Privacy Policy
Version 0.9 | Publication draft prepared 14 October 2026
Effective date: insert the approved publication date before release. This policy must match the enabled services, supplier register and retention settings before it is published.
1. Who we are
FORMM AI LTD, company number 17372021, provides FORMM. Our registered office is Uncommon Fulham, 126 New Kings Road, London, United Kingdom, SW6 4LZ. Contact us about privacy at hello@formm.ai, including to exercise a right or raise a complaint. Please mark privacy messages “Privacy”. You do not need an account to contact us.
This Policy explains personal information used for our website, demonstrations, account administration, support and the FORMM services available to you. It does not mean every feature described is currently available. At a collection point we will explain any feature-specific use that is not clear from this Policy. A privacy notice informs you; accepting service terms is not blanket consent to all processing.
2. Our role and your organisation’s role
Our own operations. We act as controller when deciding how and why information is used to operate our website, manage our customer relationships, establish accounts, bill customers, answer enquiries, prevent fraud, secure our own service and meet our legal duties. This includes information about business contacts, not only consumers.
Company work. When a Business Customer determines the purpose of a Job and gives us information from its people, files or connected systems, we generally act as processor on its instructions, or as subprocessor if that customer is itself a processor. The customer’s privacy notices and our DPA govern that processing. Your employer or the relevant application operator should explain its own purpose, lawful basis, recipients, retention and significant decisions. We help it handle rights requests; we do not use its work content for our unrelated purposes.
Personal FORMM. For the personal service we provide directly to you, we generally act as controller for your account and the personal information needed to supply that service. Where you use it for a business or provide third-party information outside a purely personal or household activity, your own legal obligations and the appropriate controller/processor arrangement must also be assessed. Calling an account “personal” does not automatically make other people’s data unrestricted.
Customer-operated applications. A customer publishing an application through FORMM is normally responsible for its end-user purposes and notices. Hosting that application does not make its end users members of the customer’s internal workspace. Where FORMM has an independent purpose, such as protecting its platform or managing its own billing, this Policy applies to that purpose.
3. Information we process and where it comes from
We process information necessary for the particular feature or relationship. Categories can include the following; sensitive categories are restricted as explained in section 6.
| Category | Examples and usual source |
|---|---|
| Identity and contact | Name, email, company, role and account identifiers, from you, an inviting organisation or an authorised sign-in provider. |
| Account and authority | Memberships, roles, permission settings, authentication events, consent and terms records, from your activity and authorised administrators. |
| Billing and service use | Plan, usage, credit reservations and charges, payment status, invoice details and limited payment-method references, from you, our systems and the payment provider. Use secure checkout rather than chat for payment-card information. |
| Work content and private context | Prompts, messages, files, records, instructions, outputs, approved memories, task state and connected-system information, from you or sources you are authorised to connect. |
| Evidence and operational records | Relevant approvals, action status, times, errors, access events and necessary evidence of work, from service activity and connected systems. Evidence may itself contain personal information. |
| Technical information | IP address, browser or device information, request metadata, security events and storage preferences, from your device and our delivery systems. Optional tracking is governed by our Cookie Policy and your choices. |
| Support and communications | Enquiries, support content, complaint details, communication preferences and feedback that you provide. A support case should contain only what is needed to resolve it. |
| Optional voice or media | Audio, transcripts, screenshots or recordings only when you use an enabled feature and give the required permissions or instructions. We do not use an ordinary microphone permission as permission for continuous recording or biometric identification. |
For a supported Google or Microsoft sign-in, we receive the identity and authentication information authorised for that sign-in. Connecting mail, files or calendars is a separate permission: sign-in alone does not grant access to their contents. An enabled integration’s permission screen and feature notice explain the requested categories and actions.
Information can come from authorised colleagues, customers or suppliers, public sources used for a requested research task, and service providers performing their agreed roles. Public availability does not mean information is exempt from privacy law. Where we obtain information indirectly as controller, we provide the required notice within the applicable period, ordinarily within one month or earlier when first contacting the person or disclosing the information, unless a valid legal exception applies.
4. Purposes and legal grounds
The following grounds apply where UK or EEA data protection law governs our controller processing. For customer-instructed work, the customer establishes the appropriate grounds and we process under the DPA.
| Purpose | Legal ground and relevant interest |
|---|---|
| Provide an individual’s account and requested Personal service; respond to their pre-contract request | Steps requested before a contract, or performance of our contract with that individual. A contract with an employer is not automatically this ground for every employee’s information. |
| Administer a business account and work with its contacts | Legitimate interests in supplying and managing the requested business service, balanced against the individual’s rights. |
| Authenticate access, prevent abuse and maintain service integrity | Legitimate interests in protecting customers, systems and information; legal obligation where a specific law requires the processing. |
| Bill, keep accounts and respond to lawful demands | Contract where applicable; legal obligation for required accounting, tax and regulatory records; legitimate interests for proportionate dispute management. |
| Answer support enquiries and complaints; exercise or defend claims | Contract where applicable, legal obligation where required and legitimate interests in resolving issues and protecting legal rights. |
| Improve reliability and usability using permitted operational information | Legitimate interests in a secure and effective service, with minimisation and safeguards. This does not authorise shared-model training on private work content. |
| Send optional marketing or use optional tracking | Consent where required. Where law permits an alternative for a particular business communication, a documented legitimate-interest assessment and applicable messaging rules apply. You can object to direct marketing at any time. |
| Process a separately enabled sensitive-data feature | A valid ordinary legal ground plus the applicable additional condition, such as explicit consent where appropriate. The feature notice identifies the condition and purpose before use. |
We assess necessity and proportionality when relying on legitimate interests. You can ask for information about the relevant assessment. Consent may be withdrawn without affecting processing already lawful before withdrawal. We do not rely on consent where someone cannot genuinely choose or where another ground is the appropriate basis.
Some information is needed to create an account, provide a requested feature, complete a payment or meet the law. Refusing it may prevent that specific service. Optional marketing, optional recording and optional cookies are not prerequisites for unrelated core services.
5. AI processing, private memory and model suppliers
FORMM uses approved AI and tool providers to carry out permitted work. Necessary prompts, relevant retrieved context, outputs and associated metadata may be sent to those providers. Depending on the enabled feature, this can include file content, a screenshot or a transcript. We limit what is sent to the task and permissions involved; a request is not permission to send an entire workspace everywhere.
AI processing can create summaries, classifications and other inferences that may be wrong. Private memory may include company or personal facts and approved instructions needed for ongoing work. Updating that memory or retrieving a document is not the same as training a model’s weights. Access, correction, deletion and source restrictions apply to the information we retain for that purpose.
We do not use private customer or Personal FORMM content to train models shared across customers, and ordinary service use does not authorise a model supplier’s general training on that content. A separate contribution or training programme would require specific disclosure, agreement and valid legal and source rights before use. Feedback alone is not agreement to contribute confidential material.
“No training” does not mean “no processing”, “no storage” or “zero retention”. Providers may retain information for the contracted service or necessary security purposes within their approved arrangements. The verified supplier and transfer information made available with the Service explains the applicable arrangements. Changing models does not remove our duties: we must recheck the supplier, destination, retention and permissions before changing a data flow.
Human access is limited to an authorised need, such as resolving a requested support issue, investigating a genuine security incident or meeting a legal obligation. We do not give all FORMM staff or all customer administrators unrestricted access to private conversations. We do not use confidential payroll, health, grievance or legal content to target FORMM marketing.
6. Sensitive information and significant decisions
The ordinary Service is not a general medical-record, biometric-identification or criminal-record processing service. Do not put highly sensitive information into a demonstration or an unsupported feature. For an expressly enabled business feature involving such information, the customer must identify the lawful purpose, additional legal conditions, access rules and safeguards; we must also meet our own obligations. Unexpected sensitive content is not treated as consent for new uses.
Do not submit HIPAA-regulated information unless an appropriate business associate agreement and supported configuration are in place. We do not claim that FORMM is HIPAA-certified, ISO-certified or SOC 2-attested merely because a supplier has related credentials.
We do not offer unrestricted, solely automated decisions with legal or similarly significant effects through an ordinary account. AI assistance with hiring, performance, financial or other consequential decisions requires the relevant use-specific assessment, transparency and human safeguards. The actual purpose and effect determine the legal requirements, not a role name or an “advisory” label. Where a permitted feature makes such decisions as controller, its notice must explain the meaningful logic, importance and likely consequences, and the available human review and challenge rights before activation. Such a feature is not authorised by this general Policy alone.
7. Who receives information
We disclose information only for an appropriate purpose subject to the relevant permissions and safeguards. Recipients can include authorised members of the same customer organisation; recipients you instruct the Service to contact; connected-service providers; hosting, security, AI, communications, payment and support providers; professional advisers and insurers with a legitimate need; and authorities where required by law. Business transfer recipients may receive necessary information under suitable confidentiality and data-protection safeguards; a transaction is not blanket permission for a new purpose.
When acting as processor for a customer, suppliers are authorised and managed under the DPA. An external system you choose to connect, or a person you instruct us to contact, may act independently under its own notices rather than solely as our processor. We will not treat that distinction as a reason to ignore our own selection, security or disclosure duties.
We do not sell personal information or share it for cross-context behavioural advertising, and we do not use private work content for advertising. This commitment depends on maintaining that configuration, including in analytics and advertising tools; any materially different proposed use would require a prior lawful assessment, updated information and the choices required by law. We do not treat acceptance of service terms as opting into such a change.
8. International processing
FORMM is based in the United Kingdom. A particular core hosting region does not mean every model call, support activity, network request, backup or connected application is processed only there. We provide the applicable supplier locations and transfer information with the verified service register before activating the relevant data flows. Country restrictions agreed with a customer must also be applied to fallback suppliers.
For a restricted transfer, we use a valid applicable mechanism, such as an adequacy decision covering that recipient and data, or approved contractual safeguards with the necessary transfer assessment and additional measures. UK transfers may use the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as appropriate. Where a US framework is relied upon, the specific recipient’s participation and applicable coverage must be valid; a supplier’s name or US address is not enough.
You can ask hello@formm.ai for information about the destinations and a copy of relevant safeguards, subject to necessary redactions that do not prevent understanding the protection. This Policy itself is not a transfer agreement. Details of any applicable regional representative will be provided in the regional notice for that service.
9. How long we retain information
We retain information only for its lawful purpose, taking account of the service, customer instructions, source terms, legal obligations, risks and your rights. The following is our standard service schedule; a valid customer-specific schedule or mandatory legal requirement takes precedence where applicable.
| Record | Retention rule |
|---|---|
| Website enquiry or unresolved sales discussion | Ordinarily up to 12 months after the last meaningful contact, unless a continuing relationship or dispute justifies longer. |
| Marketing preferences | While the relevant subscription remains active; review inactive contacts after 24 months. Keep only the minimum suppression record needed to respect an opt-out for as long as the relevant marketing activity continues. |
| Work content, outputs, files and private memory | While the account and permitted purpose remain active, subject to earlier valid deletion or source revocation obligations. On closure, a standard 30-day export window, then delete remaining live work content within 30 days. An earlier valid deletion request is handled without waiting for the whole exit window. |
| Residual backup copies | Isolated from ordinary use and overwritten within a further 90 days after live deletion. Restore procedures must reapply valid deletions before returning data to normal use. |
| Necessary audit event history | Standard target of 400 days from the event for minimal permission, approval, usage and action evidence, where justified. This is not permission to retain full prompts, files or sensitive case content for 400 days. Earlier erasure, minimisation or restricted retention may be required. |
| Routine technical diagnostics | Ordinarily up to 90 days, with shorter retention where possible. Necessary evidence of an actual incident may be isolated and kept for the investigation or legal claim. |
| Billing, contract and claims records | A limited record retained for the relevant legal accounting and limitation period, ordinarily six years after the relevant accounting period or relationship ends, depending on the record; retain longer only where a specific legal need justifies it. |
Any enabled guest demonstration, browser/session recording or special-case collection has its retention period explained in the relevant feature notice. Supplier-side limits are recorded in the service’s supplier information. These records are not silently included in an indefinite general history.
A deletion request does not necessarily remove information lawfully held by a person to whom you sent it, or records another organisation is independently required to retain. We will explain relevant limits. We do not keep all content merely because some accounting or legal records must remain. A credit pause is not a new lawful basis for indefinite retention.
10. Security and your controls
We use technical and organisational safeguards appropriate to the risk, including access management, separation of customer contexts, protection of credentials, secure transmission, incident response and supplier oversight. No internet service can guarantee absolute security.
Use supported account, connection, sharing, notification and deletion controls, and contact us when a control is unavailable or a request requires assistance. A privacy request, complaint or cancellation is not conditional on purchasing work credits. Revoking a connection stops future authorised access, but may not undo an action already submitted or automatically remove all copies needed for an existing lawful purpose.
For an enabled mobile or voice feature, operating-system permissions and the feature notice explain access to microphones, notifications or files. You can change those permissions. Turning off notifications does not necessarily cancel an underlying scheduled Job. Notifications should not expose sensitive work in lock-screen previews by default.
11. Your rights, requests and complaints
Depending on applicable law and the processing, you may request access and a copy, correction, deletion, restriction, portability, withdrawal of consent, or safeguards concerning significant automated decisions. You may object at any time to processing for direct marketing. You may also object to processing based on legitimate interests on grounds relating to your situation. We explain any lawful exception rather than treating rights as unconditional or refusing without a reason.
Email hello@formm.ai or write to our registered office. We ask only for proportionate information to verify identity or authority; do not send identity documents unless we explain why a secure verification step is necessary. An authorised representative may act for you. For customer-controlled work, we will route the request to the responsible customer and assist it where appropriate, without exposing someone else’s private information.
We respond to UK/EEA rights requests without undue delay and normally within one month, subject to lawful extension, clarification and identity-verification rules. Where an extension applies, we explain it within the applicable period. Other laws may set different deadlines. Requests are normally free; any permitted fee or refusal must have a lawful basis and be explained.
You can complain to us using the same contact details or another reasonable available channel. We acknowledge a data-protection complaint within 30 days, investigate without undue delay, keep you informed where necessary and explain the outcome. You can also complain to the UK Information Commissioner’s Office or your applicable supervisory authority, including an EEA authority where you live or work or where an alleged infringement occurred. Contacting us does not remove your right to approach an authority or court.
12. Additional information for US residents
Where a US state privacy law applies to our processing, you may have rights to confirm processing, know and access information, obtain a portable copy, correct or delete it, and opt out of sale, targeted advertising or certain significant profiling. Rights to limit sensitive information or appeal a refusal depend on the applicable law. We do not discriminate unlawfully against you for exercising a right.
The categories in section 3 include identifiers, customer-record information, commercial information, internet or electronic activity, professional or employment information, submitted audio/visual material and inferences created in requested work. Sensitive categories may include account credentials, communications contents or specifically enabled health-related information. Sources, purposes, recipients and retention are described in sections 3–9. We use sensitive information only for the permitted service and other purposes allowed by the applicable law, not to infer unrelated traits for advertising.
Our launch policy is no sale of personal information and no sharing for cross-context behavioural advertising, including for people under 16. We respect legally applicable universal opt-out signals, including Global Privacy Control, for the browser or device communicating the signal and associated accounts where the law requires. An opt-out signal does not by itself disable requested essential service functions. We do not treat the absence of a signal as consent.
Requests and authorised-agent requests can be sent to hello@formm.ai without creating an account. For a covered California request, we generally acknowledge within 10 business days and respond within 45 calendar days, with a notified extension where permitted; sale/sharing opt-outs, if relevant, use the shorter applicable deadline. Other state deadlines take precedence for their residents.
Where a right of appeal applies, reply to the refusal or email hello@formm.ai with “Privacy appeal”. We will reconsider and explain the decision and any route to the relevant state authority within the legally required period. We do not require you to waive a state-law privacy right in a contract.
Where a regional notice or notice at collection accompanies the Service, it provides additional detail about the processing and the rights that apply to you. Contact us to request the relevant information in an accessible format.
13. Children, links and updates
The FORMM account service is intended for adults aged 18 and over. We do not knowingly offer accounts to children. An age statement alone is not our only safeguard where a service is likely to be accessed by children. Tell us if a child has supplied information so we can assess and take appropriate action. Any customer application aimed at children requires a separate authorised assessment and notice before launch.
External websites and connected services have their own privacy information. We remain responsible for our own collection and disclosures. If this Policy materially changes, we will give appropriate notice before the new use and obtain a new consent where required. We do not retrospectively broaden an accepted training, advertising or disclosure purpose merely by updating this page.
For questions, rights requests or complaints: hello@formm.ai.