1 Who we are & scope
Forma Page, Inc. is a Delaware corporation with its principal place of business at [company mailing address] . For personal information covered by this policy, Forma is the "controller" (or "business") for information about our website visitors and account holders, and a "processor" (or "service provider") for the content our customers upload and process through the Services on behalf of their own users.
This policy applies to the Services and to Forma-operated websites that link to it. It does not apply to third-party products, or to a customer's own use of Forma to process personal information about their end users — that use is governed by the customer's own privacy notice and our agreement with them.
2 Information we collect
Information you provide
- Account & profile data — name, work email, password (stored only as a salted hash), organization, role, and profile preferences.
- Content — presentations, slides, charts, uploaded files, prompts, comments and other material you create or import into Forma ("Customer Content").
- Billing data — plan, billing contact and transaction history. Card details are collected and stored by our payment processor, not by Forma.
- Support & communications — messages you send us, survey responses and information you share when you contact us.
Information we collect automatically
- Usage data — features used, actions taken, timestamps and performance metrics, used to operate and improve the Services.
- Device & log data — IP address, browser type, operating system, referring pages, and diagnostic logs.
- Cookies & similar technologies — see Cookies & tracking .
Information from third parties
- Single sign-on & integrations — if you sign in with a third-party identity provider or connect an integration, we receive the profile and scopes you authorize.
- Business partners — limited data from analytics and infrastructure providers acting on our behalf.
3 How we use information
- To provide, maintain, secure and improve the Services and your account.
- To generate, review and edit presentation content when you use AI features (see below).
- To process transactions and send service, security and administrative messages.
- To respond to support requests and communicate about features, with your consent where required.
- To monitor for, investigate and prevent fraud, abuse and security incidents.
- To produce aggregated, de-identified analytics that do not identify you.
- To comply with legal obligations and enforce our Terms of Service .
4 AI features & your content
Forma uses AI models — our own and those of third-party providers — to draft, review and transform presentation content when you ask it to. When you use these features, the relevant prompts and content are sent to the model provider solely to return a result to you.
- We contractually require our AI providers not to use Customer Content submitted through our accounts to train their models.
- We do not use your Customer Content to train foundational AI models unless you or your organization explicitly opts in.
- AI output can be inaccurate; you are responsible for reviewing it before you rely on or share it.
5 Legal bases for processing (EEA/UK)
If you are in the European Economic Area, United Kingdom or Switzerland, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Providing the Services under our agreement with you | Performance of a contract |
| Security, fraud prevention, product improvement, analytics | Legitimate interests |
| Optional marketing, non-essential cookies | Consent |
| Tax, accounting and legal compliance | Legal obligation |
Where we rely on legitimate interests, we have balanced those interests against your rights. You may object to this processing as described in Your privacy rights .
7 Sub-processors
We rely on a limited set of vendors to run the Services — for example cloud hosting, database and storage, AI model providers, payment processing, email delivery, error monitoring and product analytics. Each is bound by a data-processing agreement. A current list of sub-processors is available at [link to sub-processor list] and we will provide advance notice of material changes to customers who subscribe to updates.
8 International data transfers
Forma is based in the United States and processes information there and in other countries where our providers operate. When we transfer personal information out of the EEA, UK or Switzerland, we use an approved transfer mechanism — typically the European Commission's Standard Contractual Clauses (and the UK Addendum) — together with supplementary safeguards where appropriate. You may request a copy of the relevant safeguards by contacting us.
9 Data retention
We keep personal information for as long as your account is active and as needed to provide the Services, then for the period required to meet legal, tax and security obligations. Customer Content is retained while your account is active; after account closure it is deleted or de-identified within [retention period, e.g. 30–90 days] , except where longer retention is legally required. Backups are purged on a rolling schedule.
10 Security
We use administrative, technical and organizational measures designed to protect personal information — including encryption in transit and at rest, access controls, and continuous monitoring. See our Security page for detail. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
11 Your privacy rights
Depending on where you live, you may have the right to access, correct, delete, port or restrict the processing of your personal information, to object to certain processing, and to withdraw consent. To exercise these rights, email privacy@forma.page or use the in-product controls. We will verify your request and respond within the time required by applicable law. You will not be discriminated against for exercising your rights.
If Forma processes your information on behalf of a customer (your employer or workspace owner), please direct your request to that customer; we will assist them as their processor. EEA/UK users may also lodge a complaint with their local supervisory authority.
12 U.S. state privacy disclosures
Residents of California and other U.S. states with comprehensive privacy laws have the rights described above, including the right to know, delete, correct and opt out of "sale" or "sharing" of personal information and of targeted advertising. Forma does not sell or share personal information for these purposes and does not use it for targeted advertising. In the prior 12 months we have collected the categories described in Section 2 and disclosed them only to the service providers described in Section 6 . To make a request, email privacy@forma.page ; you may use an authorized agent as permitted by law.
14 Children
Forma is a business tool not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.
15 Changes to this policy
We may update this policy from time to time. If we make material changes, we will update the "Last updated" date and, where appropriate, notify you by email or in-product. Your continued use of the Services after changes take effect constitutes acceptance of the updated policy.
16 Contact us
Questions or requests? Email privacy@forma.page or write to Forma Page, Inc., [company mailing address] . For EEA/UK matters, our representative is [EU/UK representative, if appointed] .