Privacy policy

Effective October 16, 2026. Samusev Consulting LLC operates Forma. For privacy questions or requests, contact support@goforma.ai.

What we process

We store your account name, email, password hash, recovery-code hash, sessions, cloud-saved projects and brand kit, generation usage, and subscription identifiers. We use a hashed network identifier and request counters to limit abusive sign-in attempts. Your email is an account identifier; it is not verified and cannot be used by itself to restore an account.

Local designs and brand settings remain in your browser unless you choose to save them to your account. Anyone with access to that browser profile may be able to see local designs. Signing out ends the cloud session but does not erase browser-saved projects.

Shared workspaces

When you accept a private invitation code, the workspace owner and its editors can see and update designs and brand kits saved in that shared workspace. Personal cloud copies remain private. We store invitation email addresses, hashed invitation codes, memberships, and the name of the last design editor. Owners can revoke access. Do not share an invitation code beyond its intended recipient.

Providers and purposes

Cloudflare hosts the website, database, and project storage. OpenAI receives the brief you submit for AI-copy or image generation. Text requests disable response storage; provider security and abuse-retention rules may still apply to text and image requests. We store image prompts, generated images, and credit records to provide your generation history and enforce balances. Generated images are available for 30 days and removed during routine account activity after that period, unless you save them into a project. Usage and payment records may remain for billing and abuse prevention. Stripe processes billing and receives billing account details. Forma does not store full payment-card numbers. Providers may process data outside your country.

We use this information to operate the service, authenticate users, save requested content, enforce limits, handle support, and maintain billing records. We do not sell your personal data or use advertising trackers in this version.

Cookies and retention

We use an essential, secure session cookie for sign-in, normally lasting seven days. Browser storage keeps local projects and preferences. Cloud projects remain until deleted. Expired sessions and sign-in counters are periodically removed. Usage and billing records may be retained to prevent abuse, resolve disputes, and meet legal obligations. Hosting backups can retain earlier versions temporarily.

Your choices

Use Account to export your cloud data or delete your account after a paid subscription has ended. Delete browser-saved projects separately. You can also contact support@goforma.ai to request access, correction, deletion, or other rights available in your location. We may need to verify control of your account. Do not send passwords or recovery codes by email.