← Back to the website

Privacy Notice

Last updated: 5 October 2026

This notice explains how Module Forge handles information submitted through this website. It covers project enquiries, call bookings, email sent to our addresses, visit statistics and the technical data needed to run and protect the site.

1. Who handles the data

The data controller and website operator is Module Forge. Privacy questions and data-subject requests can be sent to hello@moduleforge.studio.

2. Information we receive

When you send a project enquiry, we receive your name, email address, company, studio or project name, role, the service and engagement type you choose, project stage, timing, indicative budget, engine and tools, project description, the page you sent it from, and the referral or campaign source of your visit.

When you email an address at moduleforge.studio, we receive your message, its headers and your email address. A copy is kept in our internal system that tracks our conversations with clients and our replies to job posts.

To protect the enquiry form from spam, Cloudflare Turnstile runs when you scroll near the form or start filling it in; on the call booking form it runs only when you start filling it in. It processes your IP address and technical signals from your browser to tell people and bots apart. Your IP address is also used for one minute to limit repeated submissions from the same address.

Scheduling a call

When you book a call, we receive your name, your email address (which you confirm with a code we email to you), your company, studio or project name, your role and website if you give them, the service you choose, your short description of the project and of what you want from the call, the time and time zone you choose and, if you choose Discord, your Discord username.

We use these details to arrange and prepare the call, and to email you the code, the confirmation, any change of time and a cancellation. A short summary (the time, your name, your company or project and the chosen service) is also used by our internal assistant to announce the call to our owner; it does not receive your email address or your description. The call itself runs on the service you choose: a video call on Jitsi Meet (meet.jit.si, run by 8x8) on a link we create for your booking, or Discord. Each provider processes data under its own terms and privacy notice.

To stop the calendar from being filled by abuse, each booking is linked to a security code made with a secret key from your network address (for IPv6 connections, the network prefix). We do not store the IP address itself. The code is pseudonymous: it shows that two booking attempts came from the same network, so we normally allow one upcoming booking per email address and per network at a time. Shared networks can affect more than one person; if this stops a genuine booking, email hello@moduleforge.studio. Please keep the booking form free of confidential project material, passwords and sensitive personal information.

3. Why we use it

We do not use project enquiries for unrelated advertising and we do not sell personal data.

4. Legal basis

Depending on the enquiry, processing is necessary to take steps at your request before entering into a contract, or is based on our legitimate interest in responding to business enquiries and protecting the website. Booking a call is processed to take the steps you ask for before a possible contract; the booking security code described in section 2 is based on our legitimate interest in protecting the calendar from abuse. Where a separate optional service needs consent, we ask for it separately.

5. Service providers

Cloudflare provides the website's hosting, network, security, spam protection (Turnstile) and web analytics, and forwards enquiries to us by email. Resend is a fallback email delivery channel for enquiries and sends the booking emails (the code, the confirmation, changes and cancellations). Booking details are stored in Cloudflare's database service and copied to our private operations server. Enquiries are then stored in the mailbox of our email provider, and a copy is kept in our internal system that tracks our conversations with clients, so an enquiry is not lost if email delivery fails. These providers process data on our instructions, under their data-processing terms and only as needed to provide their service. Cloudflare processes Turnstile signals on our behalf to protect the site, and also as a controller to improve its bot detection, as described in its Turnstile Privacy Addendum.

6. Retention

Enquiries that do not lead to a project are deleted within 12 months of our last contact with you, unless a longer period is needed to continue a discussion you asked for, to establish or defend a legal claim, or to comply with a legal obligation. Information that becomes part of a client relationship is kept under the applicable contract and our business records policy. Visit statistics (section 9) are deleted after 13 months. Call bookings are deleted 12 months after the call or its cancellation. The one-booking restriction ends when the call ends or is cancelled. Booking codes expire after ten minutes, and their records, together with the short-lived records used to limit repeated bookings, are deleted within a day. Deleted information may remain for a short time in restricted backups until those expire.

7. International transfers

Some providers may process data outside the European Economic Area. Such transfers rely on safeguards recognised by data-protection law, such as an adequacy decision or standard contractual clauses.

8. Your rights

Subject to applicable law, you can ask for access to, correction, deletion, restriction or portability of your personal data, and you can object to processing based on legitimate interests. You can also complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or to the supervisory authority where you live.

9. Cookies and analytics

The website sets no advertising cookies. We use Cloudflare Web Analytics to count page views and measure page speed. It does not use cookies and does not build profiles of individual visitors. Cloudflare Turnstile, described in section 2, may store data in your browser that it needs for the security check.

We also keep our own visit statistics, without cookies. For each page view we record the page, the referring site or campaign, your browser and device type, and the approximate location and network that Cloudflare derives from your IP address (country, region, city and the name of the network, such as an internet provider or a company). We also count a few interactions: playing a video, following a link to another site or to an email address, opening or sending the enquiry form, and spending time on a page. We do not store your IP address in these statistics, and the booking security code described in section 2 is not used to measure or link visits. To count unique visits we keep a one-way code made from your IP address, your browser details, the date, a secret value and a random value that is replaced and deleted every day; the code changes every day, so a visit cannot be linked to visits on other days, and once the day is over nobody can work out which address a code came from. For referring sites we keep only the address of the page, not its query string. We use these statistics only in aggregate, to understand how the website is found and used, on the basis of our legitimate interest, and we delete them after 13 months.

We use session storage named mf-source to remember the referring site or campaign for the length of your browser tab session. If you send an enquiry, that information goes with it so we know how you found us; otherwise it is deleted when you close the tab.

Our Work page shows official game videos hosted on YouTube. Nothing is loaded from YouTube until you press a video's play button. The video then loads from youtube-nocookie.com, Google's privacy-enhanced embed, and Google receives your IP address and browser details and may store data in your browser under its own privacy policy. You can watch the same videos on YouTube through the link under each player instead.

10. Changes

We update this notice when the website, providers or processing change. The "Last updated" date above shows the current version.