Privacy Policy

1.1 Information You Provide

We collect information you provide directly, including:

• Account Information: Name, email address, password, and billing information
• Profile Information: Business name, address, and preferences
• Content: Formulas, ingredients, batches, and other data you create or upload
• Communications: Messages you send us, support requests, and feedback
• Payment Information: Credit card details (processed securely by Stripe)

Do not submit protected health information unless we have signed a Business Associate Agreement with you and approved the required controls in writing.

1.2 Information Collected Automatically

When you use the Service, we automatically collect:

• Usage Data: Features used, actions taken, time spent, and click patterns
• Device Information: Browser type, operating system, device identifiers
• Log Data: IP address, access times, pages viewed, and referring URLs
• Fraud-Prevention Signals: Hashed browser or device fingerprint data and related IP, account, and usage signals used to protect trials, payments, and account security

1.3 Information from Third Parties

We may receive information from third-party services you connect:

• E-commerce Platforms: Order data from Shopify and other integrations you explicitly authorize
• Authentication Providers: If you sign in with Google or other providers

We use your information to:

• Provide, maintain, and improve the Service
• Process transactions and send billing notifications
• Send service-related communications (updates, security alerts, support)
• Respond to your inquiries and provide customer support
• Personalize your experience and provide relevant features
• Analyze usage patterns to improve the Service
• Detect, prevent, and address fraud and security issues
• Comply with legal obligations
• Send marketing communications only when you separately opt in

We may share your information with:

We retain your information for as long as your account is active or as needed to provide the Service. After account deletion, we retain only information required to:

• Comply with legal obligations (tax records, dispute resolution)
• Enforce our Terms of Service
• Maintain security and prevent fraud

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit and at rest
• Secure password hashing (bcrypt)
• Regular security assessments and monitoring
• Access controls and employee training
• Secure cloud infrastructure
• Row-level security ensuring data isolation

Learn more on our Security page.

If you are in the European Union or EEA, you have additional rights under the General Data Protection Regulation:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restriction: Request limitation of processing
• Right to Portability: Receive your data in a portable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact us at privacy@formuley.io. We will respond within 30 days.

California residents have the right to:

• Know what personal information we collect and how it's used
• Request correction of inaccurate personal information
• Request deletion of your personal information
• Limit the use or disclosure of sensitive personal information if that becomes applicable to our processing
• Know that we do not sell or share personal information as those terms are used in the CCPA/CPRA
• Non-discrimination for exercising your rights

Formuley does not sell or share personal information for cross-context behavioral advertising, and we do not offer a separate "Do Not Sell or Share My Personal Information" link because that activity is not part of our business model.

We treat recognized opt-out preference signals, including Global Privacy Control, as a request to opt out if we ever offer a feature that qualifies as selling or sharing personal information under California law.

To exercise your rights, contact us at privacy@formuley.io.

The Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child without parental consent, we will delete that information promptly. If you believe we have collected information from a child, please contact us at privacy@formuley.io.

Your information may be transferred to and processed in countries other than your own, including the United States, where our primary hosting and subprocessors operate today. When we transfer personal data from the EU/EEA, UK, or Switzerland to countries without an adequacy decision, we rely on appropriate safeguards such as Standard Contractual Clauses and related data processing commitments with relevant vendors where applicable.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.