Cookie Policy

Version 0.9 | Publication draft prepared 14 October 2026

Effective date: insert the approved publication date before release. Schedule A must be completed from the actual deployed website and application inventory.

1. Who is responsible

FORMM AI LTD, company number 17372021, operates FORMM. Our registered office is Uncommon Fulham, 126 New Kings Road, London, United Kingdom, SW6 4LZ. Questions about cookies, device storage or privacy can be sent to hello@formm.ai.

This Policy covers storage and access technologies used on our own website and the FORMM interfaces to which this Policy is linked. Our Privacy Policy explains the associated personal-information processing. Customer-operated applications and external services may need their own notices and controls; their technologies are not automatically covered by our consent choices.

2. What these technologies are

A cookie is a small piece of information stored by a website in your browser. Similar rules can apply to local storage, session storage, pixels, tags, software development kits, embedded content, device identifiers and fingerprinting. Calling something “cookieless” does not automatically make it exempt. The relevant question is what information is stored or accessed and why.

Session storage normally ends with the relevant session; persistent storage lasts until its stated expiry or earlier deletion. Some technology is set by FORMM and some by a provider we use. A provider’s independent use of information must also be disclosed and lawfully controlled.

3. The choices we offer

Necessary technologies support a service you request, such as maintaining a secure sign-in session, applying security controls, balancing an essential connection or remembering your privacy choice. We do not use the “necessary” label merely because a technology is commercially useful or a supplier labels it essential. Necessity depends on the actual purpose and implementation.

Optional technologies, where offered, may support analytics, non-essential preferences or embedded features. Our default is to obtain your opt-in before activating optional storage or access, including optional analytics. Some countries permit narrow exceptions with specific conditions; we do not use those exceptions to activate optional tracking under this default policy.

Advertising and cross-site tracking are not enabled under our launch policy. We do not use these technologies to sell personal information or share it for cross-context behavioural advertising. Any future change would require a prior assessment, updated information and effective choices before activation. Acceptance of Terms of Service is not agreement to advertising or analytics tracking.

Schedule A identifies the actual technologies used, their provider, purpose, storage period and category. An optional category displayed in general guidance does not mean that a particular tracker is installed.

4. Giving and changing consent

Where optional technologies are available, our privacy controls offer Accept optional, Reject optional and Manage choices, with a clear and equally accessible way to reject. Optional categories are off unless you positively choose them. Scrolling, silence, closing a banner or continuing to browse is not consent. We do not bundle optional cookie consent with signing up or buying the Service.

You can return to Cookie settings in the website footer or the relevant application settings to change or withdraw your choice. Withdrawal is as easy as giving consent. It stops future optional storage and access for the affected purpose; it does not undo processing that was lawful before withdrawal. Where appropriate, we remove optional first-party items we can control and pass the changed choice to our providers. Some third-party items may also need to be removed using the provider’s or your browser’s controls.

We retain a minimal record of your choice, including its time and the applicable notice version, for as long as needed to apply and evidence it. We request a fresh choice when a material purpose or provider change requires it, or when the applicable consent period expires. We do not repeatedly prompt you merely because you rejected optional tracking.

Choices may be specific to a browser, device or account. Clearing browser storage can remove the saved choice. We will explain any supported account-level synchronisation rather than assume a choice silently covers every device or third-party application.

5. Browser controls, signals and embedded content

Most browsers let you inspect, block or delete stored items. Blocking essential storage may prevent a requested function, such as remaining signed in. Rejecting optional tracking does not prevent access to unrelated core website information or legal pages.

We honour legally applicable universal opt-out signals, including Global Privacy Control, for sale, sharing or targeted-advertising purposes where relevant. A signal is not treated as permission for another use. There is no general consent for optional tracking simply because the browser does not send a signal.

External videos, support widgets, sign-in providers and payment tools may involve third-party technologies. Where an embed would use non-exempt storage, it remains blocked until the necessary choice or request is made and appropriate information is shown. A link to an external website does not itself grant that website consent on your behalf.

An operating-system permission for an app feature, such as notifications, is distinct from permission for unrelated tracking. A server log that does not store or access information on your device is not automatically a cookie, but any personal information in it remains subject to data protection rules.

6. Updates and contact

We update this Policy and the inventory when our actual use changes, and obtain new consent before a new optional purpose begins where required. The date and version identify the policy shown to you. Contact hello@formm.ai to ask about a technology, report a preference control that is not working, or exercise a privacy right.

Schedule A. Deployment inventory

Publication hold: the rows below are verification fields, not a claim that these items are installed. Replace them with the actual inventory, or positively record that no such technology is used. Remove this instruction only when the scan and engineering review are complete.

For every item record: exact cookie/key/SDK/tag name; setting domain; provider’s legal name; function; information stored or accessed; first/third-party status; category and exception or consent relied on; exact session/expiry period; recipient and country information; and how blocking, withdrawal and deletion work.

A category-level description alone does not replace the completed inventory and actual preference controls. Verify ordinary browsing, logged-in pages, forms, rejected consent, accepted consent, withdrawal, fresh sessions and supported mobile interfaces. A banner is not proof that blocked technologies remain inactive.