Your data,
handled deliberately.

This policy applies to the Forma Studio platform, project submissions, project communications, support requests and related services. It does not govern third-party websites or services that you choose to visit or connect.

We collect the information needed to operate the platform and deliver projects:

• Google account data: name, email address, profile picture and account identifier.
• Profile data: country, phone number, user type, company name, website, LinkedIn profile and communication preferences.
• Project data: briefs, technical requirements, budgets, deadlines, references, attachments, messages, quotations, milestones and handover records.
• Transaction data: invoice references, provider references, amount, currency and payment status. We do not store raw card numbers.
• Support data: contact details, subject, category, message and any project reference.
• Technical data: session cookies, security logs, IP-derived rate-limiting signals and basic device information.

Do not submit special-category or highly sensitive personal data unless it is genuinely necessary and you have a lawful basis to do so.

• Authenticate users and maintain secure sessions.
• Review, scope, quote and manage project requests.
• Communicate about projects and provide support.
• Record approvals, payments, handovers and audit events.
• Prevent spam, fraud, abuse and unauthorised access.
• Comply with legal, tax and accounting obligations.
• Improve the reliability and security of the platform.

We do not sell personal information. We do not use client project data to train public models, and we do not publish a client's project, files or identity without an administrator-controlled publication decision and appropriate permission.

Depending on your jurisdiction, processing is based on one or more of: performance of a contract or steps requested before entering one; legitimate interests in operating and securing the platform; consent where required; and compliance with legal obligations.

Where consent is the basis, you may withdraw it. Withdrawal does not affect processing that already occurred or processing required for another lawful basis.

Data is stored in Google Cloud Firestore and Firebase Storage, and the application is hosted on Vercel. Authentication is provided by Google Firebase Authentication. Payment processing may be provided by a supported payment provider once configured.

These providers process data under their own terms and security commitments, which may involve storage or processing outside your country. We select providers with appropriate safeguards and limit access to the data needed for their function.

Access is controlled through server-verified sessions, role-based administrative permissions, restrictive Firestore and Storage rules, and server-side validation. Files are private by default. Administrative actions are recorded in audit logs.

No system is perfectly secure. You should use a secure Google account, avoid sending passwords or private keys through messages, and report suspected unauthorised access promptly.

Project, quotation, invoice, payment and handover records are retained for as long as needed to operate the service, resolve disputes and meet legal, tax and accounting obligations. Support records and audit logs may be retained for security and compliance.

When data is no longer required, it is deleted or de-identified where practicable, subject to backup, fraud-prevention and legal retention requirements.

Subject to applicable law, you may request access to your information, correction of inaccurate information, deletion, restriction, portability, or objection to certain processing. You may also withdraw consent where consent is the basis.

Requests can be sent to studio@formaproj.com. We may need to verify your identity. Some records may need to be retained for legal or fraud-prevention reasons. You may also have the right to complain to a data protection authority.

The platform uses an HTTP-only session cookie to authenticate requests and protect dashboard access. Firebase may use local storage for authentication persistence. We do not use invasive advertising cookies.

Blocking the essential session cookie will prevent access to authenticated areas.

The platform is intended for adults and organisations. It is not directed at children. If you believe a child has provided personal data, contact support so it can be reviewed and removed where appropriate.

We may update this policy as the platform changes. The current version and update date are shown at the top of this page. Material changes may also be communicated through the platform.

Privacy questions: studio@formaproj.com.