Privacy Policy
The data we keep, and the data we don’t.
Formeze stores the form data you save and the pages you scan — encrypted when retained, processed with models we operate, and never sold. Optional model-training contribution is off by default. This is the plain-language version of exactly what we collect and what we do with it.
Last updated: August 19, 2026
How we think about privacy
Three commitments that shape every decision about your data.
We only handle what you save or scan.
There's no hidden tracking of your browsing. Formeze only handles the fields you save or that it auto-captures when you submit a form, and the pages you actively scan — never your general browsing. You choose what's captured, and you can turn capture off or exclude any site.
Your data is processed on our own servers.
Semantic matching and form-field detection run with models we operate, not an outside AI API. Saved fields stay scoped to your account. PDF scan samples are not retained for training unless you separately opt in; opted-in samples may be reviewed and used to improve the shared detector.
Export your data or delete your account.
Your data is yours. Download a copy, delete contributed scan samples without deleting your account, or delete the account from settings. Automated embedding cleanup covers vectors linked to known stored fields; historical provider-only vectors can fall outside that guarantee.
What we collect
When you sign up: your name, email, and authentication credentials. When you use Formeze: the form-field labels and values you save or that Formeze auto-captures when you submit a form (on by default — you can turn it off), the web address of the page a captured field came from, and an image of a page or PDF when you actively run a scan. Because it captures fields you submit, saved values can include financial or health information — known credentials and payment-card fields are filtered, but no heuristic can identify every sensitive field. We don't track your general browsing history.
Account basics / Saved & captured fields / Page URLs / Scan images
Scanning & captured images
When you actively scan a web form or PDF, Formeze sends a rendered page image to our authenticated detection service so it can propose fields for you to review. The image is not retained as training data by default. A separate, default-off ‘Contribute PDF scan samples’ control lets you consent to retaining encrypted page images, detected boxes, labels, and corrections for model improvement. Opted-in samples can contain text visible on the page and may be reviewed or combined with other consented samples to improve the shared detector. You can turn contribution off for future scans and separately delete all of your retained samples and annotations from settings.
User-initiated scans / Training off by default / Encrypted if retained / Independent deletion control
How we use it
We use saved fields and labels to provide autofill, generate semantic label embeddings, secure the service, meter usage, and support your account. We use scan images to perform scans you request. Only when you separately opt in may retained scan samples and corrections be used to evaluate or improve the shared field detector. We do not sell personal data or use it for advertising, creditworthiness, or unrelated profiling.
Service delivery / Separate training consent / No data resale or ads
Storage & encryption
Saved field values and any consented training scan images or OCR text are encrypted with AES-256-GCM before database storage, and traffic between you and our servers uses TLS. Browser scan state expires after at most 30 minutes. Known passwords, one-time codes, payment-card credentials, SSNs, and bank-routing fields are filtered, but you should review forms before capture because automated filtering is not exhaustive.
AES-256-GCM / TLS in transit / Encrypted at rest
Your rights
Export the account data we store, delete retained training scan samples independently, or delete your account at any time. The scan-sample deletion action also turns future training contribution off; it does not delete your saved form fields. Account deletion removes primary database records and queues cleanup for embeddings linked to known stored fields. Historical provider-only embeddings are not covered by the current automated per-vector cleanup.
Data export / Delete training samples / Account deletion
Service providers
We share data only with the vetted providers that help us run Formeze, and only as needed to operate the service. Our AI models — semantic matching and form-field detection — run on our own infrastructure, not a third-party AI provider.
AI-assisted features run on models we operate — including the detection container Modal hosts for us — never a third-party AI provider, and no saved field data leaves Formeze for AI processing.
Vetted sub-processors / No third-party AI
Retention & deletion
Saved account data is kept while the account is active, subject to applicable retention settings. Browser scan state expires after at most 30 minutes. Consented training captures remain until you delete those samples, delete the account, or an applicable retention rule removes them. Account deletion removes primary database rows and queues known embedding cleanup, but historical provider-only vectors and retained security/audit records can remain outside that immediate operation. Deletion from primary storage does not rewrite already completed, approved model artifacts; future model releases exclude withdrawn source samples.
30-minute browser scan state / Training deletion control / Account deletion
Questions about your data
If you have a privacy question, or want to exercise your rights to export or delete your data, get in touch.