Privacy Policy

Effective Date: February 11, 2026

Last Updated: February 11, 2026

This Privacy Policy ("Policy") describes how Puggi Industries, LLC, a New Mexico limited liability company doing business as Fourever ("Company," "we," "us," "our"), collects, uses, discloses, and protects your personal information when you access or use the Fourever platform, website located at fourever.ai, and all related services, applications, and tools (collectively, the "Service").

This Policy applies to all users of the Service, regardless of location. Additional provisions apply to residents of the European Economic Area ("EEA"), the United Kingdom ("UK"), Switzerland, and the State of California, as described in Sections 11 and 12 below.

By accessing or using the Service, you acknowledge that you have read, understood, and agree to the collection and use of your personal information in accordance with this Policy. If you do not agree to this Policy, you must not access or use the Service.

This Policy is incorporated into and subject to our Terms of Service.

Definitions
Information We Collect
How We Use Your Information
Legal Bases for Processing (EEA/UK Users)
How We Share Your Information
Third-Party Service Providers and Data Processors
Data Transmission to AI Providers
Cookies and Tracking Technologies
Data Retention
Data Security
Your Rights and Choices
Region-Specific Disclosures
Children's Privacy
International Data Transfers
Third-Party Links
Changes to This Policy
Contact Us

1. Definitions

For the purposes of this Policy:

"Personal Information" (also referred to as "Personal Data") means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you as an individual.
"Processing" means any operation or set of operations performed on Personal Information, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, combination, restriction, erasure, or destruction.
"Data Controller" means the entity that determines the purposes and means of Processing Personal Information. With respect to the data described in this Policy, Puggi Industries, LLC is the Data Controller.
"Data Processor" means an entity that processes Personal Information on behalf of the Data Controller.
"User Input" means content, text, prompts, files, or other materials you submit to the Service.
"AI Output" means content generated by the AI models in response to User Input.

2. Information We Collect

We collect information in the following categories:

2.1 Account Information

When you create an account through our authentication provider, Clerk, we collect:

Full name (as provided during registration)
Email address
Profile photograph (if provided via Google or Apple sign-in)
Authentication provider identifiers (e.g., Google account ID, Apple account ID)
Account creation date and account status

2.2 Conversation and Usage Data

When you use the Service, we collect:

Conversation history: The text of your User Input (prompts and messages) and the corresponding AI Output (responses). Conversation data is stored to enable conversation continuity, history features, and service improvement.
Usage metadata: Timestamps of interactions, session duration, number of messages sent, features used, AI model selected, and frequency of use.
User preferences: Interface settings, theme preferences, model preferences, and other customization choices.

2.3 Payment and Billing Information

When you subscribe to a paid plan, our payment processor, Stripe, collects:

Credit or debit card number (processed and stored by Stripe; we do not have access to your full card number)
Card expiration date and CVV (processed by Stripe)
Billing name and billing address
Transaction history and subscription status

We receive from Stripe: a truncated card identifier (e.g., last four digits), card type, billing address, transaction confirmations, subscription status, and payment failure notifications. We do not receive or store your full card number, CVV, or other sensitive payment credentials.

2.4 Device and Technical Information

We automatically collect certain technical information when you access the Service:

IP address
Browser type and version
Operating system and version
Device type and unique device identifiers
Screen resolution
Referring URL and exit pages
Language preferences
Time zone

2.5 Cookies and Similar Technologies

We and our service providers use cookies, web beacons, pixels, and similar tracking technologies to collect information about your interactions with the Service. For details, see Section 8.

2.6 Communications Data

When you contact us for support or otherwise communicate with us, we collect:

The content of your communications (emails, support tickets, feedback)
Your contact information
Any attachments or files you provide

2.7 Information from Third-Party Authentication Providers

When you sign in using Google or Apple, we may receive certain profile information from these providers, as authorized by you during the authentication process. This may include your name, email address, and profile picture. We do not receive your passwords from these providers.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Providing and Operating the Service

Processing your User Input through AI models to generate AI Output
Maintaining conversation history and enabling conversation continuity
Managing your account, including registration, authentication, and account settings
Processing payments and managing subscriptions
Providing customer support

3.2 Improving and Developing the Service

Analyzing usage patterns and trends to improve functionality, performance, and user experience
Identifying and resolving technical issues, bugs, and errors
Developing new features and services
Conducting internal research and analytics

3.3 Safety and Security

Detecting, preventing, and addressing fraud, abuse, security incidents, and technical issues
Enforcing our Terms of Service and Acceptable Use Policy
Protecting the rights, property, and safety of our users and the public
Monitoring for violations of our policies

3.4 Communications

Sending transactional communications (e.g., account confirmations, payment receipts, subscription updates)
Sending service-related announcements (e.g., maintenance notices, security alerts, policy changes)
Responding to your inquiries and support requests

3.5 Legal and Compliance

Complying with applicable legal obligations, regulations, and legal processes
Responding to lawful requests from public authorities, including law enforcement
Establishing, exercising, or defending legal claims
Enforcing our agreements

3.6 Aggregated and De-Identified Data

We may create aggregated, de-identified, or anonymized data from the information we collect. Such data is not considered Personal Information under applicable law, and we may use it for any lawful purpose, including analytics, research, service improvement, and business purposes, without restriction.

4. Legal Bases for Processing (EEA/UK Users)

If you are located in the EEA, UK, or Switzerland, we process your Personal Data on the following legal bases under the GDPR:

| Purpose | Legal Basis | |---|---| | Providing the Service, processing payments, managing your account | Performance of a contract (Article 6(1)(b) GDPR) | | Sending transactional and service-related communications | Performance of a contract (Article 6(1)(b) GDPR) | | Improving and developing the Service | Legitimate interests (Article 6(1)(f) GDPR) | | Safety, security, and fraud prevention | Legitimate interests (Article 6(1)(f) GDPR) | | Compliance with legal obligations | Legal obligation (Article 6(1)(c) GDPR) | | Cookies and tracking (non-essential) | Consent (Article 6(1)(a) GDPR) |

Where we rely on legitimate interests, we have conducted a balancing assessment to ensure our interests do not override your fundamental rights and freedoms.

5. How We Share Your Information

We do not sell your Personal Information. We share your information only in the following circumstances:

5.1 Third-Party Service Providers

We share your information with third-party service providers who perform services on our behalf, as described in Section 6. These providers are contractually obligated to use your information only for the purposes for which it was disclosed and in accordance with this Policy.

5.2 AI Model Providers

Your User Input is transmitted to OpenAI for processing through their API to generate AI Output. See Section 7 for details.

5.3 Legal Requirements

We may disclose your information if required to do so by law or in the good-faith belief that such action is necessary to:

(a) Comply with a legal obligation, subpoena, court order, or legal process;
(b) Protect and defend the rights or property of Puggi Industries, LLC;
(c) Prevent or investigate possible wrongdoing in connection with the Service;
(d) Protect the personal safety of users of the Service or the public;
(e) Protect against legal liability.

5.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, asset sale, or other similar transaction, your Personal Information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service of any change in ownership or uses of your Personal Information, as well as any choices you may have regarding your Personal Information.

5.5 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

5.6 Aggregated or De-Identified Data

We may share aggregated, de-identified, or anonymized data that cannot reasonably be used to identify you with third parties for research, analytics, or other business purposes.

6. Third-Party Service Providers and Data Processors

We use the following third-party service providers to operate the Service. Each provider acts as a Data Processor on our behalf (except where they act as independent controllers as noted):

6.1 OpenAI

Purpose: AI language model processing. User Input is sent to OpenAI's API to generate AI Output.
Data shared: User Input (text of prompts and messages), technical metadata.
Data processing location: United States.
Note: OpenAI's API data usage policy governs how OpenAI processes data received through its API. As of the effective date of this Policy, OpenAI states that it does not use data submitted through the API to train its models. However, we do not control OpenAI's practices and encourage you to review OpenAI's privacy policy and API data usage policy.

6.2 Clerk

Purpose: User authentication and identity management (Google Sign-In, Apple Sign-In, email authentication).
Data shared: Name, email address, authentication tokens, profile photograph, account identifiers.
Data processing location: United States.
Website: https://clerk.com

6.3 Stripe

Purpose: Payment processing and subscription management.
Data shared: Billing name, billing address, payment card information, transaction amounts, subscription details.
Data processing location: United States.
Note: Stripe is PCI DSS Level 1 certified. Stripe may act as an independent data controller for certain processing activities.
Website: https://stripe.com

6.4 Convex

Purpose: Backend database and real-time data storage.
Data shared: Account data, conversation history, user preferences, usage data.
Data processing location: United States.
Website: https://convex.dev

6.5 Vercel

Purpose: Web application hosting, deployment, and content delivery.
Data shared: IP addresses, request logs, technical metadata.
Data processing location: United States and global edge network.
Website: https://vercel.com

7. Data Transmission to AI Providers

7.1 How Your Data Is Processed

When you submit a message through the Service, your User Input is transmitted to OpenAI's servers via the OpenAI API for processing. This is a necessary function of the Service, as the AI models that generate responses operate on OpenAI's infrastructure, not ours.

7.2 What Is Transmitted

The following data may be transmitted to OpenAI:

The text of your current message (prompt)
Relevant conversation context from the current conversation session (to enable contextual responses)
System-level instructions (not visible to you) that configure the AI model's behavior
Technical metadata (e.g., model selection, token parameters)

7.3 What Is NOT Transmitted

We do not transmit the following to OpenAI:

Your name, email address, or account credentials
Your payment or billing information
Your conversation history from other sessions (unless you explicitly reference it in a prompt)

7.4 OpenAI's Data Practices

OpenAI processes the data it receives in accordance with its own privacy policy and API data usage policy. As of the effective date of this Policy, OpenAI represents that data submitted via the API is not used to train their models, is retained for up to 30 days for abuse monitoring, and is then deleted. We do not control OpenAI's data practices and cannot guarantee the accuracy of these representations. We encourage you to review OpenAI's policies directly.

7.5 Your Acknowledgment

By using the Service, you expressly acknowledge and consent to the transmission of your User Input to OpenAI and other third-party AI providers for the purpose of generating AI Output. You understand that once your data is transmitted to these providers, it is subject to their respective privacy policies and practices, which are beyond our control.

8. Cookies and Tracking Technologies

8.1 What Are Cookies

Cookies are small text files placed on your device by websites and applications you visit. They are widely used to enable functionality, remember preferences, and analyze usage.

8.2 Types of Cookies We Use

| Cookie Type | Purpose | Duration | |---|---|---| | Strictly Necessary Cookies | Essential for the operation of the Service, including authentication, security, and session management. The Service cannot function properly without these cookies. | Session or up to 1 year | | Functional Cookies | Remember your preferences and settings (e.g., theme, language, model preferences). | Up to 1 year | | Analytics Cookies | Help us understand how users interact with the Service by collecting usage data in an anonymous or aggregated form. | Up to 2 years | | Session Cookies | Used for anonymous session tracking to maintain your session state while using the Service. | Session (deleted when browser is closed) |

8.3 Third-Party Cookies

Our third-party service providers (including Clerk, Stripe, and Vercel) may also place cookies on your device to facilitate their services. These cookies are governed by the respective providers' cookie policies.

8.4 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to:

View what cookies are stored and delete them individually or in bulk
Block third-party cookies
Block cookies from specific sites
Block all cookies
Delete all cookies when you close your browser

Please note that blocking or deleting certain cookies may affect the functionality of the Service. Strictly necessary cookies cannot be disabled without impairing core functionality.

8.5 Do Not Track

Some browsers offer a "Do Not Track" ("DNT") feature. There is currently no universally accepted standard for how companies should respond to DNT signals. At this time, we do not respond to DNT signals. However, you may opt out of certain tracking as described in this Section.

9. Data Retention

9.1 General Retention Principles

We retain your Personal Information for as long as necessary to fulfill the purposes for which it was collected, as described in this Policy, unless a longer retention period is required or permitted by law.

9.2 Specific Retention Periods

| Data Category | Retention Period | |---|---| | Account information | Retained while your account is active and for up to 30 days after account deletion to facilitate account recovery | | Conversation history | Retained while your account is active; deleted upon account deletion or upon your request | | Usage data and analytics | Retained in identifiable form for up to 24 months; retained indefinitely in aggregated or de-identified form | | Payment and billing records | Retained for up to 7 years after the last transaction, as required for tax and legal compliance | | Support communications | Retained for up to 3 years after the last communication | | Technical logs (IP, device data) | Retained for up to 90 days | | Cookie data | Varies by cookie type (see Section 8.2) |

9.3 Deletion Upon Request

You may request deletion of your Personal Information at any time by contacting us at support@fourever.ai. Upon receiving a verified deletion request, we will delete or de-identify your Personal Information within thirty (30) days, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention, legal compliance, resolving disputes).

9.4 Data Held by Third Parties

Please note that we cannot control the retention practices of our third-party service providers. Data that has been transmitted to third parties (e.g., OpenAI, Stripe, Clerk) is subject to their respective retention policies.

10. Data Security

10.1 Security Measures

We implement and maintain commercially reasonable administrative, technical, and physical security measures designed to protect your Personal Information from unauthorized access, disclosure, alteration, and destruction. These measures include:

Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security) encryption.
Encryption at rest: Sensitive data stored in our databases is encrypted at rest.
Access controls: Access to Personal Information is restricted to authorized personnel on a need-to-know basis, with role-based access controls and multi-factor authentication.
Secure authentication: User authentication is managed through Clerk, which implements industry-standard security practices including secure token management and encrypted credential storage.
Payment security: Payment processing is handled by Stripe, which is PCI DSS Level 1 certified, the highest level of certification available in the payment industry.
Infrastructure security: Our application is hosted on Vercel and uses Convex for data storage, both of which implement enterprise-grade security measures including SOC 2 compliance.
Regular monitoring: We monitor our systems for potential vulnerabilities and security incidents.

10.2 No Guarantee of Security

Despite our efforts, no method of transmission over the Internet and no method of electronic storage is completely secure. We cannot guarantee the absolute security of your Personal Information. Any transmission of Personal Information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Service.

10.3 Breach Notification

In the event of a data breach that compromises the security of your Personal Information, we will notify affected users and relevant authorities in accordance with applicable law. We will make reasonable efforts to notify you via email and/or through a prominent notice on the Service within seventy-two (72) hours of becoming aware of the breach, where feasible.

11. Your Rights and Choices

11.1 General Rights (All Users)

Regardless of your location, you have the following rights:

(a) Access: You may request access to the Personal Information we hold about you.
(b) Correction: You may request that we correct inaccurate or incomplete Personal Information.
(c) Deletion: You may request that we delete your Personal Information, subject to certain exceptions.
(d) Data portability: You may request a copy of your Personal Information in a structured, commonly used, and machine-readable format.
(e) Account management: You may update your account information through your account settings or by contacting us.
(f) Subscription management: You may manage or cancel your subscription through your account settings.

11.2 Rights for EEA, UK, and Swiss Users (GDPR)

If you are located in the EEA, UK, or Switzerland, you have the following additional rights under the General Data Protection Regulation (GDPR) and equivalent local law:

(a) Right to restrict processing: You may request that we restrict the processing of your Personal Data under certain circumstances (e.g., while we verify the accuracy of your data).
(b) Right to object: You may object to our processing of your Personal Data where we rely on legitimate interests as the legal basis, and we will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
(c) Right to withdraw consent: Where processing is based on your consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
(d) Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement. A list of supervisory authorities is available at https://edpb.europa.eu.
(e) Right to be informed of automated decision-making: You have the right to not be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, except where permitted by law.

11.3 How to Exercise Your Rights

To exercise any of your rights, please contact us at:

Email: support@fourever.ai
Mail: Puggi Industries, LLC, 224 W 35th St, New York, New York 10001

We will respond to your request within thirty (30) days (or within the time period required by applicable law). We may request additional information to verify your identity before processing your request. We will not discriminate against you for exercising your privacy rights.

11.4 Authorized Agents

If you are a California or EEA resident, you may designate an authorized agent to make a privacy rights request on your behalf. The authorized agent must provide proof of authorization (e.g., a signed written authorization or power of attorney). We may still require you to verify your identity directly.

12. Region-Specific Disclosures

12.1 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA").

12.1.1 Categories of Personal Information Collected

In the preceding twelve (12) months, we have collected the following categories of Personal Information as defined by the CCPA:

| Category | Examples | Collected | |---|---|---| | A. Identifiers | Name, email, IP address, account identifiers | Yes | | B. Personal information under Cal. Civ. Code 1798.80(e) | Name, address, payment card information (via Stripe) | Yes | | C. Protected classification characteristics | Age (for eligibility verification only) | Yes | | D. Commercial information | Subscription records, purchase history | Yes | | F. Internet or other electronic network activity | Browsing history, interaction with Service, usage data | Yes | | G. Geolocation data | Approximate location derived from IP address | Yes | | K. Inferences | Preferences and characteristics inferred from usage patterns | Yes |

12.1.2 Sale and Sharing of Personal Information

We do not sell your Personal Information as defined under the CCPA. We do not share your Personal Information for cross-context behavioral advertising purposes.

12.1.3 Your CCPA Rights

As a California resident, you have the right to:

(a) Right to Know: Request that we disclose the categories and specific pieces of Personal Information we have collected about you, the categories of sources, the business or commercial purposes for collecting the information, and the categories of third parties with whom we share the information.
(b) Right to Delete: Request that we delete Personal Information we have collected from you, subject to certain exceptions.
(c) Right to Correct: Request that we correct inaccurate Personal Information.
(d) Right to Opt-Out of Sale/Sharing: You have the right to opt out of the sale or sharing of your Personal Information. As noted, we do not sell or share Personal Information for cross-context behavioral advertising.
(e) Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
(f) Right to Limit Use of Sensitive Personal Information: You have the right to limit the use and disclosure of sensitive Personal Information. We do not use sensitive Personal Information for purposes beyond those permitted by the CCPA.

12.1.4 Submitting CCPA Requests

To submit a CCPA request, please contact us at support@fourever.ai or by mail at the address provided in Section 17. We will verify your identity before processing your request by matching information you provide with information we have on file.

12.1.5 California "Shine the Light" Law

Under California Civil Code Section 1798.83, California residents who provide Personal Information to us may request certain information about our disclosure of Personal Information to third parties for their direct marketing purposes. We do not disclose Personal Information to third parties for their direct marketing purposes.

12.2 European Economic Area, UK, and Swiss Users (GDPR)

12.2.1 Data Controller

The Data Controller for the purposes of the GDPR is:

Puggi Industries, LLC 224 W 35th St New York, New York 10001 Email: support@fourever.ai

12.2.2 Data Protection Officer

We have not appointed a Data Protection Officer ("DPO") at this time. For privacy inquiries, please contact us at support@fourever.ai.

12.2.3 International Data Transfers

Your Personal Data may be transferred to and processed in the United States. The United States may not provide the same level of data protection as your home country. When we transfer your data outside the EEA/UK, we rely on the following transfer mechanisms:

(a) Standard Contractual Clauses (SCCs) as approved by the European Commission;
(b) Data Processing Agreements with our service providers that incorporate appropriate safeguards;
(c) The recipient's binding corporate rules, where applicable;
(d) Your explicit consent, where applicable and where no other mechanism is available.

12.2.4 Data Processing Agreements

We maintain Data Processing Agreements ("DPAs") with our key service providers that comply with Article 28 of the GDPR, ensuring that they process your Personal Data only on our documented instructions and implement appropriate technical and organizational security measures.

12.2.5 Retention and Erasure

For details on data retention, see Section 9. You may exercise your right to erasure ("right to be forgotten") under Article 17 of the GDPR by contacting us at support@fourever.ai.

13. Children's Privacy

13.1 Age Restrictions

The Service is not directed to children under the age of thirteen (13) in the United States, or under the age of sixteen (16) in the EEA, UK, and Switzerland. We do not knowingly collect Personal Information from children under these ages.

13.2 COPPA Compliance

We comply with the Children's Online Privacy Protection Act ("COPPA"). We do not knowingly collect, use, or disclose Personal Information from children under the age of 13 without verified parental consent.

13.3 Parental Notification

If we learn that we have collected Personal Information from a child under the applicable minimum age without verified parental consent, we will take steps to promptly delete such information from our records. If you are a parent or guardian and believe that your child has provided us with Personal Information without your consent, please contact us immediately at support@fourever.ai.

13.4 Parental Rights

Parents and guardians have the right to:

(a) Review the Personal Information we have collected from their child;
(b) Request deletion of their child's Personal Information;
(c) Refuse further collection or use of their child's Personal Information;
(d) Consent to the collection and use of their child's information without consenting to its disclosure to third parties.

14. International Data Transfers

14.1 Data Processing Locations

Your Personal Information may be transferred to and processed in countries other than your country of residence, including the United States. Our service providers (OpenAI, Clerk, Stripe, Convex, and Vercel) primarily process data in the United States, with Vercel also operating a global edge network.

14.2 Transfer Safeguards

When we transfer Personal Information across borders, we implement appropriate safeguards to ensure that your Personal Information receives an adequate level of protection, including:

(a) Standard Contractual Clauses approved by the European Commission;
(b) Data Processing Agreements with all service providers;
(c) Compliance with applicable data transfer frameworks;
(d) Technical measures such as encryption in transit and at rest.

14.3 Your Consent to Transfer

By using the Service, you consent to the transfer of your Personal Information to the United States and other countries where our service providers operate, which may have data protection laws that differ from those in your jurisdiction.

15. Third-Party Links

The Service may contain links to third-party websites, services, or resources that are not owned or controlled by us. We are not responsible for the privacy practices or content of such third-party sites. We encourage you to review the privacy policies of any third-party sites you visit. This Policy applies solely to information collected by the Service.

16. Changes to This Policy

16.1 Right to Update

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, legal requirements, or for other operational, legal, or regulatory reasons.

16.2 Notice of Changes

When we make material changes to this Policy, we will:

(a) Update the "Last Updated" date at the top of this Policy;
(b) Post the revised Policy on the Service;
(c) Make reasonable efforts to notify you of material changes via email and/or a prominent notice on the Service at least fourteen (14) days before the changes take effect.

16.3 Acceptance

Your continued use of the Service after the effective date of any revised Policy constitutes your acceptance of the changes. If you do not agree to the revised Policy, you must stop using the Service and may request deletion of your data.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Puggi Industries, LLC (dba Fourever) 224 W 35th St New York, New York 10001

Email: support@fourever.ai Website: https://fourever.ai

For privacy-specific inquiries, including data access, correction, or deletion requests, please email support@fourever.ai with the subject line "Privacy Request."

We will acknowledge your request within five (5) business days and respond substantively within thirty (30) days (or within the time period required by applicable law).

By using the Service, you acknowledge that you have read, understood, and agree to this Privacy Policy.