include Lovable and Supabase-based infrastructure for application hosting, authentication and data storage; Lovable's AI gateway and the selected AI provider for requested AI operations; Railway for selected regional connection services; Plisio for payments; and Google for sign-in and font resources. A connected exchange, broker or other source receives the information needed for the request you authorise. Authorised personnel and service providers may process information needed for support, security and administration. Relevant information may be disclosed where legally required or necessary to handle a legal claim. If you publish a workspace, its content and available data can become accessible according to your selected access settings. Invitation lists contain the email addresses you enter. Review the publication settings before sharing. 9. International processing Some service providers may process data outside the European Economic Area, including in the United States. Selecting a connection server in Singapore involves processing through that location. A selected connection region does not determine the locations of every other component, such as authentication, AI, payment processing or backups. Contact info@k1forge.com for information about the international processing relevant to your use of the service. You can request information about the safeguards applicable to a particular transfer, and copies of those safeguards, at info@k1forge.com. Lovable describes its own international processing and safeguards in its [Privacy Policy](https://lovable.dev/privacy). 10. How long information is kept Retention depends on the purpose and category of information: - Account and workspace information is retained while needed to provide the account and saved content, and to handle closure or deletion requests. - Source credentials are retained while the saved connection requires them; clearing or removing a connection affects these credentials, while action journals may remain necessary to reconcile transactions or resolve disputes. - Purchase, consent, payment and refund records are retained for the applicable accounting and tax requirements and relevant claims periods. - Support and diagnostic records are retained according to the issue, security need and any related claim. - Local browser information remains until the application updates it or you clear it; backup retention depends on the infrastructure involved. The current workspace deletion action archives the workspace; it does not itself erase the stored code and messages. To request erasure of an account or stored content, contact us. We assess what can be deleted and what must be retained, rather than treating disconnection or archiving as complete erasure. 11. Your choices and rights Subject to applicable conditions, you can request access to your personal data, correction, erasure, restriction of processing and a portable copy of data. You can object to processing based on legitimate interests and withdraw consent where processing relies on it. Withdrawal does not affect the lawfulness of earlier processing. Send requests to info@k1forge.com. We may request proportionate information to verify your identity. GDPR requests are normally answered within one month; where a lawful extension is necessary, we explain it. Rights may be limited by legal retention obligations or the rights of others. You can complain to the [Estonian Data Protection Inspectorate](https://www.aki.ee/en) or another competent supervisory authority, including in the country where you live or work. 12. AI and your decisions AI assists with responses and workspace generation; the resulting content can be inaccurate. You remain responsible for reviewing generated outputs and choosing financial actions. Supported trading functions use the permissions and confirmation steps applicable to the connection. Automated technical checks also validate access, quotas and payment status. Contact us if you believe an automated result has incorrectly affected your account or purchase. 13. Changes and contact We may update this policy when the service or its processing changes. The effective date and version identify the text currently published. Material changes will be communicated as appropriate to their impact and applicable requirements. For questions about this policy or your data, write to info@k1forge.com or VikingSoft OÜ at the address above.