Privacy Policy

1. Information We Collect

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service.
• Create and manage your account and process payments.
• Send transactional emails (e.g., account verification, billing receipts, password resets).
• Send product updates and marketing communications where you have consented or where permitted by law. You may opt out at any time.
• Power AI-assisted features, such as forecast analysis and suggestions, using aggregated or de-identified data where feasible.
• Detect, investigate, and prevent fraud, security incidents, and abuse.
• Comply with legal obligations.

3. How We Share Your Information

We do not sell your personal data. We may share information with:

• Service providers — third-party vendors who help us operate the Service (e.g., cloud hosting, payment processing, email delivery, analytics). These vendors are contractually obligated to handle data only on our behalf and in accordance with this policy.
• AI model providers — anonymized or de-identified forecast context may be sent to AI providers (e.g., Anthropic) solely to generate responses within the Service. We do not permit these providers to use your data to train their general models.
• Business transfers — in connection with a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data becomes subject to a materially different privacy policy.
• Legal requirements — when required by law or to protect the rights, property, or safety of Formulate, our users, or the public.

4. Data Retention

We retain your account data and forecast data for as long as your account is active, or as necessary to provide the Service. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal or compliance purposes (e.g., billing records for tax purposes, typically 7 years).

5. Security

We use industry-standard safeguards including TLS encryption in transit, AES-256 encryption at rest, and access controls to protect your data. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security. If you become aware of any security vulnerability, please contact us immediately at security@formulate.app.

6. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your personal data, subject to legal retention requirements.
• Portability — receive your data in a structured, machine-readable format.
• Objection / Restriction — object to or request restriction of certain processing activities.
• Withdraw consent — where processing is based on consent, withdraw that consent at any time.

To exercise any of these rights, contact us at support@formulateinc.com. We will respond within 30 days.

7. Cookies

We use the following categories of cookies:

• Strictly necessary — authentication tokens and session management. These cannot be disabled.
• Functional — remember your preferences such as selected year and view mode.
• Analytics — aggregate usage statistics to help us improve the Service. You may opt out via your browser settings or an opt-out link in our cookie banner.

You can control cookies through your browser settings. Disabling strictly necessary cookies will prevent you from logging in.

8. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

9. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

10. International Data Transfers

Your data may be transferred to and processed in countries other than your own. Where required, we use Standard Contractual Clauses or other appropriate safeguards to protect your data during international transfers.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a prominent notice in the Service at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.