FORMA

Privacy Policy

This Privacy Policy explains how Wellington Web Co ("Forma", "we", "us") collects, uses and protects your information when you use the Forma website and app (the "Service").

1. Information we collect

• Photos you submit. Images you upload or capture for facial analysis.
• Analysis results. The scores, measurements and plans generated from your photos.
• Account and contact data. Email address and any name or profile details you provide. If you create an account, your account details and your scan analysis data (scores, breakdowns and dates, never the photos) are stored securely so they sync across your devices.
• Purchase data. Records of single payments and subscriptions (handled by our payment processors; we do not store full card numbers).
• Usage data. Device type, app interactions and diagnostics used to operate and improve the Service.

2. How we use your information

• To generate and deliver your facial analysis and improvement plan.
• To create and manage your account and deliver your report.
• To process payments and provide customer support.
• To maintain, secure and improve the Service.
• To send you communications about the Service (and marketing only where you have consented; you can opt out at any time).

3. Your photos, face data and third party AI processing

Face data. The photos you submit are images of a face, which are a form of face data. Forma uses this face data for one purpose only: to compute the facial analysis, scores and improvement plan you asked for. We do not create, derive or store a faceprint, face template or any other biometric identifier, and we do not use face data to recognise, identify or track you or anyone else across sessions, apps or services. Your face data is never used for advertising and is never used to train AI models. It is never sold, and it is never shared with anyone other than the AI processors named below, who act only on our instructions to generate your result. Face data is deleted as soon as your analysis has been delivered, and in all cases within 72 hours, after which it is permanently removed. Your face photos are never part of cloud sync or long term storage: only the analysis results (scores, breakdowns and dates) sync between your devices, never the images themselves.

To produce your analysis, photos you submit are sent to third party AI providers, currently OpenAI (GPT-4o vision) and Google Cloud Vision, solely to compute your results. They are processed to generate your analysis, are not sold and are not used for advertising. We do not retain your photos on our own servers for the analysis itself.

If you choose to receive your report by email (an optional opt in), your photos are held securely only so we can prepare and verify that report. They are deleted automatically as soon as your report is sent, and in all cases within 72 hours, after which they are permanently removed. We never keep your photos longer than that, and never sell or share them.

4. Service providers we share data with

• OpenAI, Google Cloud Vision: facial analysis processing.
• Stripe: web payments.
• Apple App Store / Google Play / RevenueCat: in app subscriptions and purchases.
• Resend: sending your report by email, if you opt in.
• Vercel, Upstash: hosting and the short term (maximum 72 hour) storage used only to prepare emailed reports.
• Supabase: account authentication and encrypted database hosting for cross-device sync of your account and analysis data (never your photos).

Each processes data only as needed to provide their function, under their own terms and privacy policies.

5. Your rights

Depending on where you live (including under UK GDPR and GDPR), you may have the right to access, correct, delete or export your data and to object to or restrict certain processing. You can delete your account and the data stored on your device at any time from the Profile screen in the app. To exercise any other rights, contact us at contact@wellingtonwebco.com.

6. Data retention

We keep account and analysis data for as long as your account is active or as needed to provide the Service, then delete or anonymise it unless we are required to keep it for legal reasons.

7. Children

The Service is not directed to children under 16. We do not knowingly collect data from anyone under that age.

8. Security

We use reasonable technical and organisational measures to protect your data. No method of transmission or storage is completely secure and we cannot guarantee absolute security.

9. Changes

We may update this policy from time to time. Material changes will be posted here with an updated date.

10. Contact

Wellington Web Co, Edinburgh, Scotland. Questions: contact@wellingtonwebco.com.

← Back to Forma