Privacy policy

This Policy covers personal data we process as a controller (for example account, billing, and marketing data about customers and website visitors). When we process Customer Content that includes personal data under a customer’s instructions, we act as a processor as described in the DPA.

We may collect:

• Account and contact data: name, email, company, role, password or SSO identifiers, and support communications.
• Billing data: payment method details processed by our payment providers, invoices, and plan information.
• Customer Content: documents, templates, fields, signatures, redlines, comments, recipient details, and related workflow metadata you submit to the Service.
• Usage and device data: IP address, browser and device type, pages viewed, approximate location derived from IP, cookies or similar technologies, and diagnostic logs.
• API and integration data: API request metadata, webhook destinations, and credentials you configure.

We use personal data to:

• Provide, operate, secure, and improve the Service
• Authenticate users and prevent abuse or fraud
• Process transactions and send service communications
• Provide support and respond to requests
• Analyze product usage in aggregate or de-identified form where feasible
• Send product or marketing communications where permitted (you may opt out of marketing emails)
• Comply with law and enforce our Terms

We do not sell personal data. We do not use Customer Content to train generalized AI models for other customers without a separate written agreement.

We may share personal data with:

• Service providers who host infrastructure, email, analytics, payments, customer support, or similar functions under contractual confidentiality and security obligations
• Counterparties and recipients you invite into a document, signature, or redlining workflow
• Integrations you enable (for example CRMs or storage tools)
• Professional advisors and authorities when required by law or to protect rights and safety
• Successors in connection with a merger, acquisition, or asset sale

We use cookies and similar technologies for authentication, preferences, security, and analytics. You can control cookies through your browser settings, but some Service features may not work without them.

We use administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit and at rest where appropriate, access controls, and monitoring. No method of transmission or storage is completely secure. See our Security page for additional information.

We retain personal data for as long as needed to provide the Service, meet legal obligations, resolve disputes, and enforce agreements. Customer Content is retained according to your account settings, plan, and instructions, subject to backups and legal holds.

Formable may process data in the United States and other countries where we or our processors operate. Where required, we use appropriate transfer mechanisms such as standard contractual clauses.

Depending on your location, you may have rights to access, correct, delete, port, or restrict certain personal data, or to object to certain processing. To exercise these rights for data we control, contact Formable through your account where available.

If we process your data only as a processor for a Formable customer, please contact that customer. We will assist customers with verified requests as required by our DPA and applicable law.

The Service is not directed to children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided personal data, contact us and we will take appropriate steps.

We may update this Privacy Policy from time to time. We will post the updated Policy on this page with a revised date and, where appropriate, provide additional notice.