Formwork is built on the principle that your work is yours. This policy explains what data we collect, how we use it, and the control you have over it.
What we collect
When you create an account, we collect your email address and password (encrypted, not stored in plain text). If you choose to add a name, we collect that too.
When you use Formwork, we store your conversations with the team, the Briefings filed at session end, any files you upload as attachments, and metadata about your sessions (when they happened, which team members were involved, what was decided).
When you make a payment, payment processing is handled by Stripe. We don’t store your full payment card details — Stripe handles that. We store enough information to identify your subscription (the last four digits of your card, the expiration date, the billing address you provide).
We collect basic usage data needed to operate the service: when you log in, which features you use, error logs that help us fix problems. This is operational data, not behavioral tracking for marketing purposes.
How we use it
Your conversations and Briefings are used to provide the service to you — the team needs your prior context to remember you across sessions, and your Briefings are accessible from your workspace as your accumulated work.
Your payment information is used to process subscription charges via Stripe.
Your usage data is used to operate and improve the service — fixing bugs, understanding which features are valuable, ensuring the system works.
We don’t use your data to train AI models without your explicit consent. You can opt in to contributing your anonymized conversations to improve Formwork’s models from your account settings; this is opt-in, never default-on.
We don’t sell your data. We don’t share it with advertisers. We don’t use it for marketing purposes outside of our service to you.
Who has access
Within Formwork, access to customer data is limited to the founder and any team members directly involved in operating the service. We access individual customer data only when necessary — for example, when investigating a support request or debugging a problem you’ve reported.
We work with operational service providers who handle data on our behalf:
- Stripe processes payments
- Anthropic provides the AI infrastructure that powers the team’s conversations
- Our hosting infrastructure stores your data
- Our email service sends transactional emails (payment confirmations, security alerts)
These providers operate under their own privacy policies and security commitments. We work with providers who handle data responsibly.
How it’s stored
Your data is encrypted in transit (when traveling between your device and our servers) and at rest (when stored in our databases).
Account passwords are hashed using industry-standard algorithms — even we can’t read your password.
Payment card details are not stored on our systems; Stripe handles that.
Your rights
You can export all your data at any time. From your account settings, you can download all your Briefings as PDFs and export your account history. Your work is portable.
You can request deletion of your account and all associated data. This is permanent and cannot be undone. Account deletion removes your conversations, Briefings, team progression, and all stored data.
You can correct inaccurate information by updating it in your account settings (email, name, password).
You can opt out of data use for AI model training. This is the default — we never train on your data unless you explicitly opt in.
Cancellation and data retention
If you cancel your subscription, your data is preserved in your account indefinitely. You can reactivate later and pick up where you left off.
If you explicitly delete your account, your data is removed within 30 days. Some operational records (payment transaction history, security logs) may be retained longer for accounting, fraud prevention, and legal compliance.
International users
Formwork operates from Canada. Data is stored in infrastructure that may be located in Canada, the United States, or other regions where our providers operate. By using Formwork, you consent to this storage and processing.
If you’re in a jurisdiction with specific privacy requirements (the EU’s GDPR, California’s CCPA, etc.), you have additional rights under those laws. Contact us if you want to exercise specific rights under your jurisdiction’s privacy framework.
Children
Formwork is built for adults working on businesses. The service is not intended for use by anyone under 18. We don’t knowingly collect data from children. If you believe a minor has created an account, contact us so we can address it.
Cookies and tracking
We use minimal cookies — essentially what’s required to keep you logged in and remember your preferences. We don’t use third-party advertising trackers or analytics services that profile users across the web.
Security
We take reasonable measures to protect your data. No system is perfectly secure; we follow security best practices and respond to security issues quickly when they’re identified.
If you discover a security vulnerability, contact us via our Contact page. We take responsible disclosure seriously.
Changes to this policy
This policy may be updated as Formwork evolves. Material changes will be communicated to active customers via email. The date of the most recent update is noted at the bottom of this page.
Contact
For questions about this policy or about how your data is handled, contact us via our Contact page.
Last updated — pending publication before launch