Privacy Policy

Universal Global Services Ltd ("UGS", "we", "us") operates ChangelogForge (changelogforge.app). This Privacy Policy explains what personal data we process when you use ChangelogForge and the rights you have under applicable law, including the UK GDPR and the EU GDPR.

1. Data controller and contact

The controller is Universal Global Services Ltd, a company registered in England and Wales (Company No. 17423506) with registered address 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

Contact: [email protected].

2. Data we process

• Account data (sign-in with Google or Microsoft): when you sign in with Google or Microsoft we receive your account identifier, name and email address (and, from Google, your profile picture). We use this data only to create your account, sign you in and keep the service secure.
• Repository integration (GitHub): connecting repositories uses the separate ChangelogForge GitHub App through GitHub\'s authorization flow. This is used to access the repositories you connect; account sign-in uses Google or Microsoft. Through it we receive repository names, branches, commits, pull requests and release metadata for the repositories you connect, so that we can generate changelogs and release notes.
• Support chat and follow-up email: when you use the in-app support chat, we process your message content to generate a reply. If you choose to provide an email address for human follow-up, we process it together with your message to create a support ticket so our support team can respond. We use this data to answer your request (performance of a contract and our legitimate interest in supporting customers) and retain it only for as long as needed to handle the request and keep support records.
• Usage data: releases generated, approval events, quota usage and billing state.
• Web interaction events: our website records first-party, PII-free product events (for example calls to action and page navigation) through our own API endpoint (/api/v1/events) to understand how the product is used, on the basis of our legitimate interest in improving the service. These events stay on our own infrastructure and are not used for advertising. We do not load third-party analytics scripts, tracking beacons or advertising cookies, and Cloudflare Web Analytics is not enabled. A small amount of browser storage (sessionStorage and localStorage) is used to operate the interface.
• Payment data: processed by Stripe on our behalf. We do not store card numbers. Prices shown exclude VAT; VAT is added at checkout by Stripe Tax. VAT registration applied for; not yet valid. Stripe may collect billing address and tax information during checkout where applicable.

3. Legal bases and purposes

• Performance of a contract: operate your account, generate changelogs and publish approved releases.
• Legitimate interests: service security, abuse prevention, product improvement and analytics.
• Legal obligation: tax, accounting and regulatory record-keeping.
• Consent: where local law requires it for marketing or non-essential cookies.

4. Sharing

We share data only with service providers that help us operate the service: Google and Microsoft (sign-in and account authentication), GitHub (repository integration and release publishing), Stripe (payments and tax), and hosting and LLM infrastructure providers. We do not sell personal data.

5. Retention

We retain account data while your account is active and thereafter only as required for tax, legal and security purposes. Financial records are typically kept for up to six years.

6. Your rights

Depending on your jurisdiction you may have rights to access, rectify, erase, restrict or port your personal data, and to object to processing. For data subject requests contact [email protected]. We respond within 30 days.

7. International transfers

Data may be processed in the United Kingdom, the EU and the United States. Where transfers occur outside the UK or EEA we rely on appropriate safeguards such as UK or EU Standard Contractual Clauses.

8. AI features and EU AI Act transparency

ChangelogForge uses AI (large language models) to draft changelog entries and to operate the in-app support assistant. In line with the transparency requirements of the EU AI Act (Regulation (EU) 2024/1689): the support assistant identifies itself as an AI assistant before answering; AI-drafted changelog entries are advisory and are published only after a human user approves them; and we do not use these features for automated decisions that produce legal effects concerning you. AI processing relies on the legal bases described in Section 3 (contract and legitimate interests).

9. Changes

We may update this policy from time to time and will notify you of significant changes through the service or by email.

Last updated: 22 September 2026.